I'm planning an environment where I want to have all my universal forwarder clients to a local splunk server and this server makes the forwarder to an instance in the cloud.
do I need to buy an extra local license to the cloud license?
Splunk licensing (official documentation here) is measured in terms of indexed data per day, the size measured is raw data size and normally purchased in GB/day.
The source that forwarded the data should not make any difference to your licensing / cloud purchase.
The volume of data per day is going to influence how much license you require in your cloud (or on prem instance).
Forwarders do not require a license to forward data, you can use the forwarder license on heavy forwarders or point them to a license master, either way the license will not be used for forwarding of data.
Hey @tomasnelson, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂
Splunk licensing (official documentation here) is measured in terms of indexed data per day, the size measured is raw data size and normally purchased in GB/day.
The source that forwarded the data should not make any difference to your licensing / cloud purchase.
The volume of data per day is going to influence how much license you require in your cloud (or on prem instance).
Forwarders do not require a license to forward data, you can use the forwarder license on heavy forwarders or point them to a license master, either way the license will not be used for forwarding of data.