Splunk® Enterprise

Admin Manual

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Groups, stacks, pools, and other terminology

You can aggregate compatible Splunk Enterprise licenses into stacks of available license volume and define pools of indexers to use license volume from a given stack.

Splunk Free users: This functionality is only relevant for Enterprise licenses. If you're running a standalone instance of Splunk Free, groups, pools, and stacks are not needed.

License terms diagram


Certain types of Splunk licenses can be aggregated together, or stacked so that the available license volume is the sum of the volumes of the individual licenses.

This means you can increase your indexing volume capacity over time as you need to without having to swap out licenses. Instead, you simply purchase additional capacity and add it to the appropriate stack.

  • Enterprise licenses and sales trial licenses can be stacked together, and with each other.
  • The Enterprise *trial* license that is included with the standard Splunk download package cannot be included in a stack. The Enterprise trial license is designed for standalone use and is its own group. Until you install an Enterprise or sales trial license, you will not be able to create a stack or define a pool for other indexers to use.
  • The Splunk Free license cannot be stacked with other licenses, including Splunk Free licenses.
  • The forwarder license cannot be stacked with other licenses, including forwarder licenses.


A license group contains one or more stacks. A stack can be a member of only one group, and only one group can be "active" in your Splunk installation at a time. Specifically this means that a given license master can only administer pools of licenses of one group type at a time. The groups are:

  • Enterprise/sales trial group -- This group allows stacking of purchased Enterprise licenses, and sales trial licenses (which are Enterprise licenses with a set expiry date, NOT the same thing as the downloaded Enterprise trial).
  • Enterprise trial group -- This is the default group when you first install a new Splunk instance. You cannot combine multiple Enterprise trial licenses into a stack and create pools from it. If you switch to a different group, you will not be able to switch back to the Enterprise trial group.
  • Free group -- This group exists to accommodate Splunk Free installations. When an Enterprise trial license expires after 60 days, that Splunk instance is converted to the Free group. You cannot combine multiple Splunk Free licenses into a stack and create pools from it.
  • Forwarder group -- This group exists for the purposes of configuring a Splunk instance as a universal forwarder or light forwarder. These types of forwarders do not perform any indexing, and therefore aren't really managed via the Licensing pages in Manager, but do belong to a license group. If you change the license group of a Splunk instance to the Forwarder group, it assumes that Splunk instance is configured as a forwarder and will not be indexing any data. See forwarders and "Forwarder licenses" for more information.


You can define a pool of license volume from a given license license stack and specify other indexing Splunk instances as members of that pool for the purposes of volume usage and tracking.

A license pool is made up of a single license master and zero or more license slave instances of Splunk configured to use licensing volume from a set license or license stack.

License slaves

A license slave is a member of one or more license pools. A license slave's access to license volume is controlled by its license master.

License master

A license master controls one or more license slaves. From the license master, you can define pools, add licensing capacity, and manage license slaves.

Last modified on 10 September, 2016
Types of Splunk software licenses
Configure a license master

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters