"So, the old, enforced license will
continue to be available, In fact,
this is the default? The new,
non-enforced license can be received
after some kind of negotiation?"
Correct, you need to talk to your sales rep who will cut you a new license with the non-enforcement flag that you will stack on your existing license.
Such questions arose:
what kind of data collected - well, it
looks good in the doc, but the more
information is, the easier it is for
internal approval
The document is quite clear, including data samples and location of the log files where the info comes from. If you have further questions contact your account team who will, I'm sure, be happy to explore further with you in your environment. HINT: check out $SPLUNK_HOME/etc/apps/splunk_instrumentation
# the default schedule for running the scripted input is 3:05 AM daily.
# Please override this value in system/local/inputs.conf to specify custom schedule
[script://./bin/instrumentation.py]
interval = 5 3 * * *
index=_telemetry
passAuth = splunk-system-user
disabled=false
where the data been sent:
url/ip/port/protocol? We need to
configure the firewalls. Is proxy
supported?
It is sent back over SSL. Proxy is supported, yes.
I used Splunk Stream to capture the traffic. You would need to open *.api.splunkmobile.com:443
if we choose to send reports manually,
where to upload?
You will need to speak to your account rep to clarify what if any requirements will be asked of you.
if we choose to send reports manually,
what happens if we forget to upload
for a period of time?
We trust our customers and work on the honor system for much of our licensing enforcement. lol I am sure this won't be an issue for you and your account team.
if we choose to send reports manually,
how often do I need to send it?
Talk to your account team.
what happens when a new (internal)
regulation forbid to continue upload
usage reports?
Cross that bridge when you get there. Like I said, this is in place for the benefit of our customers, not to make things harder for you to manage Splunk. The no enforcement has been introduced because Splunk has become part of critical monitoring and reporting infrastructure in our client environments, and killing your ability to search due to massive spikes in data, when you may need us the most, is not a crowd pleaser.
... View more
