Splunk® SOAR (On-premises)

Administer Splunk SOAR (On-premises)

The classic playbook editor will be deprecated in early 2025. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:

Obtain and configure a license

From the main menu, select Administration > Company Settings > License to view information about the license on your system.

There are two types of licenses available for :

  • Community License
    This is the default, free license for everyone who registers for Community access and downloads . This license is limited to a set number of actions per day. See Community License.
  • Seat-based License
    This license is governed by the number of users allowed to log in to . Seat-based licensing is available in blocks of five seats and can vary by the number of tenants.

The number of tenants is purchased as an additional parameter for seat-based licenses.

Contact your Splunk representative or Splunk Support at least 30 days before your license expiration date to ensure continuity of service.

Community license

installs with a default license, the Community License. The Community License is limited to:

  • 100 licensed actions per day
  • 1 tenant
  • 5 cases in the New or Open states

licensed actions

  • phantom.act()
  • phantom.prompt()

Using these actions via the REST API, a Playbook, or by executing an action in the graphical user interface counts as a licensed action. When used in the Visual Playbook Editor's debugger, these actions are not counted against the number of licensed actions.

No actions called from the Visual Playbook Editor's debugger count as a licensed action.

The action limit is specifically the number of actions run, as opposed to Playbooks run. Running one Playbook may invoke several actions. Also, an action run against multiple assets will count as only one action. Keep this in mind if you are managing the number of actions taken per day.

Seat-based license

Customers using a seat-based license are limited to a number of user accounts that can log in to . This number includes local accounts in and accounts authenticated or managed by external services such as SAML2, LDAP, or OpenID. The built-in user accounts for the automation and the admin users do not count against a seat-based license. Other users assigned the admin role still count against a seat-based license.

Seat limits must be purchased in increments of five.

Obtaining a license

To obtain a license, you must submit a license request and obtain a license file.

To obtain a trial license for , contact the Sales department.

To request an updated copy of a current license, open a license request case at https://support.splunk.com or call +1(855)SPLUNK-S or +1(855)775-8657.

International Splunk Support numbers are located at https://www.splunk.com/en_us/about-us/contact.html#tabs/customer-support.

The expiration of the license is based on the terms listed in your company's entitlement.

Once you have your license file:

  1. From the main menu, select Administration.
  2. Select Company Settings > License.
  3. Click Upload Key.
  4. Provide the location of the key file on your system.
  5. Click Accept & Install. The license is applied automatically.

The information obtained from the license file is displayed on the page.

If any of the information shown is incorrect or you experience any difficulty loading the license file, open a support case at https://support.splunk.com or call +1(855)SPLUNK-S or +1(855)775-8657.

Last modified on 26 March, 2024
Configure the ROI Settings dashboard   Configure a source control repository for your playbooks

This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.1.1, 6.2.0, 6.2.1, 6.2.2, 6.3.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters