- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Splunk Free License and Free Forwarding
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I recently downloaded Splunk. Right now, I am using the free license that came with Splunk software on three different servers. Is that ok? Or do I need a different free license for each instance of Splunk I have? If so, how do I get more free licenses?
I can also use forwarding with the free version of Splunk, correct? And how much data can I forward with the free version?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'd suggest that you check out http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree for a lot more details about the Free vs Enterprise.
But, to answer your specific questions:
- You can use the same free license, just remember you will have the limitations listed in the above link.
- Yes you can. There's an actual splunk-forwarder.license - you can rename that to splunk.license and you're set.
- It's not so much about the amount of data you can forwarder, it's the amount you index. The daily limit for indexing data is 500MB with a caveat. You can index as much as you want, but if you go over that limit 3 times in a 30 day period, searching will be disabled. For example, if you had 10gigs worth of data you wanted to index all at once, you can.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I found this link that talk about the features that you lost when use a Free license.
http://docs.splunk.com/Documentation/Splunk/4.3/Admin/TypesofSplunklicenses#Free_license
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'd suggest that you check out http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree for a lot more details about the Free vs Enterprise.
But, to answer your specific questions:
- You can use the same free license, just remember you will have the limitations listed in the above link.
- Yes you can. There's an actual splunk-forwarder.license - you can rename that to splunk.license and you're set.
- It's not so much about the amount of data you can forwarder, it's the amount you index. The daily limit for indexing data is 500MB with a caveat. You can index as much as you want, but if you go over that limit 3 times in a 30 day period, searching will be disabled. For example, if you had 10gigs worth of data you wanted to index all at once, you can.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So i could index 50GB in a single time and not be limited as i only did it once ?
Suppose i do get limited i can search that data after my searching gets re-enabled ?
How long is searching disabled ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can only index 1 Mb a day locally. But in forwarder mode, you are forwarding all your data to another indexer, so nothing should be indexed locally, so the "1 MB limit" really doesn't limit you in any way.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'd say no, otherwise I'd be in trouble since I forward gigs a day using the free license 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the help! The main issue I have with using the the forward license is that it says I can only forward up to 1 MB per day. Any truth to that?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
