Installation

Export data during license violation

pettuv01
Engager

Hi, Is it possible to export/archive data during license violation causing search function lockdown?

In our case we have seen license violation warnings during system integration. And It might cause search function lockdown....
We are certain that during production environment we will not be seeing large amount of logs and risking a license violation.

However it is important that we can export/archive regularly even if there would be a license violation in the future that would lock down the search function.

Grateful for clarity on this issue!

Labels (1)
0 Karma
1 Solution

gcusello
Legend

Hi @pettuv01,

I'm sorry!

I think that you cannot export/archive data when you're in violation because searches are blocked and every action in Splunk starts from a search.

The only chance is that you ask to your Splunk Channel Manager (if you're a Splunk Partner) or to your Splunk Partner (if you're a Customer) to have an unlock license, that solves the momentary problems but if you continue to exceed license you'll have a new violation.

Why don't you use your production license also for the development phase?

Ciao.

Giuseppe

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

My understanding is that all searches (incl. exports, which needs search) will be blocked. But prior 8.1. (from 6.x) you should have non blocking license. After 8.1. that is not possible under 100GB licenses. But at same time those limits has changed to 45 times/60 days (instead of old 5/30d).

https://www.splunk.com/en_us/resources/splunk-enterprise-license-enforcement-faq.html

Still there are those unlock license which you could get from your splunk support/account manger/partner. But I suppose that after that you must increase your current license too.....

r. Ismo

gcusello
Legend

Hi @pettuv01,

I'm sorry!

I think that you cannot export/archive data when you're in violation because searches are blocked and every action in Splunk starts from a search.

The only chance is that you ask to your Splunk Channel Manager (if you're a Splunk Partner) or to your Splunk Partner (if you're a Customer) to have an unlock license, that solves the momentary problems but if you continue to exceed license you'll have a new violation.

Why don't you use your production license also for the development phase?

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...