License Enforcement below 100 GB Volume with no enforcement key (Enterprise License)

[cimey]

Hey all,

I have question regarding license enforcement. We currently have a "50 GB (No enforcement) Enterprise Term-license" and exceeding it since 10 days.

I already read the "License Enforcement FAQ" and other posts but its no 100% clear to me if there will be enforcement in our environment after 45 warnings in 60 days.
I understand that below 100 GB there is conditional enforcement but is this is also the case with the "no enforcement" key we have? What will happen to our environment / search function if we exceed the volume more than 45 times in 60 days?

Best regards,
Cimey

[richgalloway]

This question is best asked of your Splunk account team.

[PickleRick]

+1 on that. Generally small licenses are enforcement licenses. You having a relatively small no-enforcement license is strange enough on its own.

[cimey]

To give you guys some more context, the 50GB is only a part of the complete license. We are migrating into a newly built environment and moved 100+GB to from the old to the new environment and started migrating, thats why we are exceeding only the last few days on the old evironment now. So its not one big license but instead 2 different sized ones. Both are indeed no enforcement.

[PickleRick]

Again, that's still a relatively unusual setup because normally you'd rather have a single bigger license and you should just set up a License Manager and split the license "internally" between indexers. If you managed to get two separate smaller license "counted" as one, each of them might indeed be non-enforcing.

If you open Settings->Licensing and click on "All license details" you'll see if your installed license has "ConditionalLicensingEnforcement" or not. If it's indeed non-enforcing it will... well, not enforce license limits. (remember though that if you keep exceeding your license entitlement it might show, for example, in diag package when you create a support case and it might lead to some uncomfortable questions ;-))

[isoutamo]

+1 and please tell to us what they answer to you 😉