Can we still search data with expired license on multisite cluster with smartstore?

[johnansett]

Hey folks, been a while - I have a question I figured community would be better to answer:

We have a multisite cluster using SmartStore built in AWS.  We are not going to new Splunk but need to be able to access the data for the next 7 years and thus want to age it out, but it may need to be searched from time-to-time.

I understand we can convert to a Free license. However, does the architecture impact that (namely, that there is cluster replication)? Or is it possible to have a single standalone instance with Splunk Free to search as needed?

[PickleRick]

Adding to what @yeahnah and @isoutamo already said (yes, the zero-ingest license seems to be the way to go; otherwise you'll have a huge headache trying to make your all data available for a single Splunk instance (to be honest while it is not explicitly stated anywhere I wouldn't be surprised if Splunk Free didn't support SmartStore; after all it's a relatively enterprise-level functionality) be very cautious not to get your environment to a state in which you have an expired license since then you must get an unlock license from the sales team. It's not enough to just upload a renewed license - once it's locked you have to unlock it "manually".

[yeahnah]

Hi @johnansett 

We had something similar after moving our on-prem Splunk to Splunk Cloud.  Our on prem indexed data needed to be searchable as it aged out.

As a Splunk customer you should be able to request a zero-ingest license from Splunk Support. This is better than a free or trail license as it gives all the benefit of a standard license (except no data ingestion) and does not need renewing every 6 weeks like a trail license does.  If you have a Splunk account manager then this is something you could discuss with them. 

Hope that helps. 

[isoutamo]

Free license didn’t contains cluster or distributed capabilities. So you cannot use free for this. Basically you maybe could convert multi site environment back to single instance environment before your license goes to old?