Splunk Enterprise License Enforcement FAQ

We know that Splunk plays a mission-critical role for your business. We value you, our customers, and all the ways you are using Splunk, the Data-to-Everything Platform. As we continue to innovate and update policies, we want to keep you up to speed on the new license enforcement policy for on-premises license stack volumes less than 100 GB.

What is the new license enforcement policy?

For Splunk Admins managing a Splunk Enterprise On-Premises license stack of total capacity less than 100 GB, who are on version Splunk Enterprise 8.1.0 and above, Splunk Enterprise will automatically deactivate search in each of these cases:

• For the entire deployment when total usage (across the stack and all license pools) exceeds license capacity and receives 45 warnings over a rolling 60-day window.
• In cases where license pools have a strict quota enabled, search is turned off for the offending license pool member(s) after 45 warnings over a rolling 60-day window for the license pool. Other pools are searchable as long as the total usage across the stack and all license pools does not exceed the stack license capacity 45 times over a rolling 60-day window. The customer can upgrade to a larger license to meet their larger indexing needs.

How does this affect Premium Solutions like Splunk IT Service Intelligence and Splunk Enterprise Security?

This license enforcement policy will apply if you have less than 100 GB stack volume, including your core Splunk and premium solutions’ combined indexing capacity on version 8.1.0 or later of Splunk Enterprise.

What happens if my search is turned off?

• If you are on a version lower than Splunk Enterprise 6.5: Upgrade to a currently supported Splunk Enterprise version and obtain a “no enforcement” key so that the software will not turn off search. License is enforced as described above for capacities below 100GB on Splunk Enterprise versions 8.1.0 and above
  
  The “no enforcement” key should be installed on each deployment’s License Manager. You can get the key in either of these two methods:
  
  Method 1: Purchase a net-new currently supported Splunk Enterprise license. For any license purchase after September 27, 2016, you will actually receive two keys: one for the purchased license capacity and one “no-enforcement” key. The “no enforcement” key only works on license managers on versions 6.5 and above. It is not compatible with previous versions of Splunk Enterprise. If you are an existing customer running an earlier version of Splunk Enterprise, we are providing both keys so that you can install the “no-enforcement” key when you are ready to upgrade.
  
  Method 2: Contact your sales rep or Splunk authorized partner to request a key. They’ll help you assess your current deployment, use cases and data volume needs and provide recommendations to secure additional capacity and a “no-enforcement” key."

• If you are on a Splunk Enterprise version from 6.5 to 8.0: Splunk Enterprise will not turn off search when you exceed your licensed data ingestion quota. 
• If you are on Splunk Enterprise 8.1.0 and above: To re-enable search after it is turned off you must work with your Splunk sales rep or Splunk authorized partner to assess your current usage and purchase additional license capacity.

How do I know if I’m exceeding my license capacity?
Notifications in the software will indicate license warnings and violations.

What happens if I exceed my purchased license capacity?
The software will generate a warning if you exceed your licensed indexing volume on any one calendar day.

• If you exceed your daily indexing limit five or more times in a rolling 30-day period and have a license stack volume over or equal to 100 GB on Splunk Enterprise version 6.5 and above, the software will not deactivate your search functionality.

• If you exceed your daily indexing limit five or more times in a rolling 30-day period and have a license stack volume less than 100 GB on Splunk Enterprise versions between 6.5 and 8.1.0, the software will not deactivate your search functionality.

• If you exceed license capacity 45 or more times in a rolling 60-day period and have a license stack volume less than 100 GB on Splunk Enterprise version 8.1.0 and above, the software will deactivate your search functionality. In cases where license pools have strict quota enabled, search is deactivated for the offending license pool member(s) after 45 warnings over a rolling 60-day window for the license pool. Other pools are searchable as long as the total usage across the stack and all license pools does not exceed the stack license capacity 45 times over a 60-day window. The customer can upgrade to a larger license to meet their larger indexing needs.

You should work with your Splunk sales rep or Splunk authorized partner to assess your current usage and purchase additional license capacity.

What is my legal obligation if I exceed my purchased license capacity?
Your legal obligations remain unchanged. The Splunk General Terms specifically state that customers cannot exceed their Capacity.

Where can I find additional documentation?
Detailed documentation is available here. 

Can I cancel my support agreement and continue to use the software without restriction?

For perpetual licenses* over 100 GB, you can continue using the software with the "no-enforcement" license even if you terminate support. However, you will not receive any software updates or technical support. If you exceed your purchased license capacity, you are violating the Splunk General Terms, and the software will indicate as such in the user notification.

For term licenses, support is included with your term license, and your license will still expire at the end of the term.

*As of November 1, 2019, all Splunk products and services will feature term licenses. We will no longer sell any products with perpetual licenses. For more information, click here.