Free vs. Enterprise

Splunk Enterprise is available as a free download. You'll get all of the features of our latest release, Splunk Enterprise 6.2, for 60 days and you can index up to 500 megabytes of data per day. After 60 days, or anytime before then, you can convert to a perpetual Free license or purchase an Enterprise license to continue using the robust features designed for multi-user enterprise deployments. Or try our free online sandbox - your personal online environment.

Splunk License Comparison Table

The Splunk Free license is intended for individual use. The Splunk Enterprise and Splunk Cloud licenses offer added capabilities to support multi-user, distributed deployments and includes alerting, role-based security, single sign-on, scheduled PDF delivery, clustering, premium Splunk apps and support for much higher data volumes.

Feature Description Splunk Free Splunk Enterprise Splunk Cloud  
Indexing Volume Maximum indexing volume per day 500MB/day Unlimited
(according to license)
5GB/day to multi-TB/day
(according to license)
Data Onboarding

Universal Indexing
Wizard-based workflow to simplify onboarding of any data source

Universal real-time indexing of machine data
Search Ad hoc search across real-time and historical data        
Distributed Search Search across multiple Splunk deployments; supports load balancing and failover        
Monitoring & Alerting Monitor and alert for individual and correlated real-time events        
Reporting Ad hoc reports across real-time and historical data        
Knowledge Mapping Knowledge mapped to machine data artifacts        
Dashboards Highly customizable and interactive dashboards integrating real-time machine data and charts, reports and tables        
Data Model Used to define consistent relationships in machine data        
Pivot Drag-and-drop UI to explore, manipulate and visualize machine data        
Event pattern detection

High Performance Analytics Store
Automatically discovers patterns in your data with a single click

High performance analytics technology
Report Acceleration Transparent data summarization technology        
Embedded Reports Embed charts and reports in other third-party business applications external to Splunk Enterprise        
PDF Delivery Scheduled and automated PDF generation and delivery of reports and dashboards        
Access Control and Single Sign-On Integrated role-based access control and user authentication with LDAP directory and single sign-on integration        
Single-site Clustering High availability architecture for machine data availability in a single site deployment        
Distributed Management Console Centrally manage the health and performance of distributed Splunk deployments        
Multi-site Clustering High availability architecture for disaster recovery in a multi-site deployment     On request  
Universal Forwarder Forwarding of data securely and reliably from remote systems in real time        
Forwarder Management UI for monitoring and deploying Forwarder configurations        
Rich Developer Environment Developer platform for building enterprise apps that leverage Splunk modern web languages        
Apps Access to hundreds of partner, community and Splunk apps from the Splunk apps website        
Premium Apps Access to premium Splunk apps        
Standard Support Access full product documentation, Splunk apps, Splunk Answers and IRC channel        
Enterprise Support Direct access to Splunk Customer Support, ability to manage cases online, tailored support levels        


Looking for More on Splunk Free?

If you already have Splunk installed and want to learn how to convert your Enterprise Trial into a Free license, take a look at More About Splunk Free from our Installation Manual.