All Apps and Add-ons

License Duplicate

ahmedhassanean
Explorer

Dears,

i have scenario where i have three nodes
node one master and indexer and searh head
node two indexer and search head
node three heavy forwarder

all three node are configure as license slave for node 1

now i have configure node three heavy forwarder to forwardandindex locally then send data to node one and two
but in license i can see that license count double is that normal

?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Yes it's normal because you index twice your logs, it's the same thing to send logs to two different Indexers without autoloadbalancing.
To not duplicate license consuption the onlu way is not index locally and use remote indexed events also For local search.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...