Splunk Enterprise

What happens during a license violation?


HI All ,

I am preparing for splunk admin exam and I want to know what happens when splunk license expires in 8.1.1 does it stop search or not because on splunk doc I can see this 

 license violation happens when you exceed the number of warnings allowed on your license. The license violation conditions are based upon the license type.

Here is what happens to indexing and search capability during a license violation:

Splunk Enterprise continues to index your data.

Using search is blocked while you are in violation. This restriction includes scheduled reports and alerts.

Searching the internal indexes is not blocked. You can use the monitoring console or run searches against the _internal index to diagnose the licensing problem.


But somewhere I got to know this was happening only splunk 6.5 

so please help 



Labels (3)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!