Installation

Indexer cluster - does data remain accessible after license expires?

pcsegal1
Explorer

Hi,

I have a Splunk Enterprise cluster that consists of:

  • 1 cluster master
  • 3 indexers
  • 1 search head
  • 1 license master

My doubt is: when the Enterprise license expires and you don't include a new license, what happens to the data already residing in the indexers? Does it remain accessible? Is there any specific procedure that I would need to perform to make sure the data would remain accessible in that situation?

As I understand it, Splunk lets you to downgrade to a Free license, and then you lose all the Enterprise features, including distributed search. Given that Free license doesn't allow distributed search, does this mean that the 3 indexers will automatically become standalone instances, and I'd still be able to search their data individually?

Labels (3)
0 Karma

woodcock
Esteemed Legend

When your license expires, you continue to ingest data and it continues to be maintained as always, but you can no longer search it. In the case of downgraded to Free and losing distributed, yes: each indexer becomes a standalone unit and whatever gets forwarded to any indexer is searchable on that indexer, provided it also is setup to use the Free license.

pcsegal1
Explorer

Thank you.
Just to make sure I understand:
If I make sure that (1) data stops coming into the indexers before the license expires, and (2) the license is downgraded to Free in the license master, do the indexers automatically become standalone and individually searchable?

0 Karma

woodcock
Esteemed Legend

Yes. They are always individually searchable, even when clustered.

0 Karma

pcsegal1
Explorer

A follow up question about the described scenario:
After license expiration, when downgrading the cluster members from Enterprise to Free, is there any special procedure that needs to be performed to make sure that the already existing data (everything that was indexed prior to the expiration) is preserved?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...