This is actually a question to your local Splunk sales representative (or your local Partner since you're probably purchasing licenses through a Partner). Typically your ES license must match your main SE license volumewise and I've never seen it otherwise. The general idea is that all data you are indexing can be used for ES purposes so the only case where you might be able to have a "partial" ES situation would be if you had two separate licences for two separate environments - one with ES and one without. But that in itself is not something you'll easily get.- honestly I'm not sure if you can get such deal unless you are a huuuuuge customer and have completely disconnected environments (otherwise you're supposed to use a single license manager and split your license into separate licensing stacks). Bottom line is - your ES license must match the size of your main SE license and it is highly unlikely you'll get it otherwise.
... View more