Splunk® Enterprise

Installation Manual

Splunk Enterprise version 7.1 is no longer supported as of October 31, 2020. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Install a license

After you install Splunk Enterprise, you must install a license within 60 days to continue using all of the features of the product.

Before you proceed, you might want to review these topics on licensing:

Add a new license

If you install a Dev/Test license with an Enterprise license, the Enterprise license file will be replaced.

  1. Navigate to Settings > Licensing.
  2. Click Add license.
  3. Either click Choose file and navigate to your license file and select it, or click copy & paste the license XML directly... and paste the text of your license file into the provided field.
  4. Click Install. Splunk Enterprise installs your license.
  5. If this is the first Enterprise license that you are installing, restart Splunk Enterprise.

License violations

License violations occur when you exceed the maximum daily indexing volume allowed for your license. If you exceed your licensed daily volume on any one calendar day, you receive a violation warning. The warning persists for 14 days. If you incur 5 or more warnings on an Enterprise license or 3 warnings on a Free license in a rolling 30-day period, you are in violation of your license.

Unless you have a Splunk Enterprise 6.5.0 or later "no-enforcement" license, Splunk Enterprise disables search for the offending license pools. Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) warnings in the previous 30 days, or when you apply a temporary reset license (available for Enterprise only). To obtain a reset or "no-enforcement" license, contact your sales rep.

Summary indexing volume does not count against your license.

If you get a violation warning, you have until midnight (using the time on the license master) to resolve it before it counts against the total number of warnings within the rolling 30-day period.

During a license violation period:

  • Splunk never stops indexing your data. Splunk only blocks search while you exceed your license.
  • Splunk does not disable searches to the _internal index. This means that you can still access the Indexing Status dashboard or run searches against _internal to diagnose the licensing problem.

If you have license violations, see About license violations in the Admin Manual or Troubleshooting indexed data volume from the Splunk Community Wiki.

More licensing information is available in the "Manage Splunk licenses" chapter in the Admin Manual.

Last modified on 05 March, 2020
About Splunk Enterprise licenses   How to upgrade Splunk Enterprise

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters