Splunk No Enforcement License

[rohitvjoshi]

HI All ,

We having Splunk no enforcement license and we are breaching it almost everyday.As per name suggest their is no impact if we breach some data.

If we breach the license,do we have any operational impact, bar having to pay to increase the usage figure to splunk?

I am not clear after reading the documents ,please help me on this.

Thanks
Rohit

[judithsr]

Effective October 2020, Splunk licensing policy has been updated to include conditional license enforcement for license stack volumes less than 100GB. 

Starting with Splunk Enterprise 8.1.0 for on-premises license stacks less than 100 GB, Splunk will disable search when total usage (across the stack and all license pools) exceeds license capacity and you receive 45 warnings over a 60-day window.

For more details and further questions, check out the Licensing Enforcement FAQ.

[cimey]

Hello @judithsr 

in that context, what would happen. When there is a 50GB Enterprise license withe the "no enforcement" key? (so below 100GB) Will the search still be turned off in that case?

Best regards

[nickhills · Accepted solution]

The No-enforce license takes no action if you exceed your agreed limit.

Conversely, if you were on the "Standard" license, you would be prevented from running searches after 5 violations in a rolling 30 day window.

The main difference (other than the lack of 'enforcement') is your obligation to report to Splunk your actual licence usage, so your account manager can assess if your current license is suitable for your use. - It sounds like you might be due a review.