Deployment Architecture

Duplicating Events without license impact

shocko
Contributor

Guys, I have Splunk Enterprise 6.1.4 (don't ask why I haven't upgraded. I have my reasons !). I have several forwarders (7.x) forwarding to an indexer in this infrastructure but I also wish to forward a subset of this data to my Splunk free instance. How to do this:

  • forward directly from forwarder (messy as need firewall rules to my free instance etc.)
  • forward from indexer

Wondering if I do it from the indexer do I get hit with a double license cost at my existing indexer?

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @shocko,
if the events in the free license are less that 500MB/day, you'll pay only on the main installation, otherwise, you'll pay twice in both your situations.
To not pay twice, you have to configure an Indexers' Cluster (not with free license!).

Beware using a newest version of UFs than Indexers, there could be problems and Splunk Support could not help you..

Ciao.
Giuseppe

shocko
Contributor

Yes indeed they amount to ~ 200 MB so Splunk Free will do. I was wondering though how to configure the indexer to index and forward.

0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...