What happens if license volume limit is exceeded?

[jenny_life]

hello everyone.

I'd like to know what will happen if i exceed the license volume limit.
After getting the warning how should i do?
If I get the warning over 5 times, what will happen? can't i search anymore? or do i have to reset my license?
now, my splunk version is 6.6.2.

And I'd like to know what license volume is.

e.g. I have a license 1GB / day.
If I create two 500MB index, that is exceeded the limit?
if it's not, how do i know how many data I used in a day?
If you have a good search query or other way to check data, please let me know.

[nilbak1]

Hi @jenny_life

I will try to answer your question one by one here -
First of all,

• Warnings and violations occur when you exceed the maximum daily indexing volume allowed for your license.
  It is measured midnight to midnight by the closck on your licensing servers

• If you get the licensing warning for the first first time on a particular day that means your quota is exceeded for the day.
  This is call "soft warning". If you correct it before midnight then, then it will not count toward your rolling 30-day total.
  You can correct it by using less of your license, view the usage report to learn which data sources are contributing the
  most to your quota.If you are not able to correct it by midnight then it will become "hard warning".

• 5 such hard warnings and your license will get violate for the month. Then you need to reset the license. Now, Since you
  are using 6.6 version of splunk you can request for no-enforcement license from Splunk.com if already don't have. As no-
  enforcement license warns you when you exceed your license quota or are in license violation, but it does not disable search.
  Even during a violation period, search remains enabled.

• licensing volume is the amount of license that you have purchased from splunk.com. Its the sum of the volumes of the
  individual licenses. So, say if you have purchased 1GB/day then its your licensing volume and you created two 500 MB
  indexes then these are your licensing pools. And if daily usage got more than 1 gb/day then only you will be exceeding
  your daily limit. You can view your license usage under settings > licensing -> usage report on licensing server.

Hopefully, It answers all your questions.

[jenny_life]

@nilbak1
Thank you for your kind explanation.
I'd like to ask one more thing.
So, what you mean is , If i have purchased 1GB/day and I created two indexes as 500MB max size, I exceed the limit even though the real data size is 1 or 2MB for each index.
Is it right?
And,
If i don't create any indexes and just searching a lot, then also that day can be exceed the license limit?

[nilbak1]

@jenny_life
No its not right , you will exceed the limit when you actually have consumed or used the indexing volume allowed for your license.
Creation of index does not count towards licensing.
Say if you have purchased 1 gb license, and created 2 indexes of 500 mb each, it will not cost your license until its usage (daily indexing) is more than 500 mb.
License violation is not related to creating of indexes or searching.
It occur when you exceed the maximum indexing volume allowed for your license.

[jenny_life]

oh, Thank you so much.
I can understand.!!

[nilbak1]

There are good docs as well in splunk from which you can take reference.
Let me know if any other help needed.
You can accept this answer if all your queries are solved )