About license violations
This topic discusses license violations, how they come about, and how to resolve them. Before you proceed, you may want to review these topics:
- Read "How Splunk licensing works" in this manual for an introduction to Splunk licensing.
- Read "Groups, stacks, pools, and other terminology" in this manual for more information about Splunk license terms.
What are license violations and warnings?
Warnings and violations occur when you exceed the maximum indexing volume allowed for your license.
If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have 5 or more warnings on an Enterprise license or 3 warnings on a Free license in a rolling 30-day period, you are in violation of your license, and search will be disabled for the offending pool(s). Other pools will remain searchable and be unaffected, as long as the total license usage from all pools does not exceed the total license quota for the license master.
Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) warnings in the previous 30 days, or when you apply a temporary reset license (available for Enterprise only). To obtain a reset license, contact your sales rep. See the Installation Manual for instructions on how to apply it.
Note: Summary indexing volume is not counted against your license, although in the event of a license violation, summary indexing will halt like any other non-internal search behavior.
If you get a license warning, you have until midnight (going by the time on the license master) to resolve it before it counts against the total number of warnings within the rolling 30 day period.
During a license violation period:
- Splunk does not stop indexing your data. Splunk only blocks search while you exceed your license. This restriction includes scheduled reports and alerts.
- Searches to the
_internalindex are not disabled. This means that you can still access the Indexing Status dashboard or run searches against
_internalto diagnose the licensing problem.
What license warnings look like
If indexers in a pool exceed the license volume allocated to that pool, you will see a yellow warning banner across the top of Splunk Web:
Clicking on the link in the banner takes you to Settings > Licensing, where the warning shows up under the Alerts section of the page. Click on a warning to get more information about it.
A similar banner is shown on license slaves when a violation has occurred.
Here are some of the conditions that will generate a licensing alert:
- When a slave becomes an orphan, there will be an alert (transient and fixable before midnight)
- When a pool has maxed out, there will be an alert (transient and fixable before midnight)
- When a stack has maxed out, there will be an alert (transient and fixable before midnight)
- When a warning is given to one or more slaves, there will be an alert (will stay as long as the warning is still valid within that last 30-day period)
About the connection between the license master and license slaves
When you configure a license master instance and add license slaves to it, the license slaves communicate their usage to the license master every minute. If the license master is down or unreachable for any reason, the license slave starts a 72 hour timer. If the license slave cannot reach the license master for 72 hours, search is blocked on the license slave (although indexing continues). Users will not be able to search data in the indexes on the license slave until that slave can reach the license master again.
To find out if a license slave has been unable to reach the license master, look for an event that contains
failed to transfer rows in splunkd.log or search for it in the _internal index.
How to avoid license violations
To avoid license violations, monitor your license usage and ensure you have sufficient license volume to support it. If you do not have sufficient license volume, you need to either increase your license or decrease your indexing volume.
The distributed management console contains alerts that you can enable, including one that monitors license usage. See "Platform alerts" in this manual.
Use the License Usage report to see details about and troubleshoot index volume in your deployment. Read about the license usage report view in the next chapter.
Correcting license warnings
If Splunk is telling you to correct your license warning before midnight, you've probably already exceeded your quota for the day. This is called a "soft warning." The daily license quota will reset at midnight (at which point the soft warning will become a "hard warning"). You have until then to fix your situation and ensure that you won't go over quota tomorrow, too.
Once you've already indexed data, there is no way to un-index data that will give you "wiggle room" back on your license. You need to get additional license room in one of these two ways:
- Purchase a bigger license.
- Rearrange license pools if you have a pool with extra license room.
If you cannot do either of these, prevent a warning tomorrow by using less of your license. Take a look at the License Usage Report View to learn which data sources are contributing the most to your quota.
Once you identify a data culprit, decide whether or not you need all the data it is emitting. If not, read "route and filter data" in the Forwarding Data Manual.
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has around license violations.
Manage your licenses
Swap the license master
This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14