Enterprise Security does not measure anything. It's licensed based on your "main" license ingestion limit. There is no possiblity to have - for example - a Splunk Enterprise license for 50GB daily ingestion volume and Enterprise Security License for 15GB. If you have a license for Splunk Enterprise for 50GB, you must buy a ES license for 50GB as well. If you exceed your daily ingestion, normal Splunk Enterprise mechanisms kick in. ... View more

I know my question is very general, but yes I will like to know,  how I can know if the logs come from different environments.  and know which one.  ... View more

You shouldn't need to disclose anything about the project other than the number of GB you need for the license.  Your Account Team should be able to tell you what license options are available. ... View more