Will switching to free Splunk from an Enterprise trial license disregard the current license violation?

[wennylynn]

We are currently using the Splunk Enterprise trial license (we still have a month or so for the trial license) However, we have exceeded the license limit for 3 days already causing a licensing violation. This is only for our test environment and the sudden increase in indexing was due to an issue that we have already identified and resolved.

Apart from applying for a license and waiting for the license violation to be lifted, is there any other workaround that we can try to implement now to get us moving forward again?

Will switching to Splunk Free from the Trial license disregard the earlier licensing violation from the previous days?

Thanks!

[mayurr98 · Accepted solution]

hey you can refer this doc
https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/MoreaboutSplunkFree#What_you_should_know_ab...

from the documentation:

"If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have 5 or more violations on an Enterprise license or 3 violations on a Free license in a rolling 30-day period, search will be disabled. Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) violations in the previous 30 days or when you apply a new license with a larger volume limit.

Note: During a license violation period, Splunk does not stop indexing your data. Splunk only blocks access while you exceed your license.

Note: Searches to the _internal index are not disabled even during a licensing-enforcement period, so you can still access the Indexing Status dashboard, or run searches against _internal to diagnose the licensing problem. "

so: you can exceed your Enterprise license 4 times within 30 days--the 5th time, search will be disabled. You can exceed your Free licenses 2 times, and the 3rd time, search will be disabled.
This is official doc so I think this should answer your question.

let me know if it helps!

[wennylynn]

Thanks! I've browsed through this one already earlier and found this statement "Splunk Free regulates your license usage by tracking license violations. If you go over 500 MB/day more than 3 times in a 30 day period, Splunk Free continues to index your data, but disables search functionality until you are back down to 3 or fewer warnings in the 30 day period."

Judging by this, the answer to my question "Will switching to Splunk Free from the Trial license disregard the earlier licensing violation from the previous days?" will sadly be No right?

[mayurr98]

No, it won't! but I would you suggest you to use trial license till fourth violation and then convert it to free license then you will have 3 more times

[nickhills]

I don' think that is correct.
If you are running on the ent-trial with 4 violations, when you convert to free, the 4 violations will move with the version change, and your system will immediately disable search.

Users on Splunk answers have previously confirmed that changing ent-trial -> free does not reset any existing violations, and if you have 3+ violations when you convert you are stuck.

Are you are trailing Splunk with a (potential) eventual intention to purchase? .If so, you should contact Splunk sales, who I am sure would be prepared to offer 'reset' key to allow you to complete your trial if you are a genuine opportunity.

[mayurr98]

hey, that was just a suggestion, any which ways his license is going to get violate so I just told him to try that. But if you are sure that It will disable his search then yes are right. he will need to get a reset key from Splunk. so now he cannot convert to free license.If he converts, his search will get disabled and then he will need a reset key.