Getting Data In

Splunk Free License and Free Forwarding

ericmoss
Explorer

I recently downloaded Splunk. Right now, I am using the free license that came with Splunk software on three different servers. Is that ok? Or do I need a different free license for each instance of Splunk I have? If so, how do I get more free licenses?

I can also use forwarding with the free version of Splunk, correct? And how much data can I forward with the free version?

1 Solution

Brian_Osburn
Builder

I'd suggest that you check out http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree for a lot more details about the Free vs Enterprise.

But, to answer your specific questions:

  1. You can use the same free license, just remember you will have the limitations listed in the above link.
  2. Yes you can. There's an actual splunk-forwarder.license - you can rename that to splunk.license and you're set.
  3. It's not so much about the amount of data you can forwarder, it's the amount you index. The daily limit for indexing data is 500MB with a caveat. You can index as much as you want, but if you go over that limit 3 times in a 30 day period, searching will be disabled. For example, if you had 10gigs worth of data you wanted to index all at once, you can.

View solution in original post

gerardo_maya
Splunk Employee
Splunk Employee

I found this link that talk about the features that you lost when use a Free license.

http://docs.splunk.com/Documentation/Splunk/4.3/Admin/TypesofSplunklicenses#Free_license

Brian_Osburn
Builder

I'd suggest that you check out http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree for a lot more details about the Free vs Enterprise.

But, to answer your specific questions:

  1. You can use the same free license, just remember you will have the limitations listed in the above link.
  2. Yes you can. There's an actual splunk-forwarder.license - you can rename that to splunk.license and you're set.
  3. It's not so much about the amount of data you can forwarder, it's the amount you index. The daily limit for indexing data is 500MB with a caveat. You can index as much as you want, but if you go over that limit 3 times in a 30 day period, searching will be disabled. For example, if you had 10gigs worth of data you wanted to index all at once, you can.

gwcon
Path Finder

So i could index 50GB in a single time and not be limited as i only did it once ?
Suppose i do get limited i can search that data after my searching gets re-enabled ?
How long is searching disabled ?

0 Karma

Lowell
Super Champion

You can only index 1 Mb a day locally. But in forwarder mode, you are forwarding all your data to another indexer, so nothing should be indexed locally, so the "1 MB limit" really doesn't limit you in any way.

Brian_Osburn
Builder

I'd say no, otherwise I'd be in trouble since I forward gigs a day using the free license 🙂

0 Karma

ericmoss
Explorer

Thanks for the help! The main issue I have with using the the forward license is that it says I can only forward up to 1 MB per day. Any truth to that?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...