This documentation applies to the following versions of Splunk: 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10
Starting in version 4.0.5, Splunk Free is back!
Splunk Free is a totally free (as in beer) version of Splunk. It allows you to index up to 500MB/day and will never expire. If you go over 500MB/day more than 3 times in a 30 day period, Splunk will continue to index your data, but search will be disabled until you are back down to 3 or fewer times in the 30 day period.
Splunk Free is designed for personal, ad-hoc search and visualization of IT data. You can use Splunk Free for ongoing indexing of small volumes (<500MB/day) of data. Additionally, you can use it for short-term bulk-loading and analysis of larger data sets--Splunk Free allows you to bulk-load much larger data sets up to 3 times within a 30 day period. This can be useful for forensic review of large data sets.
Need to look at some historical data? Want to investigate some trends over a long period of time? Splunk Free can help.
Learn more about Splunk Free including how to switch from the Enterprise Trial license to Free.