Installation

Multiple licenses, violation warnings and search lockout.

hanoc
Engager

We are planning to split up our environments into different licenses.

My questions are:

  1. should we have a violation on an individual license does that add to a global or individual (to the license) violation total.

  2. What will be the effect should we have 5 violations (within the rolling window) on a single license. Search blackout on that license or globally.

The use case I really want to avoid is e.g. 5 violations from different licenses causing a global search blackout or 5 violations on a lower priority license (from our perspective, e.g. dev environment) causing a global search blackout.

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

It all depends on how you stack the licenses. If you have a single license master with all the licenses installed, and carved up, a global blackout would be caused by 5 violations. If you have multiple license masters, then you would have individual license blackouts. You can also get a reset license rather quickly if you need it. I would also suggest a "Dev license" (10GB) for use in your Dev Environment. That way you don't have to worry about dev impacting prod.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

It all depends on how you stack the licenses. If you have a single license master with all the licenses installed, and carved up, a global blackout would be caused by 5 violations. If you have multiple license masters, then you would have individual license blackouts. You can also get a reset license rather quickly if you need it. I would also suggest a "Dev license" (10GB) for use in your Dev Environment. That way you don't have to worry about dev impacting prod.

hanoc
Engager

Great advice, thank you. I will be standing up some new license masters very shortly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...