|
I am attempting to evaluate splunk, however the licence terms are too restrictive in order to do a proper eval. To get a baseline for my organisation I need to get a large amount of logging data in initially, then the updates will be pretty small, much less that the 500mb per day limit. Has anyone any idea how I can do this? I have already hit the "Your Splunk license expired or you have exceeded your license limit too many times." error. |
|
Contacting sales for a larger trial license is probably the best answer. The 500MB/day enterprise trial license and the free license allow more than a single day's violation within a 30-day period, e.g., the I believe the free version will let you go over 3 days out of 30 and the trial will let you go over 5 out of 30. So if you can load all the data within 1 or 2 days, this won't be a problem. If you clean out all the indexed with So there is no top limit to the daily indexed amount? I ask because I recall reading on the docs about an indexing-cap which was 3x the licensed amount. But that was months ago and I might as well be wrong.
(22 Jul '10, 15:36)
Paolo Prigione
there is not and has never been such a limit. perhaps you read that you could exceed the limit 3 times before you were locked out of searching.
(22 Jul '10, 16:04)
gkanapathy ♦
|
|
If you are serious about evaluating splunk for purchase, contact splunk sales. A sales rep will be able to set you up with a larger volume trial license. |