Trial license limits

[samerfaour]

Are the daily limits enforced right away or after an average period?

For example if I am testing importing 5 GB but it will be a one time import rather than a stream, then how is that handled? I will not exceed the average daily limit over 30 days.

Is this handled as one violation or several violations until 10 days after where the average is within the limit?

[gcusello]

Hi @samerfaour,

good for you.

Ciao and happy splunking.

Giuseppe.

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @samerfaour,

which kind license have you?

Anyway, Splunk counts the violations on a daily  basis and you cannot have more violations than a threshold depending on the kind of license (e.g. Trial License is blocked after only three violations, normal license blocs after 45 violations in 60 days, etc...).

When you're in violation, Splunk block searching after the followimng midnight.

Average isn't relevant: it's only relevant the number of exceedings in a period.

So, if you can distribute your ingestion avoiding to exceed license is better, otherwise, it's better to exceed one shot because the quantity of exceeding isn't relevant.

Ciao.

Giuseppe

[samerfaour]

I do not have any license yet. I am looking at testing and want to understand the license limits.

https://www.splunk.com/view/SP-CAAAAEQ

So in the scenario I described based on what you say here that would be treated as 1 violation for the first day import only, correct?

Day 1: 5 GB - 1 violation no restrictions

Day 2-30: 0GB - no violations

[gcusello · Accepted solution]

Hi @samerfaour,

with a trial licene you can index 500 MB/day and you can have two exceeds in 30 solar days.

As I said, it's better to exceed of many GBs in one day that few GBs in many days.

Ciao.

Giuseppe