Indexer cluster - does data remain accessible after license expires?

[pcsegal1]

Hi,

I have a Splunk Enterprise cluster that consists of:

• 1 cluster master
• 3 indexers
• 1 search head
• 1 license master

My doubt is: when the Enterprise license expires and you don't include a new license, what happens to the data already residing in the indexers? Does it remain accessible? Is there any specific procedure that I would need to perform to make sure the data would remain accessible in that situation?

As I understand it, Splunk lets you to downgrade to a Free license, and then you lose all the Enterprise features, including distributed search. Given that Free license doesn't allow distributed search, does this mean that the 3 indexers will automatically become standalone instances, and I'd still be able to search their data individually?

[woodcock]

When your license expires, you continue to ingest data and it continues to be maintained as always, but you can no longer search it. In the case of downgraded to Free and losing distributed, yes: each indexer becomes a standalone unit and whatever gets forwarded to any indexer is searchable on that indexer, provided it also is setup to use the Free license.

[pcsegal1]

Thank you.
Just to make sure I understand:
If I make sure that (1) data stops coming into the indexers before the license expires, and (2) the license is downgraded to Free in the license master, do the indexers automatically become standalone and individually searchable?

[woodcock]

Yes. They are always individually searchable, even when clustered.

[pcsegal1]

A follow up question about the described scenario:
After license expiration, when downgrading the cluster members from Enterprise to Free, is there any special procedure that needs to be performed to make sure that the already existing data (everything that was indexed prior to the expiration) is preserved?