Install a license

Install a license

Each instance of Splunk server must have its own license. This topic discusses how to install or update a license, and what to do when you have a violation on your license.

For more details about license types and policies, refer to "About Splunk licenses" earlier in this manual.

Note: You must purchase a separate license for every instance of Splunk with an Enterprise license that you deploy.

Install your license

All Splunk servers have a license located in $SPLUNK_HOME/etc/, whether it is a Free license (splunk-free.license) or an Enterprise license (splunk.license). You can install and update your licenses with the CLI or using Splunk Web.

Install a license using Splunk Web

1. Log into Splunk Web as the admin user.

2. Click Manager>License.

3. Click Change License.

4. Paste in your license key and click Save.

5. Return to the main Manager tab and click Restart Splunk.

Pre-seeding your license before first time run

Starting with 4.0.2, by default when you start Splunk for the first time, it moves aside any existing 3.x license and replaces it with a temporary Enterprise trial license. This allows you to bring up the new version of Splunk without having your license be expired until you get your new one copied in.

If you are migrating to Splunk 4.0.2 or later and have a valid 4.x license, you can pre-seed the license file so that it pulls in and installs your new license the first time you start Splunk 4. This is useful if you have to deploy multiple instances and don't want to have to manually copy the new license in after starting Splunk on each machine.

• Migrate to 4.0.2 or later, but don't start Splunk yet.
• Copy your new license into $SPLUNK_HOME/etc/splunk-user.license.
• Start Splunk.

If you're making a deployable package, you can include the splunk-user.license file with your updated license in it before you tar/zip it up for deployment to other systems.

License violations

Violations occur when you exceed the maximum indexing volume allowed for your license. If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have more than 5 violations in a rolling 30-day period, search will be disabled. Search capabilities return when you have fewer than 5 violations in the previous 30 days or when you apply a new license with a larger volume limit.

Got license violations? Click here for some troubleshooting recommendations from the Splunk Community Wiki.

Note: During a license violation period, Splunk does not stop indexing your data. Splunk only blocks search access while you exceed the allowed number of license violations.

• Was this topic useful?
• Post a comment