All new Splunk licenses are no-enforcement licenses (as of Splunk 6.5). However, as far as I can tell this no-enforcement policy doesn't exist if the License Server is down. If this server is down for 72 hours, search is no longer available.
Is this correct? If so, why is the no-enforcement policy true for licensing violations but not for a server being inaccessible?
As @richgalloway mentioned, the no-enforcement clause is specified in the license file. If the license master goes down, and splunk isn't able to validate that a license exists, it'll assume you have no license (or only a free/trial license).
As @richgalloway mentioned, the no-enforcement clause is specified in the license file. If the license master goes down, and splunk isn't able to validate that a license exists, it'll assume you have no license (or only a free/trial license).
I have weird question here, the license master is not down but sometimes we are getting an error saying the indexers cannot contact the license master because max thread limit for REST HTTP server(license master) already in use. So in this case the ingestion and searching get effected or not. Please let me know.
Just a guess, but without a license master Splunk doesn't know if you have a no-enforcement license or not. The no-enforcement indication is in the license, not the code.
--- If this reply helps you, Karma would be appreciated.
