I have a old Splunk Enterprise deployment which isn't used any more and the (volume) licence is due to expire soon. I have index data (cold buckets) stored in Google Cloud Storage using SmartStore. I will no longer be ingesting new data into Splunk but I need to keep this older data online/searchable for one year or longer. My high-level plan is to: Decommission the existing infrastructure, keeping the GCS-hosted index data Build a single-instance Splunk server, connected to the SmartStore/GCS location Run this instance using a Free Licence As far as I can tell, this plan will work. Indeed I have tested it by building a new Splunk instance and, during the Trial Licence period, I connected to GCS and performed test searches of the data. I have now switched this instance to a Free Licence and this data still appears to be searchable. Despite this testing I have been told that SmartStore cannot be used with a Free Licence. I have read the Splunk documentation about the licence and its restrictions and cannot see anything to support that assertion. Is it possible that I have missed something, or my testing might be awry? Does anyone have explicit (successful) experience of using SmartStore on an instance running under the Free Licence? Is there anything I should be looking for in log files, etc. to demonstrate that all is working as I expect it to?
... View more
