Splunk itsi

[arhaan015]

Hi team,

I have a standalone production instance and on which splunk ITSI was running.

Daily ingestion:- 50gb

Itsi license:- 20gn

It's license got expired so my team purchased a new itsi license but when I am pushing the new licesnse, splunk is deleting the enterprise license and its throwing warning license exceed

MY QUESTIONS ARE :-

1) HOW ITSI LICENSE IS CALCULATED?

2) STEPS TO CREATE A STACK OF LICENSE ON SPLUNK

3) CAN I CREATE A STACK OF ENTERPRISE AND ITSI LICESNSE?

[eduncan]

ITSI license is calculated by the events or data written to the itsi summary index.  It doesn't charge for what is ingested in to splunk rather what ITSI is ingesting into it's engine.  You need to look at how much data is being written to the itsi_summary index each day and that is your daily ingest.