Splunk® Enterprise

Admin Manual

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

About license violations

This topic discusses license violations, how they come about, and how to resolve them. Before you proceed, you may want to review these topics:

What are license violations and warnings?

Warnings and violations occur when you exceed the maximum indexing volume allowed for your license.

If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have 5 or more warnings on an Enterprise license or 3 warnings on a Free license in a rolling 30-day period, you are in violation of your license and search will be disabled for the offending pool(s). Other pools will remain searchable and be unaffected, as long as the total license usage from all pools does not exceed the total license quota for the license master.

Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) warnings in the previous 30 days, or when you apply a temporary reset license (available for Enterprise only). To obtain a reset license, contact your sales rep. See the Installation Manual for instructions on how to apply it.

Note: Summary indexing volume is not counted against your license, although in the event of a license violation, summary indexing will halt like any other non-internal search behavior.

If you get a violation warning, you have until midnight (going by the time on the license master) to resolve it before it counts against the total number of warnings within the rolling 30-day period.

During a license violation period:

  • Splunk does not stop indexing your data. Splunk only blocks search while you exceed your license.
  • Searches to the _internal index are not disabled. This means that you can still access the Indexing Status dashboard or run searches against _internal to diagnose the licensing problem.

What license warnings look like

If indexers in a pool exceed the license volume allocated to that pool, you will see a yellow warning banner across the top of Splunk Web:

License violation warning.png

Clicking on the link in the banner takes you to Manager > Licensing, where the warning shows up under the Alerts section of the page. Click on a warning to get more information about it.

A similar banner is shown on license slaves when a violation has occurred.

Here are some of the conditions that will generate a licensing alert:

  • When a slave becomes an orphan, there will be an alert (transient and fixable before midnight)
  • When a pool has maxed out, there will be an alert (transient and fixable before midnight)
  • When a stack has maxed out, there will be an alert (transient and fixable before midnight)
  • When a warning is given to one or more slaves, there will be an alert (will stay as long as the warning is still valid within that last 30-day period)

About the connection between the license master and license slaves

When a license master instance is configured, and license slaves are added to it, the license slaves communicate their usage to the license master every minute. If the license master is unreachable for any reason, the license slave starts a 24-hour timer. If the license slave cannot reach the license master for 24 hours, search is blocked on the license slave (although indexing continues). Users will not be able to search data in the indexes on the license slave until that slave can reach the license master again.

To find out if a license slave has been unable to reach the license master, look for an event that contains failed to transfer rows in splunkd.log or search for it in the _internal index.

How to avoid license violations

To avoid license violations, monitor your license usage and ensure you have sufficient license volume to support it. If you do not have sufficient license volume, you need to either increase your license or decrease your indexing volume.

Here are some options for monitoring license usage:

  • Use the Splunk on Splunk app to see how licensing capacity is used in your deployment.
  • Navigate to Manager > Licensing to view details about your license, including your license warnings and violations.
  • Use the "Indexing volume" status dashboard in the Search app to see details about index volume in your infrastructure. Note that the overview includes internal indexing, which does not count against your license.

Access the Indexing volume status dashboard

To see the "Indexing volume" dashboard:

1. Log into Splunk Web and navigate to the Search app.

2. Click Status > Index activity > Indexing volume.

3. Choose a server, "split-by" option (to see indexing volume by source, source type, index, or host), and a time range. The dashboard will reload automatically and update your results.

4. To drill down into more detail, click on a row in the list. From there, you can view the events on a timeline. To view the events themselves, click on a bar in the timeline:

License index status.png

Correcting license warnings

If Splunk is telling you to correct your license warning before midnight, you've probably already exceeded your quota for the day. The license quota will reset at midnight, so you have until then to fix your situation and ensure that you won't go over quota tomorrow, too.

Once you've already indexed data, there is no way to un-index data that will give you "wiggle room" back on your license. You need to do one or more of the following:

  • Get additional license room, either by purchasing a bigger license or by rearranging license pools if you have a pool with extra license room.
  • Use less of the license.

Take a look at this Community Wiki topic to learn which data sources are contributing the most to your quota.

Once you've determined your data culprit, decide whether or not you need all the data it is emitting. If not, read "route and filter data" in the Deploying Splunk Manual.


Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has around license violations.

Swap the license master
About Splunk Free

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18


Maxbarrass:<br />Note that you do get a couple of free passes to go over your indexing limit, in that your search isn't shut off until you've exceeded your license 3 or 5 times in a rolling 30 day window.

Jlaw splunk, Splunker
June 25, 2012

I expected the indexer to only index up 500MB (on free version), if there is more files it should resume on them the next day. I know I can only do 500MB and I only want it to do 500MB a day for the initial load of logs and then after that it will be less than 20MB a day.<br /><br />Can you just make the engine index 500MB (or up to the limit of period) and do the remainder next period? <br /><br />Great tool otherwise!

June 24, 2012

Juggler314:<br />It should be "only" 28 days from the day you switch to the free license. (It's a 30 day rolling window.)<br /><br />Alternately, contact your area's sales rep: http://www.splunk.com/index.php/ask_expert/2468/3117

Jlaw splunk, Splunker
June 11, 2012

So I had a splunk server running on the trial and I forgot about it for 3 months, once the trial expired - since I hadn't logged in and changed it to the free license my daily limit was set to 0 bytes. So now I've got 93 license violations and 30 in the last 30 days - do I really need to wait 30 days for this to clear up or is there some way to properly resolve this?

May 31, 2012

Thanks for the suggestions! We'll investigate and make it work.

Jlaw splunk, Splunker
February 10, 2012

Suggested changes:<br />Section:"What are License Violations"<br />Alter "search will be disabled"<br />to<br />"Search will be disabled for the offending pool(s) only - other pools will remain searchable / will be unaffected"<br /><br />Also suggest mentioning that Summary Searches / SI populations are disabled when search is disabled. <br />This isn't something I'd thought about previously - mentally, I hadn't classified them as "search behaviours" because it's explicitly mentioned as:<br />"Note: Summary indexing volume is not counted against your license. "<br /><br />This would have been a nasty gotcha down the track - perhaps it could be explicitly mentioned on that page, something akin to:<br />Note: Summary indexing volume is not counted against your license, although in the event of a license violation, summary indexing will halt like any other non-internal search behaviour.<br /><br />Best,<br />--Benji<br />(Reference: <br />http://splunk-base.splunk.com/answers/38742/license-violations-if-a-sub-pool-exceeds-quota-what-happens-to-the-other-pools-slaves

January 30, 2012

When you get a "Daily indexing volume limit exceeded", besides flushing the relevant index, is there anything you can do to "resolve" the situation before midnight?

January 12, 2012

I am getting "slave count violations", using free license group.<br /><br />I don't think I have any slaves. I am forwarding logs to the splunk server however. I did not have this problem before upgrading to the new license model. Could the server be counting the number of "hosts" in the index?<br /><br />Rich

June 4, 2011

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters