This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 , 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13
Each instance of Splunk server must have its own license. This topic discusses the different Splunk licenses, how to install or update a license, and what to do when you have a violation on your license.
Note: You must purchase a separate license for every instance of Splunk that you deploy.
Splunk provides two standard types of licenses, a Free license and an Enterprise license. To evaluate Enterprise features, you can request a trial Enterprise license before purchasing.
Note: If you evaluate a Splunk Preview release, it will include the required license.
When you download Splunk for the first time, you are asked to register. Your registration authorizes you to receive the Free license, which allows a maximum indexing volume of 500 MB/day. The Free license is not a trial license and does not have an expiration date. The Enterprise license enables higher data indexing volume and the following additional features:
Important: Beginning with 3.4.2, users running Splunk with the Free license can set their instance to receive data from a fowarder. In earlier versions of Splunk, users needed an Enterprise license to change this distributed setting.
To evaluate these features before you purchase an Enterprise license, you can request a 30-day trial Enterprise license.
Find more information about the different license features here. Also, read Splunk's Free license agreement.
You can request trial Enterprise licenses of varying size and duration. The default evaluation period is 30 days. If you are running with a trial license and your license expires, Splunk continues to index your data. However, you will not be able to search until you install a new license.
Splunk's Preview releases require a different license that is not compatible with other Splunk releases. Also, if you are evaluating a Preview release of Splunk, it will not run with a Free or Enterprise license. Preview licenses typically enable Enterprise features, they are just restricted to Preview releases.
Each instance of Splunk server must have its own license. As of version 3.4.2, a forwarder license is included with the product. Here are the steps to apply the 3.4.x forwarder license:
1. Stop Splunk (./splunk stop)
2. Copy $SPLUNK_HOME/etc/splunk-forwarder.license to
$SPLUNK_HOME/etc/splunk.license
3. Start Splunk (./splunk start) This license does not limit how much data you can forward from that machine.
If you are running a version of Splunk that is older than 3.4.2, contact support for a copy of the forwarder license.
Note: This 1 MB/day forward-only license is not subtracted from your existing license(s) and can be applied to multiple forwarders.
All Splunk servers have a license located in $SPLUNK_HOME/etc/, whether it is a Free license (splunk-free.license) or an Enterprise license (splunk.license). You can install and update your licenses with the CLI or from Splunk Web's Admin > License & Usage page.
Refer to the Installation Manual for instructions to install or update your Splunk license.
Violations occur when you exceed the maximum indexing volume allowed for your license. If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have more than 7 violations in a rolling 30-day period, search will be disabled. Search capabilities return when you have less than 7 violations in the previous 30 days or when you apply a new license with a larger volume limit.
Note: During a license violation period, Splunk does not stop indexing your data. Splunk only blocks access while you exceed your license.
If you have other issues with your license, refer to the Admin Manual for troubleshooting tips.