This question is a complex one, but the difficult part is more the navigation of the legal aspects more so than the actual technical implementation aspects. Before diving too deep on this, I think it's best that we level set a bit:
I am not a lawyer, nor am I employed by Splunk Inc. advice below is strictly from my own experiences
While there are general terms of types of Splunk licenses that often have common mechanics, these are negotiated contracts between Splunk and your organization, and specific terms can and do in fact vary from company to company
In General, an Enterprise license is typically strictly for the use of an individual organization's Internal Business Purposes only. Furthermore, the organization is usually prohibited from reselling functionality, or creating derivative works for clients.
Now you mention that you are needing to make UI changes for clients, if you are a Value Added Reseller, and working on their Splunk for having Splunk power websites for their internal business purposes that's likely OK. If these changes are their Splunk and showing data to their clients, well that gets into a very grey area, You need to be careful that you are not doing anything that could be construed as directly sublicensing Splunk's software. Giving clients' customers' access to the Search interface, probably no bueno. Having Splunk email a regular report of processing being done on behalf of a client, that you would be gathering data in Splunk to then compile and send out reports anyways... maybe ok, so long as it's not a primary feature being sold... embedding splunk functionality into custom webpages for third party consumption. very grey area.
In terms of customizations that are available under an enterprise license, there is a full gambit up including a Web Framework for building dashboards and views for apps in anything from basic Splunk branding to full blown HTML, JavaScript, and CSS, so much customizability that you could power quite a bit without leaving the Splunk app itself. web.conf has some basic rebranding tooling as well. Scheduled Reports can be embedded into third party sites. Furthermore Splunk has a full powered REST API where you can run searches and pull results into all kinds of other applications.
But in all of those you are to be obeying the restrictions in terms of your user population.
Now that said about Enterprise licenses, I want to also make you aware of two other license types, one is an Original Equipment Manufacturer (OEM) license, and the other being a Managed Service Provider (MSP) license. Unlike the Enterprise license, these licenses are for when you are providing Splunk technology for use by your customers' employees, as opposed to just for your own employees. The difference between OEM and MSP is that OEM Splunk is typically where you are selling a white labeled product or service and all ingestion and searching is done specifically for that particular service (as spelled out in the OEM Agreement). Unless specifically spelled out you likely wouldn't be downloading Splunkbase apps and shipping those, as you are required to white label the product. Splunk's OEM team actually has an OEM Toolkit and other resources for rebranding Splunk pretty much from the ground up that they make available to OEM Partners.
MSP Splunk is where you're running and managing Splunk technology on behalf of third parties for their business purposes. Here your customers are buying Splunk so you don't have the sourcetype restrictions that you do under the OEM license, but you may or may not have the freedom to white label the product. (I haven't seen one of these agreements)
Hopefully that was helpful and mostly coherent, for a late night rambling. Again, consult with your organization's legal team and your contracts as far as what would or would not be permitted under your current agreements with Splunk (or your customer's organizations' agreements if you're working on their Splunk installations as a contractor). The technology to rebrand Splunk is available, it's just who you enable and how you use it that could get you into trouble. (You would not want Lenny to be eating your face )
... View more