Groups, stacks, pools, and other terminology
You can aggregate compatible Splunk Enterprise licenses into stacks of available license volume and define pools of indexers to use license volume from a given stack.
Splunk Free users: This functionality is only relevant for Enterprise licenses. If you're running a standalone instance of Splunk Free, groups, pools, and stacks are not needed.
Certain types of Splunk licenses can be aggregated together, or stacked so that the available license volume is the sum of the volumes of the individual licenses.
This means you can increase your indexing volume capacity over time as you need to without having to swap out licenses. Instead, you simply purchase additional capacity and add it to the appropriate stack.
- Enterprise licenses and sales trial licenses can be stacked together, and with each other. This includes a "no-enforcement" Enterprise license.
- The Enterprise trial license that is included with the standard Splunk Enterprise download package cannot be included in a stack. The Enterprise trial license is designed for standalone use and is its own group. Until you install an Enterprise or sales trial license, you will not be able to create a stack or define a pool for other indexers to use.
- The Splunk Free license cannot be stacked with other licenses, including Splunk Free licenses.
- The forwarder license cannot be stacked with other licenses, including forwarder licenses.
- The Dev/Test license cannot be stacked with other licenses, including an Enterprise license. If you install a Dev/Test license with an Enterprise license, the Enterprise license will be deleted.
A license group contains one or more stacks. A stack can be a member of only one group, and only one group can be "active" in your Splunk installation at a time. Specifically this means that a given license master can only administer pools of licenses of one group type at a time. The groups are:
- Enterprise/sales trial group -- This group allows stacking of purchased Enterprise licenses, and sales trial licenses (which are Enterprise licenses with a set expiry date, NOT the same thing as the downloaded Enterprise trial).
- Enterprise trial group -- This is the default group when you first install a new Splunk platform instance. You cannot combine multiple Enterprise trial licenses into a stack and create pools from it. If you switch to a different group, you will not be able to switch back to the Enterprise trial group.
- Free group -- This group exists to accommodate Splunk Free installations. When an Enterprise trial license expires after 60 days, that Splunk instance is converted to the Free group. You cannot combine multiple Splunk Free licenses into a stack and create pools from it.
- Forwarder group -- This group exists for the purposes of configuring a Splunk instance as a universal forwarder or light forwarder. These types of forwarders do not perform any indexing, and therefore aren't really managed via the Licensing pages in Manager, but do belong to a license group. If you change the license group of a Splunk instance to the Forwarder group, it assumes that Splunk instance is configured as a forwarder and will not be indexing any data. See forwarders and "Forwarder licenses" for more information.
A subgroup can have one of several values, including DevTest or Production. You cannot stack two licenses with different subgroups.
Subgroups are introduced in Splunk Enterprise 6.5.0. A license with no subgroup, such as a license issued before Splunk Enterprise 6.5.0, is treated as though its subgroup is Production.
A license slave is a member of one or more license pools. A license slave's access to license volume is controlled by its license master.
A license master controls one or more license slaves. From the license master, you can define pools, add licensing capacity, and manage license slaves.
Types of Splunk software licenses
Install a license
This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.6.0, 6.6.1