Installation

How can a FREE license expire?

mikeraffety
Explorer

I have a FREE license, yet I get the error "Your Splunk license expired or you have exceeded your license limit too many times". It appears you're trying to ensure that temporary bursts over the limit are still processed, but this just means that I lose search access entirely after a few days, which is worse (then I need a silly thing called a "reset license"!).

How about an alternative FREE license which strictly enforces the limit, but never ever denies you access to searching your data? This is far more "common sense".

Labels (1)
Tags (1)

piebob
Splunk Employee
Splunk Employee

the answer to the question asked in the title of this posting is: the license isn't expiring. it is enforcing the terms of that license as documented. once your deployment has fewer than 3 violations within the noted 30-day period, you will once again be able to use Splunk to search your data, indefinitely.

in the meantime, i recommend you reduce the volume of your inputs so that you no longer violate the terms of the license more than twice in a given 30-day period. here is additional information from the official product documentation about the intended use cases for Splunk Free:

"Splunk Free is designed for personal, ad-hoc search and visualization of IT data. You can use Splunk Free for ongoing indexing of small volumes (<500 MB/day) of data. Additionally, you can use it for short-term bulk-loading and analysis of larger data sets--Splunk Free allows you to bulk-load much larger data sets up to 3 times within a 30 day period. This can be useful for forensic review of large data sets."

( http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree )

note that Splunk Free is intended for personal use. if you are using Splunk Free in an enterprise environment, and require access to support under an SLA, i recommend you purchase a license.

mikeraffety
Explorer

Sounds great -- except for the "gotcha" if you give Splunk more data than the license allows. I cannot think of any other use-limited license that reacts to over-use by shutting down. Use-limited licenses should enforce the license limits, not deactivate.

I don't need any support except a WORKING LICENSE.

0 Karma

Drainy
Champion

Splunk are heavily involved in the community and spend alot of time helping people. In fairness to them you don't have a paid support and it is a free product, personally I would say that the fact it indexes data is far more important than letting me search my data. I have a sudden issue that causes a surge of data, ok so I can't search but at least I can perform some sort of analysis afterwards... if I stopped indexing then there isn't much point 😕 Also its not a bait and switch if you are going over the free license, surely thats just a sign that you need a bigger / commercial license?

Drainy
Champion

Well perpetual means it doesn't expire and it hasn't, you've just violated the license. And it also has a three strike rule so you would have had warnings at the top of the screen for at least three days warning you of a violation. If it is a big problem you could always install a new free version and migrate your indexes over to it?

mikeraffety
Explorer

Agreed, I'm not paying for support, but I believe that a perpetual free license to index up to 500 MB a day should not deactivate and require vendor intervention to get working again. It's clearly not perpetual. Am I asking too much?

0 Karma

cvajs
Contributor

i can add my 2cents here. the Splunk website has a matrix and verbiage comparing free vs pay-for ent license. it seems to suggest the product stops indexing after 500MB, not that you cannot search after max index has been reached, etc.

"Splunk is available to download for free. Your download automatically includes all of the Enterprise license features of our latest release, Splunk 4.3, for 60 days and allows you to index 500 megabytes of data per day. After 60 days, or anytime before then, you can convert to a perpetual Free license or purchase an Enterprise license to continue using the expanded functionality designed for multi-user Enterprise deployments"

source: http://www.splunk.com/view/free-vs-enterprise/SP-CAAAE8W

in fact, the product has no indexing limit. so perhaps the description of "free" is not accurate, and, the description for limits on indexing is not accurate.

mikeraffety
Explorer

The FREE license indexes up to 500 MB/day. Oops, no, it will index MORE, but if you give it too much data to index three times in a month, it just shuts down.

AND, corporate Splunk has not yet responded to TWO calls trying to get this "reset" license key. Seems like a bait-and-switch to try to get you to pay for a commercial license.

Does anyone from the company read these forums?

0 Karma

mikeraffety
Explorer

I fully respect the 500 MB limit -- but I do NOT expect the software to just stop working when I exceed it too many times!

0 Karma

Ayn
Legend

I would argue that enforcing the license in the way you suggest is not common sense. It just happens to be better suited to your specific individual current situation.

If you use Splunk for indexing, searching and acting on data that is of relevance to you (which is the whole point of it), it'd be far worse if it just started dropping this relevant data as soon as the license limit is hit. Instead when you surpass the 500MB license cap Splunk keeps on gathering the data just as usual so you're still able to search it and then gives you not one, not two, but THREE warnings for each day you violate the license, before finally shutting down search capabilities. Even then it's still gathering data.

If you're constantly indexing more than 500MB of data per day, then the free 500MB license isn't for you.

jbsplunk
Splunk Employee
Splunk Employee

You have the ability to set up alerts on license violations, as well as to route data that is less meaningful to you to the nullQueue(Splunk equivalent of /dev/null) so that no license cost is incurred by those events.

search to alert on:
http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

nullQueue

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad

delfosseao
Engager

Just an update (since this dated page comes up as a search result about Splunk Free license):
I just installed 7.2.3 to use for a class. When I go to check the License in settings, I noticed that all it says for Free is it does not support auth (and has the 500MB limit), while Enterprise says it adds alerting. This would imply that the Free level does not support alerting.
I am using this to learn Enterprise; once I finish the class I'll try switching the license and see if alerting still works.

0 Karma

Ayn
Legend

I don't agree that continuing to index but shutting down search is "stop working entirely", but we clearly have different opinions on this. I'm no Splunk employee, I'm a customer that see this model as a good thing, as do many others. But of course any model you choose would have its disadvantages as well.

mikeraffety
Explorer

How about giving the customer a choice? But I can't think of any other license that works like this, it just stops working entirely when you exceed limits (until you get the vendor to unlock it for you). A license limit is a license LIMIT, not a warning and then a cancellation.

0 Karma

Ayn
Legend

As opposed that during the crisis, the data you needed hasn't been indexed at all because you've been over the limit since long? That wouldn't be how you want it to work either.

mikeraffety
Explorer

It's common sense to ME, as a user of the software. If I have more than the 500 MB/day of data, then just don't index it. Please don't just shut down and make it impossible for me to access my data at all! I don't access it often, I don't SEE those warnings. But when I do, it's a crisis, and IT MUST WORK as expected.

sabeeshvk
Observer

Yes, I have the same concern.  

I haven't started my personal instance for more than a month, I have not set up any auto indexing. Just uploaded some personal financial data as csv.  Now I open to look at the data and now I get message.   " Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK."

My company has an enterprise license and I am not planning to purchase a personal license. I would love to use the personal instance to play with limited personal data and learn Splunk features.   

But the "Free" license does not look free, just a bait ...

0 Karma

Ayn
Legend

Oh! Sorry, I didn't know 🙂

0 Karma

kristian_kolb
Ultra Champion

Actually, its three violations for Splunk Free, not five. Other than that I agree with you 🙂

0 Karma

lguinn2
Legend

Perpetual means "doesn't expire" not "you can do whatever you want"

mikeraffety
Explorer

Version 4.3, build 115073 on Windows.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...