license too restrictive

[wilsona]

I am attempting to evaluate splunk, however the licence terms are too restrictive in order to do a proper eval. To get a baseline for my organisation I need to get a large amount of logging data in initially, then the updates will be pretty small, much less that the 500mb per day limit. Has anyone any idea how I can do this?

I have already hit the "Your Splunk license expired or you have exceeded your license limit too many times." error.

[gkanapathy]

Contacting sales for a larger trial license is probably the best answer.

The 500MB/day enterprise trial license and the free license allow more than a single day's violation within a 30-day period, e.g., the I believe the free version will let you go over 3 days out of 30 and the trial will let you go over 5 out of 30. So if you can load all the data within 1 or 2 days, this won't be a problem. If you clean out all the indexed with splunk clean all, the license violation count will be reset to to zero. Once you have the configuration and process to load all the initial data, you can clean the indexed data, load it into Splunk (which will allow you to go over by an unlimited amount), and as long as the loading takes less time than the maximum violation time, you should be okay.

[gkanapathy]

there is not and has never been such a limit. perhaps you read that you could exceed the limit 3 times before you were locked out of searching.

[Paolo_Prigione]

So there is no top limit to the daily indexed amount? I ask because I recall reading on the docs about an indexing-cap which was 3x the licensed amount. But that was months ago and I might as well be wrong.

[ftk]

If you are serious about evaluating splunk for purchase, contact splunk sales. A sales rep will be able to set you up with a larger volume trial license.