Install a license

This topic discusses how to install a new license in Splunk Enterprise. Before you proceed, you might want to review these topics on licensing:

• See How Splunk licensing works in the Admin Manual for an introduction to Splunk licensing.
• See Groups, stacks, pools, and other terminology in the Admin Manual for more information about Splunk license terms.

Add a new license

To add a new license:

1. Navigate to Settings > Licensing.

2. Click Add license.

3. Either click Choose file and navigate to your license file and select it, or click copy & paste the license XML directly... and paste the text of your license file into the provided field.

4. Click Install. Splunk installs your license. If this is the first Enterprise license that you are installing, you must restart Splunk.

License violations

Violations occur when you exceed the maximum indexing volume allowed for your license. If you exceed your licensed daily volume on any one calendar day, you receive a violation warning. The message persists for 14 days. If you have 5 or more warnings on an Enterprise license or 3 warnings on a Free license in a rolling 30-day period, you are in violation of your license and Splunk disables search. Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) warnings in the previous 30 days, or when you apply a temporary reset license (available for Enterprise only). To obtain a reset license, contact your sales rep.

Note: Summary indexing volume does not count against your license.

If you get a violation warning, you have until midnight (using the time on the license master) to resolve it before it counts against the total number of warnings within the rolling 30-day period.

During a license violation period:

• Splunk never stops indexing your data. Splunk only blocks search while you exceed your license.
• Splunk does not disable searches to the _internal index. This means that you can still access the Indexing Status dashboard or run searches against _internal to diagnose the licensing problem.

Got license violations? Read About license violations in the Admin Manual or Troubleshooting indexed data volume from the Splunk Community Wiki.

More licensing information is available in the "Manage Splunk licenses" chapter in the Admin Manual.