Installation

What happens when I exceed my licensed limit?

the_wolverine
Champion

What happens when I exceed my Enterprise license limit?

How many times can I exceed my Enterprise Trial licensed limit? How about Free?

1 Solution

piebob
Splunk Employee
Splunk Employee

from the documentation:

"If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have 5 or more violations on an Enterprise license or 3 violations on a Free license in a rolling 30-day period, search will be disabled. Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) violations in the previous 30 days or when you apply a new license with a larger volume limit.

Note: During a license violation period, Splunk does not stop indexing your data. Splunk only blocks access while you exceed your license.

Note: Searches to the _internal index are not disabled even during a licensing-enforcement period, so you can still access the Indexing Status dashboard, or run searches against _internal to diagnose the licensing problem. "

so: you can exceed your Enterprise license 4 times within 30 days--the 5th time, search will be disabled. You can exceed your Free licenses 2 times, and the 3rd time, search will be disabled.

View solution in original post

jaminquimby
Explorer

I am new to Splunk and I am trying to understand forwarders. I ran my first test and I imported 65,000 null values with a timestamp, guid and shot over the limit.

Why not create a single user version in trial mode for a month at least I could test the forwarders without it hurting my indexing dont know if I said that right because I really dont understand what counts as a index.

Also I have years of historical data why not give us the ability to import that data over time so we dont go over the index in a given day.

Is a index a search index, a import index, a row index. Not sure.

0 Karma

fraserhardy
New Member

I had this problem as we went way over after first adding our servers due to historical data. We have been supplied a larger licence which I have applied however it still wont let us carry out any searches now.

Is there anyway to reset this?

0 Karma

David
Splunk Employee
Splunk Employee

You will need to request a reset license. Take a look at this for more: http://splunk-base.splunk.com/answers/12970/excessive-license-violations-after-installing-new-licens...

timhon5
Engager

are they serious? Instead of penalizing us for using the trial when it accidently goes over the limit, shouldnt they instead just stop indexing at the limit???

timstiles
Engager

i'm running into this problem with my eval , what purpose does this serve other than trashing the eval ?

the_wolverine
Champion

You should try contacting sales to see if they can offer you a larger license for your evaluation. The licenses have a time out so if you are legitimately evaluating, I don't see why they wouldn't offer you the bigger license.

0 Karma

piebob
Splunk Employee
Splunk Employee

from the documentation:

"If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have 5 or more violations on an Enterprise license or 3 violations on a Free license in a rolling 30-day period, search will be disabled. Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) violations in the previous 30 days or when you apply a new license with a larger volume limit.

Note: During a license violation period, Splunk does not stop indexing your data. Splunk only blocks access while you exceed your license.

Note: Searches to the _internal index are not disabled even during a licensing-enforcement period, so you can still access the Indexing Status dashboard, or run searches against _internal to diagnose the licensing problem. "

so: you can exceed your Enterprise license 4 times within 30 days--the 5th time, search will be disabled. You can exceed your Free licenses 2 times, and the 3rd time, search will be disabled.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...