topic Re: Splunk License Hard Warning in Installation

Splunk License Hard Warning

rohitvjoshi — Mon, 15 Jun 2020 18:02:03 GMT

Hi Splunkers ,

We having 100 GB to license ,Out of 100 GB , we have 50 GB License having "Splunk Enterprise - No Enforcement (6.5 )" and Rest 50GB having "Splunk Enterprise " License.Due to high flow of logs we have exceeded license 3 times in this rolling month. What will be impact if we cross 5 HARD WARNINGS in upcoming weeks ? We went throught the SPlunk Documentation , I am having bit confusion beacuse we having 2 differnt type of Licenses with us .

Thanks
RJ

Re: Splunk License Hard Warning

dkeck — Thu, 17 Jan 2019 09:37:13 GMT

Hi,

your No Enforcement License should have a GB volume of 0 and its only use is that your search function is not blocked if you exceed your license 5 times. So as long as you have a license like that and your stack has a "No Enforcement " in it you should be good even if you exceed it.

The license without "No Enforcement" are probably just older than 6.5. You can check the creation_time in All licenses details on your license master. Newer license 6.5 and older (just guessing) are named Splunk No Enforcement 6.5 .

Kind Regards

Re: Splunk License Hard Warning

mayurr98 — Thu, 17 Jan 2019 10:03:17 GMT

Starting with version 6.5, Splunk Enterprise no longer disables search when you exceed your licensed data ingestion quota. Users can keep searching even if the license master acquires five license violation warnings in a 30 day window. The license master is still in violation, but search is no longer blocked.

have a look at this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/TypesofSplunklicenses#No-enforcement_license

Also have you gone through splunk enterprise license FAQ's
https://www.splunk.com/en_us/resources/splunk-enterprise-metered-license-enforcement-faq.html

let me know if this helps!