Installation

Export data during license violation

pettuv01
Engager

Hi, Is it possible to export/archive data during license violation causing search function lockdown?

In our case we have seen license violation warnings during system integration. And It might cause search function lockdown....
We are certain that during production environment we will not be seeing large amount of logs and risking a license violation.

However it is important that we can export/archive regularly even if there would be a license violation in the future that would lock down the search function.

Grateful for clarity on this issue!

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @pettuv01,

I'm sorry!

I think that you cannot export/archive data when you're in violation because searches are blocked and every action in Splunk starts from a search.

The only chance is that you ask to your Splunk Channel Manager (if you're a Splunk Partner) or to your Splunk Partner (if you're a Customer) to have an unlock license, that solves the momentary problems but if you continue to exceed license you'll have a new violation.

Why don't you use your production license also for the development phase?

Ciao.

Giuseppe

View solution in original post

soutamo
SplunkTrust
SplunkTrust

My understanding is that all searches (incl. exports, which needs search) will be blocked. But prior 8.1. (from 6.x) you should have non blocking license. After 8.1. that is not possible under 100GB licenses. But at same time those limits has changed to 45 times/60 days (instead of old 5/30d).

https://www.splunk.com/en_us/resources/splunk-enterprise-license-enforcement-faq.html

Still there are those unlock license which you could get from your splunk support/account manger/partner. But I suppose that after that you must increase your current license too.....

r. Ismo

gcusello
SplunkTrust
SplunkTrust

Hi @pettuv01,

I'm sorry!

I think that you cannot export/archive data when you're in violation because searches are blocked and every action in Splunk starts from a search.

The only chance is that you ask to your Splunk Channel Manager (if you're a Splunk Partner) or to your Splunk Partner (if you're a Customer) to have an unlock license, that solves the momentary problems but if you continue to exceed license you'll have a new violation.

Why don't you use your production license also for the development phase?

Ciao.

Giuseppe

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!