This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 , 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13
Splunk will run with a free license which allows you to index up to 500 MB/day, or you can buy an enterprise license to get higher data volumes, additional features, and support. You can also register for a free 30-day trial enterprise license. Best of all there's just one download and just one software package - just drop in an enterprise license to enable the enterprise features!
For a complete breakdown of the differences click here.
Splunk will continue to index data but search will be blocked until you plug in a new license.
No. Splunk will always index the data. If you exceed your license limit a violation will be recorded.
Splunk allows up to a set number of violation days in a rolling 30-day period, since we know that sometimes you'll have an unpredictable one-time spike. For 3.0 and later the limit is 7 violations in the 30-day period. If you exceed the limit more than the allowed number of days, searches will be blocked. You will see warnings starting with the first violation before then, and then the notice that searches are blocked. The violation banner will persist for 7 days from the last violation. In any case, indexing will continue since we don't want you to lose data. You can start searching again as soon as a full day passes that stays within the allowed volume, or you enter a new license.
Version 3 introduces a new license key format. If you are an existing 2.x customer your license will not work with 3.0. Plus Support customers are entitled to upgrade their 2.x license to 3.0. Contact Splunk Support for your 3.0 license.