Installation

Export data during license violation

pettuv01
Engager

Hi, Is it possible to export/archive data during license violation causing search function lockdown?

In our case we have seen license violation warnings during system integration. And It might cause search function lockdown....
We are certain that during production environment we will not be seeing large amount of logs and risking a license violation.

However it is important that we can export/archive regularly even if there would be a license violation in the future that would lock down the search function.

Grateful for clarity on this issue!

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @pettuv01,

I'm sorry!

I think that you cannot export/archive data when you're in violation because searches are blocked and every action in Splunk starts from a search.

The only chance is that you ask to your Splunk Channel Manager (if you're a Splunk Partner) or to your Splunk Partner (if you're a Customer) to have an unlock license, that solves the momentary problems but if you continue to exceed license you'll have a new violation.

Why don't you use your production license also for the development phase?

Ciao.

Giuseppe

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

My understanding is that all searches (incl. exports, which needs search) will be blocked. But prior 8.1. (from 6.x) you should have non blocking license. After 8.1. that is not possible under 100GB licenses. But at same time those limits has changed to 45 times/60 days (instead of old 5/30d).

https://www.splunk.com/en_us/resources/splunk-enterprise-license-enforcement-faq.html

Still there are those unlock license which you could get from your splunk support/account manger/partner. But I suppose that after that you must increase your current license too.....

r. Ismo

gcusello
SplunkTrust
SplunkTrust

Hi @pettuv01,

I'm sorry!

I think that you cannot export/archive data when you're in violation because searches are blocked and every action in Splunk starts from a search.

The only chance is that you ask to your Splunk Channel Manager (if you're a Splunk Partner) or to your Splunk Partner (if you're a Customer) to have an unlock license, that solves the momentary problems but if you continue to exceed license you'll have a new violation.

Why don't you use your production license also for the development phase?

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...