Version 4 support of the free license was introduced in version 4.0.5. Splunk Free is designed for personal, ad-hoc search and visualization of IT data. You can use Splunk Free for ongoing indexing of small volumes (<500MB/day) of data.
If you go over 500MB/day more than 3 times in a 30 day period, Splunk will continue to index your data, but search will be disabled until you are back down to 3 or fewer times in the 30 day period.
To switch to a Free License via the web interface:
To switch to a Free License via the command line:
In 4.2 to switch to free license: