How does licensing work?


In the Free vs. Enterprise license comparison it says there's no limit on indexing in Enterprise license, but in the documentation it says that the Enterprise license can be violated by exceeding daily indexing limits, so please explain to me whether there are limits or not.

0 Karma

Splunk Employee
Splunk Employee

I suspect whatever said there's no limit was talking about something else. Perhaps no limit on the number of indexes?

0 Karma

Splunk Employee
Splunk Employee

Lets take a 3GB license as an example -

Your Enterprise license will allow you to index 3GB of data per day. In case of an unexpected data surge, we do allow for 5 violations in a 30-day period - so if you have a web-server start to produce lots of errors and you index 3.5GB on a Sunday, Splunk will tell you this on Monday morning, and everything will continue to work as before.

If you don't fix the problem and Splunk continues to index more that 3GB data on Monday, Tuesday, Wednesday & Thursday, that makes 5 violations, so Splunk will not allow you to search any data on Friday morning. Data will still be indexed, as Splunk never stops eating your data, but you won't be able to search it until you get a reset key from Splunk Support. The first one is free but repeated requests for reset keys will result in questions on the suitability of your license size so make sure you size your purchased license appropriately for your needs

The only reason Splunk will stop indexing data is if it runs out of disk-space to write to. As long as data keeps coming in, Splunk will keep indexing it, even if you have 20 violations.

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...