Licensing for Splunk for Industrial IoT

After you purchase Splunk for Industrial IoT, you receive a Splunk for Industrial IoT license. You must add this license to your software within 60 days to use all features of the products included in Splunk for Industrial IoT.

How licensing for Splunk for Industrial IoT works

Licensing for Splunk for Industrial IoT works differently from licensing for Splunk Enterprise as a standalone product. Information about licensing in the Splunk Enterprise documentation does not apply to you if you purchased a Splunk for Industrial IoT license. The Splunk for Industrial IoT license is not stackable with other Splunk Enterprise licenses.

A Splunk for Industrial IoT license includes:

• Unlimited data for a set number of sensors ingested into metrics indexes.
• A set number of GB per day of event data ingested into event indexes.

A sensor refers to a unit that streams a single type of numerical time-stamped data from an asset, application, or other entity into a Splunk metrics index. For the purposes of metering, a sensor is a unique combination of metric_name and asset ingested into a Splunk metrics index in the past 24 hours.

Event data refers to non-sensor data such as logs, alarms, network data, work orders, and so on, that you ingest into event indexes. For more about the difference between event indexes and metrics indexes, see Create custom indexes in the Splunk Enterprise documentation.

Splunk for Industrial IoT can be purchased in units of 1,000 sensors and 6 GB of daily event data ingestion. Splunk also offers a Splunk for Industrial IoT trial license. Contact your sales representative for details.

Splunk enforces license usage by running a saved search that counts your sensors and your total data ingestion into events indexes every 24 hours. For more information about the data collected, see Share data in Splunk Industrial Asset Intelligence.

For a summary of your license usage, run the following searches:

Total sensor count for all indexes

| mstats count where metric_name=* AND index=* by metric_name asset | append [|mstats count WHERE metric_name=* AND index=* AND asset!="*" by metric_name] | stats count

Total data ingested into event indexes

| REST /services/data/indexes output_mode=json datatype=event | where isInternal == 0 | stats sum(currentDBSizeMB) as usage | eval usage=usage/1024

Increase your license

Contact Splunk Sales if you want to do any of the following:

• Increase your number of allowed sensors.
• Increase your unstructured data ingestion.
• Extend the term of an existing license.

Add a license

Installing the Splunk for Industrial IoT license to your deployment involves three steps:

1. Install the license on your license master.
2. Configure all other Splunk Enterprise instances in your deployment, except forwarders, as license slaves.
3. Configure forwarders to use the forwarder license.

To add or change the license in your deployment, your role must have the license_edit capability.

Install the license on your license master

To install your Splunk for Industrial IoT license on your license master or a single-instance deployment:

1. Choose an instance to function as the license master, if you have not already done so.
2. Log into Splunk Enterprise on that instance.
3. Navigate to Settings > Licensing.
4. Click Add license.
5. Either click Choose file and navigate to your license file and select it, or click copy & paste the license XML directly... and paste your license file text into the provided field.
6. Click Install. Splunk Enterprise installs your license.
7. Restart Splunk Enterprise.

Configure license slaves

To configure a Splunk Enterprise instance as a license slave:

1. On the instance that you want to configure as a license slave, log into Splunk Web and navigate to Settings > Licensing.
2. Click Change to Slave.
3. Switch the radio button from Designate this Splunk instance as the master license server to Designate a different Splunk instance as the master license server.
4. Specify the license master to which this license slave will report. You must provide either an IP address or a hostname and the Splunk management port, which is 8089 by default.
5. Click Save.
6. Restart Splunk Enterprise.

Repeat these steps for all other non-forwarder instances of Splunk Enterprise in your environment.

Configure forwarders to use the forwarder license

If you are using universal forwarders to ingest data, it has a forwarder license applied automatically and no further action is required.

If you are using a heavy forwarder to ingest data, configure it to use a forwarder license:

1. On the instance that you want to use as a heavy forwarder, log into Splunk Web and navigate to Settings > Licensing.
2. Click Change license group.
3. Switch the radio button from Enterprise license to Forwarder license.
4. Click Save.

License expiration

When your Splunk for Industrial IoT license nears expiration, a message appears in your instance before the expiration date. Contact Splunk Sales to renew your license.

If your license expires, you will see a message on the Splunk Web login screen prompting an administrator to log in and apply a new license file. You will not be able to search your data until you apply a new license or switch to a Free license.

If you switch to a Free license, be aware of the following behaviors:

• Data ingestion for both metrics and event data is limited to 500 MB/day. You no longer have the ability to ingest unlimited metrics data for any sensors.
• Distributed search and deployment management are disabled.
• Authentication and user management, including native authentication, LDAP, and scripted authentication, is disabled.
  • There is no login. The command line or browser can access and control all aspects of Splunk software with no user and password prompt.
  • You cannot add more roles or create user accounts.
  • User accounts or roles that you created no longer work.
  • Searches run against all public indexes.
  • Restrictions on search such as user quotas, maximum per-search time ranges, search filters are not supported.
  • The capability system is disabled. All capabilities are enabled for all users accessing Splunk software.
• Any knowledge objects created by any user other than admin (such as event type, transaction, or source type definitions) and not already globally shared are not available.
• Any Splunk Enterprise alerts you defined are no longer triggered. You can still schedule searches to run for dashboards and summary indexing purposes.
• Configurations in outputs.conf to forward to third-party applications in TCP or HTTP formats do not work.