How does Splunk behave after license expiry?

[kaustubhfab]

Hello. I looked around for answers in the FAQ and this forum, but was unable to find any. Apologies if this is already asked.

I possess a Splunk Enterprise license that expires in a few days.

I have following questions:

1. Will I be still able to use the Splunk dashboard to perform searches of data that was indexed prior to expiry?
2. Will I be able to perform API calls to retrieve events which were already indexed prior to expiry?
3. How is indexing (universal forwarding) affected. Will the splunk daemon throw an exception and stop adding new events?

Thank you.

[martin_mueller · Accepted solution]

3: Splunk will keep indexing. UFs don't notice the license expiry because the forwarder license doesn't expire and is free anyway.
You will however see license violations very soon, because even if you switch to the free license you'll be limited to 500MB/day only... probably less than your current license.

2: see 1, retrieving events is just searching.

1: You should be able to search on the free license provided you don't exceed license violations... which is a real possibility due to 3.