Does SmartStore work on a standalone Splunk instance using a Free Licence?

[CharlieJ-BGS]

I have a old Splunk Enterprise deployment which isn't used any more and the (volume) licence is due to expire soon. I have index data (cold buckets) stored in Google Cloud Storage using SmartStore. I will no longer be ingesting new data into Splunk but I need to keep this older data online/searchable for one year or longer.

My high-level plan is to:

1. Decommission the existing infrastructure, keeping the GCS-hosted index data
2. Build a single-instance Splunk server, connected to the SmartStore/GCS location
3. Run this instance using a Free Licence

As far as I can tell, this plan will work. Indeed I have tested it by building a new Splunk instance and, during the Trial Licence period, I connected to GCS and performed test searches of the data. I have now switched this instance to a Free Licence and this data still appears to be searchable.

Despite this testing I have been told that SmartStore cannot be used with a Free Licence. I have read the Splunk documentation about the licence and its restrictions and cannot see anything to support that assertion.

Is it possible that I have missed something, or my testing might be awry? Does anyone have explicit  (successful) experience of using SmartStore on an instance running under the Free Licence? Is there anything I should be looking for in log files, etc. to demonstrate that all is working as I expect it to?

[gcusello]

Hi @CharlieJ-BGS ,

I never tried but I think that isn't permitted.

Ciao.

Giuseppe

[isoutamo]

I'm not sure it this is valid response or not?
But when I look license file I couldn't found any feature for S2 in enterprise license.
Unfortunately I haven't any demo/test node which I can switch to free license to test it and check how that license file changes.
But I think that It could be possible that it's working with free version too.
Best option is if you could test it with trial license and minio as S3 backend. If it works then it should work also with GCP environment. Of course it's better if you could test this also in GCP too.

There is no mention of S2 as restricted/removed features in https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.4/configure-splunk-licen...

If/when you have tested this, please inform us, is it working or not!

[CharlieJ-BGS]

Thank you @isoutamo and @gcusello for replying...

I have done some testing and I am certain that I can use SmartStore with a Trial Licence, but I'd expect that. After converting my test server to a Free Licence I seem to be able to search old data, but I have a small worry that perhaps this data had been cached locally by my previous testing.

@gcusello your response is similar to the other feedback I have received: that SmartStore probably isn't supported but I'm hoping to hear something that is definitive and/or points me to some relevant documentation since my own testing seems to contradict the advice I have received.

@isoutamo thanks, I did read the documentation about the Free Licence and agree that there is no mention of SmartStore being a "disabled feature". My assumption is that it would be explicitly called out if it was being disabled under a Free Licence.

So, at the moment I think that my testing "wins", i.e. shows that it does work, but I'm hoping that someone out there is able to share their own experience.

[isoutamo]

If you do a restart for your test license and check are those internal logs before restart usable and there is no error in internals then it should work. Also you could use that testing like in https://community.splunk.com/t5/Knowledge-Management/SmartStore-How-to-verify-splunk-indexer-connect... and it works then it works. There are more examples on help.splunk.com for test it.