Allocate license volume

Splunk Enterprise licensing management uses logical license groupings to allow for multiple licenses and license assignments, and to monitor the license usage.

The license master is a Splunk Enterprise component used to manage licenses and assign license volume.

Use the license master to group licenses and assign them to stacks. You can create license pools from the stacks, and assign the license slaves to a pool so they can use Splunk Enterprise features and have their license usage levied against a pool.

Groups

A license group represents a set of license stacks:

• Only one license group is active at a time.
• A license group can contain zero to many license stacks.
• A license master can only administer one license group at a time.

The license groups are:

• Enterprise/Sales Trial group -- This group contains Enterprise licenses and Sales Trial licenses. You can stack these licenses.
• Enterprise Trial group -- This is the default group when you first install a new Splunk Enterprise instance. If you switch an instance to a different group, you cannot switch back to the Enterprise trial group. You cannot stack Enterprise trial licenses.
• Free group -- This group accommodates Splunk Free installations. When an Enterprise Trial license expires after 60 days, that Splunk instance is converted to the Free group. You cannot stack Splunk Free licenses.
• Forwarder group -- This group is for forwarders that function solely as forwarders and do not perform other roles, such as indexing. You cannot stack Forwarder licenses.

Subgroups

The license subgroup is used to further categorize license types, and is set inside the license. There are several subgroups, including DevTest and Production. A license belongs to a single subgroup.

Stacks

A stack is one or more licenses that allow their assigned license volume to be added together. Enterprise licenses and Sales Trial licenses can be stacked together, and with each other. This allows you to increase indexing volume capacity without the need to swap out licenses. As you purchase additional capacity, just add the license to the appropriate stack.

The daily license volume is tracked at the stack and pool level. If your daily data ingest exceeds the assigned license volume, you will receive warnings at the stack or pool level depending upon how the license volume was allocated. See About license violations.

A stack contains one or more license pools, with each pool having a portion of the stack's total licensing volume. Stacks and pools are not available with these license types:

• Enterprise Trial
• Free
• Dev/Test. If you install a Dev/Test license over an Enterprise license, the Enterprise license will be deleted.
• Forwarder

Pools

A pool contains some or all of a stack's license volume. You can manage license volume usage by creating multiple pools and assigning Splunk Enterprise components to specific pools. The components must be configured as license slaves to the license master, and assigned to a pool.

For example, if you create a license pool used for production indexers, and use a separate license pool for the test indexers' you will ensure that testing activity does not impact production license needs. Each indexer is made a license slave to the license master, and the indexers are assigned to the appropriate pool; some to production and some to test.

Other components must be assigned to a license pool so that they are permitted access to Splunk Enterprise features, such as distributed search. As a general rule, assign all of your Splunk Enterprise instances to a license pool, with the exception of universal forwarders. See Licenses and distributed deployments.

License master

A license master is a Splunk Enterprise component that hosts licenses and allows you to configure license volume assignments to license slaves. You will use the license master to define pools, add licensing capacity, and manage license slaves by adding them to pools. In a distributed infrastructure, there is typically one designated license master.

License slaves

A license slave is a Splunk Enterprise instance that connects to the license master to receive license validation and a license volume assignment. A license slave is assigned to a single license pool. For example, indexers, search heads, and heavy forwarders all use features that require an Enterprise license. By configuring those components as license slaves to the license master, they have full access to the Splunk Enterprise features and license volume as needed.