HI All ,
I am preparing for splunk admin exam and I want to know what happens when splunk license expires in 8.1.1 does it stop search or not because on splunk doc I can see this
license violation happens when you exceed the number of warnings allowed on your license. The license violation conditions are based upon the license type.
Here is what happens to indexing and search capability during a license violation:
Splunk Enterprise continues to index your data.
Using search is blocked while you are in violation. This restriction includes scheduled reports and alerts.
Searching the internal indexes is not blocked. You can use the monitoring console or run searches against the _internal index to diagnose the licensing problem.
But somewhere I got to know this was happening only splunk 6.5
so please help
https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/Aboutlicenseviolations
