Installation

Is it possible to rollover unused license usage from day to day until the end of the month?

mweissha
Path Finder

Not so much a question but a re-question. If there is a better place for this, please let me know.

Recently we've had a major spike in indexing from one of our sources, this has caused me to have to stop indexing all together for that source until the traffic dies down. At this time, it isn't much of an issue, but in the future when we have more dashboards/reports linked to this source, this cannot happen. Would there be any plan in future to allow a rollover of unused license usage from day to day till the end of the month?

Labels (1)
0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

While I cannot comment on future plans regarding our licensing models, please note that indexing will never stop when daily licensed volume is exceeded.
On Splunk versions pre-6.5 search will be disabled if you have more than five license violations within 30 days. If you are on 6.5.x, you can contact your Splunk account rep and request a no-enforcement license, which will cause Splunk to continue to work normally when licensed volumes are exceeded.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

While I cannot comment on future plans regarding our licensing models, please note that indexing will never stop when daily licensed volume is exceeded.
On Splunk versions pre-6.5 search will be disabled if you have more than five license violations within 30 days. If you are on 6.5.x, you can contact your Splunk account rep and request a no-enforcement license, which will cause Splunk to continue to work normally when licensed volumes are exceeded.

mweissha
Path Finder

Thanks. I think I should have clarified my post as we were one violation away from our search being turned off, thus the reason I was curious about rollover. I attempted in vain to stop indexing so as to avoid the search being turned off. Had there been a rollover in place like I'm suggesting then we would have been able to troubleshoot through splunk instead of 3 or 4 other external sources.

The no-enforcement license is something I'll look into if this becomes an issue later.

0 Karma

jlaw
Splunk Employee
Splunk Employee

During a violation, searches to the _internal index still work, so you should be able to still troubleshoot licensing volume:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Aboutlicenseviolations#What_happens_during_a...

mweissha
Path Finder

That is true, however it wasn't licensing volume that I needed to troubleshoot. It was why there was a huge increase in one source. Had to go old school and tail some logs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...