All Apps and Add-ons

Splunk No Enforcement License

rohitvjoshi
Path Finder

HI All ,

We having Splunk no enforcement license and we are breaching it almost everyday.As per name suggest their is no impact if we breach some data.

If we breach the license,do we have any operational impact, bar having to pay to increase the usage figure to splunk?

I am not clear after reading the documents ,please help me on this.

Thanks
Rohit

0 Karma
1 Solution

nickhills
Ultra Champion

The No-enforce license takes no action if you exceed your agreed limit.

Conversely, if you were on the "Standard" license, you would be prevented from running searches after 5 violations in a rolling 30 day window.

The main difference (other than the lack of 'enforcement') is your obligation to report to Splunk your actual licence usage, so your account manager can assess if your current license is suitable for your use. - It sounds like you might be due a review.

If my comment helps, please give it a thumbs up!

View solution in original post

judithsr
Splunk Employee
Splunk Employee

Effective October 2020, Splunk licensing policy has been updated to include conditional license enforcement for license stack volumes less than 100GB. 

Starting with Splunk Enterprise 8.1.0 for on-premises license stacks less than 100 GB, Splunk will disable search when total usage (across the stack and all license pools) exceeds license capacity and you receive 45 warnings over a 60-day window.

For more details and further questions, check out the Licensing Enforcement FAQ.

0 Karma

cimey
Loves-to-Learn

Hello @judithsr 

in that context, what would happen. When there is a 50GB Enterprise license withe the "no enforcement" key? (so below 100GB) Will the search still be turned off in that case?

Best regards

0 Karma

nickhills
Ultra Champion

The No-enforce license takes no action if you exceed your agreed limit.

Conversely, if you were on the "Standard" license, you would be prevented from running searches after 5 violations in a rolling 30 day window.

The main difference (other than the lack of 'enforcement') is your obligation to report to Splunk your actual licence usage, so your account manager can assess if your current license is suitable for your use. - It sounds like you might be due a review.

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...