How does licensing work?

[mctester]

In the Free vs. Enterprise license comparison it says there's no limit on indexing in Enterprise license, but in the documentation it says that the Enterprise license can be violated by exceeding daily indexing limits, so please explain to me whether there are limits or not.

[jrodman]

I suspect whatever said there's no limit was talking about something else. Perhaps no limit on the number of indexes?

[Mick]

Lets take a 3GB license as an example -

Your Enterprise license will allow you to index 3GB of data per day. In case of an unexpected data surge, we do allow for 5 violations in a 30-day period - so if you have a web-server start to produce lots of errors and you index 3.5GB on a Sunday, Splunk will tell you this on Monday morning, and everything will continue to work as before.

If you don't fix the problem and Splunk continues to index more that 3GB data on Monday, Tuesday, Wednesday & Thursday, that makes 5 violations, so Splunk will not allow you to search any data on Friday morning. Data will still be indexed, as Splunk never stops eating your data, but you won't be able to search it until you get a reset key from Splunk Support. The first one is free but repeated requests for reset keys will result in questions on the suitability of your license size so make sure you size your purchased license appropriately for your needs

The only reason Splunk will stop indexing data is if it runs out of disk-space to write to. As long as data keeps coming in, Splunk will keep indexing it, even if you have 20 violations.