topic Splunk free license on production system in Splunk Enterprise

Splunk free license on production system

dkr3500 — Mon, 12 Feb 2024 15:52:28 GMT

Hello,

I'm trying to get a solid answer on what Splunk's laws are regarding using the Splunk Enterprise free license (0.50 GB/day) on a production system in a for-profit company. Is this allowed or are we required to buy the 1GB minimum license?

From the Splunk Enterprise download site: https://www.splunk.com/en_us/download/splunk-enterprise.html, it clearly states that "After 60 days you can convert to a perpetual free license...", so if my ingestion is below the 500MB/day limit, but the license in on a production system, is this legal or would I have to buy a 1GB license?

Note, I haven't actually deployed Splunk Enterprise on a production system, I'm gathering all the facts before I make the move to production.

Thanks.

Re: Splunk free license on production system

richgalloway — Mon, 12 Feb 2024 16:23:00 GMT

IANAL, but the word "can" conveys ability rather than requirement. IOW, you have the option to convert to a perpetual free license, but it is not mandatory.

When you download Splunk, it will include the full license agreement, which by my reading, has no restrictions on production use (provided "production" does not include reselling or other prohibited use as listed in the license).

I should also mention that the free license does not permit access to Splunk Support. Also, after the trial period the free license allows for standalone instances only - no separate search heads and indexers, for instance.

Re: Splunk free license on production system

PickleRick — Mon, 12 Feb 2024 17:53:54 GMT

https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/TypesofSplunklicenses#Other_types_of_licenses

[...]

Free license

The Free license allows a completely free Splunk Enterprise instance with limited functionality and license usage. The following important points apply to the Free license:

The Free license gives access to a limited set of Splunk Enterprise features.
The Free license is for a standalone, single-instance installation of Splunk Enterprise only.
The Free license cannot be stacked with other licenses.
The Free license does not expire.
The Free license allows you to index 500 MB of data per day. If you exceed that you will receive a license warning.
The Free license prevents searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?

For a list of features that are disabled in Splunk Free, see About Splunk Free.

[...]

So while it doesn't impose any limits on commercial vs. non-commercial use, the features that are disabled make it very challenging for production use of any kind. While in some scenarios you could probably get away without scheduled searches, the lack of ability to create users would probably disqualify the free license in all my use cases.