Getting Data In
Highlighted

Splunk Free License and Free Forwarding

Explorer

I recently downloaded Splunk. Right now, I am using the free license that came with Splunk software on three different servers. Is that ok? Or do I need a different free license for each instance of Splunk I have? If so, how do I get more free licenses?

I can also use forwarding with the free version of Splunk, correct? And how much data can I forward with the free version?

Highlighted

Re: Splunk Free License and Free Forwarding

Builder

I'd suggest that you check out http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree for a lot more details about the Free vs Enterprise.

But, to answer your specific questions:

  1. You can use the same free license, just remember you will have the limitations listed in the above link.
  2. Yes you can. There's an actual splunk-forwarder.license - you can rename that to splunk.license and you're set.
  3. It's not so much about the amount of data you can forwarder, it's the amount you index. The daily limit for indexing data is 500MB with a caveat. You can index as much as you want, but if you go over that limit 3 times in a 30 day period, searching will be disabled. For example, if you had 10gigs worth of data you wanted to index all at once, you can.

View solution in original post

Highlighted

Re: Splunk Free License and Free Forwarding

Explorer

Thanks for the help! The main issue I have with using the the forward license is that it says I can only forward up to 1 MB per day. Any truth to that?

0 Karma
Highlighted

Re: Splunk Free License and Free Forwarding

Builder

I'd say no, otherwise I'd be in trouble since I forward gigs a day using the free license 🙂

0 Karma
Highlighted

Re: Splunk Free License and Free Forwarding

Super Champion

You can only index 1 Mb a day locally. But in forwarder mode, you are forwarding all your data to another indexer, so nothing should be indexed locally, so the "1 MB limit" really doesn't limit you in any way.

Highlighted

Re: Splunk Free License and Free Forwarding

Explorer

So i could index 50GB in a single time and not be limited as i only did it once ?
Suppose i do get limited i can search that data after my searching gets re-enabled ?
How long is searching disabled ?

0 Karma
Highlighted

Re: Splunk Free License and Free Forwarding

Splunk Employee
Splunk Employee

I found this link that talk about the features that you lost when use a Free license.

http://docs.splunk.com/Documentation/Splunk/4.3/Admin/TypesofSplunklicenses#Free_license