We know that Splunk plays a mission-critical role for your business. We value you, our customers, and all the ways you are using Splunk, the Data-to-Everything Platform. As we continue to innovate and update policies, we want to keep you up to speed on the new license enforcement policy for on-premises license stack volumes less than 100 GB.

 

What is the new license enforcement policy?
For Splunk Admins managing a Splunk Enterprise On-Premises license stack of total capacity less than 100 GB, who are on version Splunk Enterprise 8.1.0 and above, Splunk Enterprise will automatically disable search in each of these cases:

  • For the entire deployment when total usage (across the stack and all license pools) exceeds license capacity and receives 45 warnings over a rolling 60-day window.
  • In cases where license pools have a strict quota enabled, search is disabled for the offending license pool member(s) after 45 warnings over a rolling 60-day window for the license pool. Other pools are searchable as long as the total usage across the stack and all license pools does not exceed the stack license capacity 45 times over a rolling 60-day window. The customer can upgrade to a larger license to meet their larger indexing needs.

How does this affect Premium Solutions like Splunk IT Service Intelligence and Splunk Enterprise Security?
This license enforcement policy will apply if you have less than 100 GB stack volume, including your core Splunk and premium solutions’ combined indexing capacity on version 8.1.0 or later of Splunk Enterprise.

 

What happens if my search is disabled?

  • If you are on a version lower than Splunk Enterprise 6.5: Upgrade to a currently supported Splunk Enterprise version and obtain a “no enforcement” key so that the software will not disable search. License is enforced as described above for capacities below 100GB on Splunk Enterprise versions 8.1.0 and above

    The “no enforcement” key should be installed on each deployment’s License Master. You can get the key in either of these two methods:

    Method 1: Purchase a net-new currently supported Splunk Enterprise license. For any license purchase after September 27, 2016, you will actually receive two keys: one for the purchased license capacity and one “no-enforcement” key. The “no enforcement” key only works on license masters on versions 6.5 and above. It is not compatible with previous versions of Splunk Enterprise. If you are an existing customer running an earlier version of Splunk Enterprise, we are providing both keys so that you can install the “no-enforcement” key when you are ready to upgrade.

    Method 2: Contact your sales rep or Splunk authorized partner to request a key. They’ll help you assess your current deployment, use cases and data volume needs and provide recommendations to secure additional capacity and a “no-enforcement” key."

  • If you are on a Splunk Enterprise version from 6.5 to 8.0: Splunk Enterprise will not disable search when you exceed your licensed data ingestion quota. 
  • If you are on Splunk Enterprise 8.1.0 and above: To re-enable search after it is disabled you must work with your Splunk sales rep or Splunk authorized partner to assess your current usage and purchase additional license capacity.

How do I know if I’m exceeding my license capacity?
Notifications in the software will indicate license warnings and violations.

 

What happens if I exceed my purchased license capacity?

The software will generate a warning if you exceed your licensed indexing volume on any one calendar day.   

  • If you exceed your daily indexing limit five or more times in a rolling 30-day period and have a license stack volume over or equal to 100 GB on Splunk Enterprise version 6.5 and above, the software will not disable your search functionality.

  • If you exceed your daily indexing limit five or more times in a rolling 30-day period and have a license stack volume less than 100 GB on Splunk Enterprise versions between 6.5 and 8.1.0, the software will not disable your search functionality.

  • If you exceed license capacity 45 or more times in a rolling 60-day period and have a license stack volume less than 100 GB on Splunk Enterprise version 8.1.0 and above, the software will disable your search functionality. In cases where license pools have strict quota enabled, search is disabled for the offending license pool member(s) after 45 warnings over a rolling 60-day window for the license pool. Other pools are searchable as long as the total usage across the stack and all license pools does not exceed the stack license capacity 45 times over a 60-day window. The customer can upgrade to a larger license to meet their larger indexing needs.

You should work with your Splunk sales rep or Splunk authorized partner to assess your current usage and purchase additional license capacity.

 

What is my legal obligation if I exceed my purchased license capacity?
Your legal obligations remain unchanged. The Splunk General Terms specifically state that customers cannot exceed their Capacity.

 

Where can I find additional documentation?
Detailed documentation is available here

 

I have purchased 400GB of total capacity split into 5 different independent instances each with 80GB. Will I be subject to License Enforcement?
Yes. Licenses are enforced on any environment where total license stack is less than 100GB. In order to not be subject to license enforcement in this situation, use a License Master to manage licenses and upgrade licenses to appropriate sizes to avoid violations.

 

Can I cancel my support agreement and continue to use the software without restriction?

For perpetual licenses* over 100 GB, you can continue using the software with the "no-enforcement" license even if you terminate support. However, you will not receive any software updates or technical support. If you exceed your purchased license capacity, you are violating the Splunk General Terms, and the software will indicate as such in the user notification.

For term licenses, support is included with your term license, and your license will still expire at the end of the term.

*As of November 1, 2019, all Splunk products and services will feature term licenses. We will no longer sell any products with perpetual licenses. For more information, click here.