Go to splunk.com and then go to Support>Support Portal. Login to your account and you should be able to see a 'My Licenses' on the left hand side. ... View more

Call Splunk Support or open a ticket, state that you've violated your license and ask for a reset key. Add that to your license master and you'll be good. ... View more

To be as concise as possible, the speed gain in your example stems from distributed search, not from clustering / replication. If your RF/SF both were 1, the speed would be the same. ... View more

The right answer is 72 hours and can be found here: http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Aboutlicenseviolations#About_the_connection_between_the_license_master_and_license_slaves the license slaves communicate their usage to the license master every minute. If the license master is down or unreachable for any reason, the license slave starts a 72 hour timer. If the license slave cannot reach the license master for 72 hours, search is blocked on the license slave (although indexing continues) ... View more

As ssievert says, if you don't need replication across sites, simple is better. For instance, that way you don't need to bother about search affinity, site specific considerations etc. However, you might want to consider the replication factor. When your environment grows, and your HA requirements with them, it might be more cost-effective to use multi-site clustering. This is because it allows you to set replication within your sites. It can make quite a bit of difference in the amount of storage you need. There is not a rule-of-thumb here, so I would discuss this in detail with your splunk architect. ... View more

Hmm.. why would the CLASSPATH in your login session affect splunk process? ... View more