We know that Splunk plays a mission-critical role for your business. With metered enforcement, unanticipated data growth or bursts of new data during an incident investigation could cause disruption in your Splunk Enterprise use. So starting with version 6.5, Splunk Enterprise no longer disables searches when you exceed your licensed data ingestion quota.


What is the removal of metered license enforcement?
Starting with version 6.5, Splunk Enterprise will no longer disable search when you exceed your licensed data ingestion quota. This will be standard for any new license purchased on or after September 27, 2016. If you’re an existing customer, you will need to upgrade to Splunk Enterprise 6.5 and request a “no-enforcement” key from your Splunk sales rep or Splunk authorized partner.


Why is Splunk doing this?
Splunk plays a mission-critical role for our customers’ business. With metered enforcement, unanticipated growth from new use cases or bursts of new data during an incident investigation could cause critical business disruption. Our goal is to remove any anxiety around ingesting data into Splunk and prevent possible disruption in your ability to use the software.


What do I have to do to remove enforcement from my deployment?
Removal of enforcement is governed by a new type of license key (“no-enforcement”) and the installation or upgrade to Splunk Enterprise 6.5. Current customers can upgrade their entire deployment, or simply upgrade their deployment’s License Master to Splunk Enterprise 6.5. You will need to acquire a new “no enforcement” key and install it on each deployment’s License Master. Once the "no-enforcement” key is installed, enforcement is removed across the entire deployment, including on the volume from previously purchased keys.


Who can get a “no-enforcement” key? Is a new purchase required?
No new purchase is required. However, you must have already purchased a Splunk Enterprise term or perpetual license and have a currently active support entitlement in order to receive a “no-enforcement” key.


Do I need to upgrade to Splunk Enterprise 6.5 in order to get the new capability? Is there an exception process?
You must upgrade at least the License Master in your deployment to 6.5 to take advantage of this capability. The “no-enforcement” key is ONLY compatible with 6.5 license stacks. Attempting to install a "no-enforcement" key on an older version of Splunk will result in an error stating the key is unrecognized. There is no exception process.


Do I have to upgrade all my forwarders, indexers and search heads to 6.5 to take advantage of this capability?
No, only the License Masters need to be upgraded to 6.5 to use this license. License Slaves will have quota enforcement disabled if the License Master has a "no-enforcement" key.


Can I update the License Master of any previous version of Splunk Enterprise?
The License-Master-only upgrade procedure will work for any 5.x or 6.x version of Splunk Enterprise.


Once I’ve upgraded, how do I know if I’m exceeding my license capacity?
Notifications in the software will continue to indicate license violations.

In addition, Splunk Enterprise 6.5 provides an easy way to share information about your deployment, including usage data, with Splunk. While this is not mandatory, it is one additional mechanism to help you stay in compliance. Read more at http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Shareperformancedata


What happens if I temporarily burst over my purchased license capacity?
The software will generate a violation warning if you exceed your licensed ingestion volume on any one calendar day. If you exceed your daily ingestion limit five or more times in a rolling 30-day period, you will be in violation of your license. However, the software will no longer disable search functionality if you exceed this limit.


What will Splunk do if I go over my purchased license capacity?
You should work with your Splunk sales rep or Splunk authorized partner to assess your current usage and purchase additional license capacity. It is not Splunk’s intention to bill for retroactive usage or surprise customers with invoices for previous license overages.


What is my legal obligation if I exceed my purchased license capacity?
Your legal obligations remain unchanged. Splunk’s EULA language specifically states that customers cannot exceed their Licensed Capacity. If you do, you need to purchase additional capacity to remain in compliance with your license. The relevant sections of the EULA (https://www.splunk.com/en_us/legal/splunk-software-license-agreement.html) are listed below:

  • Section 3: LICENSE RESTRICTIONS states that customers cannot exceed their purchased license capacity
  • Section 9: SOFTWARE VERIFICATION AND AUDIT spells out Splunk’s right to verify and/or audit the customer’s usage of Splunk software


What is the process to get the new key?
Method 1: Purchase a net-new Splunk Enterprise license.
For any license purchase after September 27, 2016, you will actually receive two keys: one for the purchased license capacity and one “no-enforcement” key.

The “no enforcement” key only works on 6.5 license masters. It is not compatible with previous versions of Splunk Enterprise. If you are an existing customer running an earlier version of Splunk Enterprise, we are providing both keys so that you can install the “no-enforcement” key when you are ready to upgrade to 6.5.

Method 2: Contact your Sales rep or Splunk Authorized Partner to request a key.
They’ll help you assess your current deployment, use cases, and data volume needs and provide recommendations to secure additional capacity and a “no-enforcement” key.


How does this affect Premium Solutions like Splunk IT Service Intelligence and Splunk Enterprise Security?
Usage of Premium Solutions will not be affected by the removal of metered enforcement in Splunk Enterprise.


Where can I find additional documentation that explains how disabling of enforcement works?
Detailed documentation is available at: http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/TypesofSplunklicenses


Can I cancel my support agreement and continue to use the software without restriction?
For perpetual licenses, you can continue using the software with the "no-enforcement" license even if you terminate support. However, you will not receive any software updates or technical support. If you exceed your purchased license capacity, you are violating the EULA and the software will indicate as such in the user notification.

For term licenses, support is included with your term license, and your license will still expire at the end of the term.