Installation

How does licensing work?

mctester
Communicator

In the Free vs. Enterprise license comparison it says there's no limit on indexing in Enterprise license, but in the documentation it says that the Enterprise license can be violated by exceeding daily indexing limits, so please explain to me whether there are limits or not.

0 Karma

jrodman
Splunk Employee
Splunk Employee

I suspect whatever said there's no limit was talking about something else. Perhaps no limit on the number of indexes?

0 Karma

Mick
Splunk Employee
Splunk Employee

Lets take a 3GB license as an example -

Your Enterprise license will allow you to index 3GB of data per day. In case of an unexpected data surge, we do allow for 5 violations in a 30-day period - so if you have a web-server start to produce lots of errors and you index 3.5GB on a Sunday, Splunk will tell you this on Monday morning, and everything will continue to work as before.

If you don't fix the problem and Splunk continues to index more that 3GB data on Monday, Tuesday, Wednesday & Thursday, that makes 5 violations, so Splunk will not allow you to search any data on Friday morning. Data will still be indexed, as Splunk never stops eating your data, but you won't be able to search it until you get a reset key from Splunk Support. The first one is free but repeated requests for reset keys will result in questions on the suitability of your license size so make sure you size your purchased license appropriately for your needs

The only reason Splunk will stop indexing data is if it runs out of disk-space to write to. As long as data keeps coming in, Splunk will keep indexing it, even if you have 20 violations.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...