Monitoring Splunk

How does Splunk behave after license expiry?

kaustubhfab
Engager

Hello. I looked around for answers in the FAQ and this forum, but was unable to find any. Apologies if this is already asked.

I possess a Splunk Enterprise license that expires in a few days.

I have following questions:

  1. Will I be still able to use the Splunk dashboard to perform searches of data that was indexed prior to expiry?
  2. Will I be able to perform API calls to retrieve events which were already indexed prior to expiry?
  3. How is indexing (universal forwarding) affected. Will the splunk daemon throw an exception and stop adding new events?

Thank you.

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

3: Splunk will keep indexing. UFs don't notice the license expiry because the forwarder license doesn't expire and is free anyway.
You will however see license violations very soon, because even if you switch to the free license you'll be limited to 500MB/day only... probably less than your current license.

2: see 1, retrieving events is just searching.

1: You should be able to search on the free license provided you don't exceed license violations... which is a real possibility due to 3.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

3: Splunk will keep indexing. UFs don't notice the license expiry because the forwarder license doesn't expire and is free anyway.
You will however see license violations very soon, because even if you switch to the free license you'll be limited to 500MB/day only... probably less than your current license.

2: see 1, retrieving events is just searching.

1: You should be able to search on the free license provided you don't exceed license violations... which is a real possibility due to 3.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...