Is there a way to setup license pools on the license master to control/allocate individual index allowance.
I can only see how to allocate Indexers to pools, rather than an individual index on that Indexer.
Any update on later versions?
Can we use index to specific pool?
Controlling license usage by index involves either data parsing or bandwidth throttling through a heavy forwarder. The consequences are that either you will not see some data, or you will see it arrive late when such controls are in effect. The most ideal solution is to go straight to the source. Undesired data can be removed from the logs at the source through log level settings through the application. Logging can be set to sparse, normal, or verbose in some applications, while in others specific fields can be toggled for logging.
When this functionality will be presently in new splunk version. it makes more sense to assign license usage per index or sourcetype and doesn't impact other data collection.
I also would like this functionality. We should both raise enhancement requests for it.
Does Splunk 6.x provide the capability of setting License pools for Indexes rather than Indexers?
That functionality is not presently available. The only way to accomplish this presently would be to reserve specific indexers for explicit indexes and get the correct data to its respective indexer.
marking answer as relevant to versions 4.2 & 4.3, for posterity
I also would like this functionality. We should both raise enhancement requests for it.
cheers bw.
I was thinking that might be the only way forward.