Export data during license violation

[pettuv01]

Hi, Is it possible to export/archive data during license violation causing search function lockdown?

In our case we have seen license violation warnings during system integration. And It might cause search function lockdown....
We are certain that during production environment we will not be seeing large amount of logs and risking a license violation.

However it is important that we can export/archive regularly even if there would be a license violation in the future that would lock down the search function.

Grateful for clarity on this issue!

[isoutamo]

My understanding is that all searches (incl. exports, which needs search) will be blocked. But prior 8.1. (from 6.x) you should have non blocking license. After 8.1. that is not possible under 100GB licenses. But at same time those limits has changed to 45 times/60 days (instead of old 5/30d).

https://www.splunk.com/en_us/resources/splunk-enterprise-license-enforcement-faq.html

Still there are those unlock license which you could get from your splunk support/account manger/partner. But I suppose that after that you must increase your current license too.....

r. Ismo

[gcusello · Accepted solution]

Hi @pettuv01,

I'm sorry!

I think that you cannot export/archive data when you're in violation because searches are blocked and every action in Splunk starts from a search.

The only chance is that you ask to your Splunk Channel Manager (if you're a Splunk Partner) or to your Splunk Partner (if you're a Customer) to have an unlock license, that solves the momentary problems but if you continue to exceed license you'll have a new violation.

Why don't you use your production license also for the development phase?

Ciao.

Giuseppe