Is it possible to rollover unused license usage from day to day until the end of the month?

[mweissha]

Not so much a question but a re-question. If there is a better place for this, please let me know.

Recently we've had a major spike in indexing from one of our sources, this has caused me to have to stop indexing all together for that source until the traffic dies down. At this time, it isn't much of an issue, but in the future when we have more dashboards/reports linked to this source, this cannot happen. Would there be any plan in future to allow a rollover of unused license usage from day to day till the end of the month?

[s2_splunk · Accepted solution]

While I cannot comment on future plans regarding our licensing models, please note that indexing will never stop when daily licensed volume is exceeded.
On Splunk versions pre-6.5 search will be disabled if you have more than five license violations within 30 days. If you are on 6.5.x, you can contact your Splunk account rep and request a no-enforcement license, which will cause Splunk to continue to work normally when licensed volumes are exceeded.

[mweissha]

Thanks. I think I should have clarified my post as we were one violation away from our search being turned off, thus the reason I was curious about rollover. I attempted in vain to stop indexing so as to avoid the search being turned off. Had there been a rollover in place like I'm suggesting then we would have been able to troubleshoot through splunk instead of 3 or 4 other external sources.

The no-enforcement license is something I'll look into if this becomes an issue later.

[jlaw]

During a violation, searches to the _internal index still work, so you should be able to still troubleshoot licensing volume:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Aboutlicenseviolations#What_happens_during_a...

[mweissha]

That is true, however it wasn't licensing volume that I needed to troubleshoot. It was why there was a huge increase in one source. Had to go old school and tail some logs.