Splunk ITSI

Questions regarding ITSI licensing and requirements

johannamayer
New Member

Hi Splunkers, this might be a dumb question but I am a bit confused in regard to ITSI licensing.

I understand that ITSI requires an ingest of at least 50GB as well as a separate ITSI license in addition to the Splunk Core license. Does that mean a 50GB Core license and a 0GB ITSI license? Or could you get a 0GB Core license (like you would use on a HF that doesn't ingest anything) and a 50GB ITSI license? 

And can both be installed in the same place in the GUI of the license master or is there a special process for the ITSI license?

Labels (2)
0 Karma

skramp
SplunkTrust
SplunkTrust

You have to buy both, the core license and the itsi license. ITSI only works if you buy a license for it and a core license is also installed. That means in your example, 50GB core and 50GB ITSI. The ITSI license doesn't include core.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...