Installation

license too restrictive

wilsona
New Member

I am attempting to evaluate splunk, however the licence terms are too restrictive in order to do a proper eval. To get a baseline for my organisation I need to get a large amount of logging data in initially, then the updates will be pretty small, much less that the 500mb per day limit. Has anyone any idea how I can do this?

I have already hit the "Your Splunk license expired or you have exceeded your license limit too many times." error.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Contacting sales for a larger trial license is probably the best answer.

The 500MB/day enterprise trial license and the free license allow more than a single day's violation within a 30-day period, e.g., the I believe the free version will let you go over 3 days out of 30 and the trial will let you go over 5 out of 30. So if you can load all the data within 1 or 2 days, this won't be a problem. If you clean out all the indexed with splunk clean all, the license violation count will be reset to to zero. Once you have the configuration and process to load all the initial data, you can clean the indexed data, load it into Splunk (which will allow you to go over by an unlimited amount), and as long as the loading takes less time than the maximum violation time, you should be okay.

gkanapathy
Splunk Employee
Splunk Employee

there is not and has never been such a limit. perhaps you read that you could exceed the limit 3 times before you were locked out of searching.

0 Karma

Paolo_Prigione
Builder

So there is no top limit to the daily indexed amount? I ask because I recall reading on the docs about an indexing-cap which was 3x the licensed amount. But that was months ago and I might as well be wrong.

0 Karma

ftk
Motivator

If you are serious about evaluating splunk for purchase, contact splunk sales. A sales rep will be able to set you up with a larger volume trial license.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...