Types of Splunk software licenses

Each Splunk software instance requires a license. As a customer, you'll work with licenses for a Splunk platform instance like Spunk Enterprise, and a premium app license like Enterprise Security. Splunk software licenses specify the features you have access to, and often how much data can be indexed.

Splunk Platform licenses

Splunk platform licenses are the most common license types, and are designed to allow various levels of access to Splunk Enterprise features and a defined license volume.

The Splunk Enterprise license

The Enterprise license must be purchased. Contact Splunk Sales for information.

• The Enterprise license gives access to all Splunk Enterprise features.
• The Enterprise license is for single-instance and distributed installations.
• The Enterprise licenses can be stacked, and assigned to pools. See Allocate license volume.
• The Enterprise license can be purchased by daily indexing volume. See Splunk Enterprise Pricing FAQ.
• The Enterprise license does not enforce license violations.

The Splunk Enterprise infrastructure license

The Enterprise infrastructure license must be purchased. Contact Splunk Sales for information.

• The Enterprise infrastructure license gives access to all Splunk Enterprise features.
• The Enterprise infrastructure license is for single-instance and distributed installations.
• The Enterprise infrastructure licenses can be stacked. See Allocate license volume.
• The Enterprise infrastructure license can be purchased by number of vCPUs. See Data-to-Everything Pricing FAQ
• The Enterprise infrastructure license cannot stack with a volume-based license.
• The Enterprise infrastructure license does not enforce license violations for exceeding vCPU usage.

The Splunk Enterprise Trial license

When you download and install a Splunk Enterprise package, a Splunk Enterprise Trial license is automatically generated for that instance.

• The Enterprise Trial license gives access to all Splunk Enterprise features.
• The Enterprise Trial license is for standalone, single-instance use only installations.
• The Enterprise Trial license cannot be stacked with other licenses, see Allocate license volume.
• The Enterprise Trial license expires 60 days after you install the Splunk platform instance.
• The Enterprise Trial license allows you to index 500 MB per day. If you exceed that you will receive a license violation warning.
• The Enterprise Trial license will prevent searching if there are a number of license violation warnings. See About license violations.

If you want to setup a trial Splunk Enterprise distributed deployment consisting of multiple Splunk Enterprise instances communicating with each other, each instance must use its own self-generated Enterprise Trial license. This differs from a distributed deployment running a Splunk Enterprise license, where you will configure a license master to host all licenses.

Sales Trial license

A sales trial license is for customers who cannot use the Enterprise Trial license due to the time or indexing volume limits. Ask for a Sales Trial license If you are preparing a pilot or proof of concept for a large deployment, and want to create a trial with a longer duration or to allow more indexing volume. Contact Splunk Sales or your sales representative with your request.

Dev/Test license

The Dev/Test license is only available to customers that own a Splunk Enterprise license. It's used by customers with pre-production environments to test upgrades and evaluate customized app configuration changes before moving the changes into production. Here are the conditions for this license type:

• The Dev/Test license gives limited access to Splunk Enterprise features.
• The Dev/Test license is for standalone, single-instance use only installations.
• The Dev/Test license cannot be stacked with other licenses.
• The Dev/Test license expires after 6 months. You can submit a request to renew your license one week before it expires using the request form at Personalized Dev/Test Licenses for Splunk Customers.
• The Dev/Test license allows you to index 50 GB of data per day. If you exceed that you will receive a license warning.
• The Dev/Test license will prevent searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?
• Instances of Splunk Enterprise with a Dev/Test license are indicated by a "DEVTEST" stamp in Splunk Web.

A Dev/Test license will not stack with another license. For example, if you install a Dev/Test license after installing a Splunk Enterprise license, the Dev/Test license removes and replaces the Splunk Enterprise license file. You should maintain a copy of your Dev/Test license should you need to reapply it.

To request a Dev/Test license, see Personalized Dev/Test Licenses for Splunk Customers.

The Splunk developer licenses are for development and testing, and cannot be used for production use cases.

Developer license

The Developer license offers features used when developing Splunkbase apps or private apps, and to facilitate app testing in a Splunk Enterprise distributed environment before deployment or release. Here are the conditions for this license type:

• The Developer license gives you access to all Splunk Enterprise features.
• The Developer license is for single-instance and distributed installations of Splunk Enterprise.
• The Developer license cannot be stacked with other licenses.
• The Developer license expires after 6 months. You can submit a request to renew your license one week before it expires using the request form at Splunk Developer License Signup.
• The Developer license allows you to index 10 GB of data per day. If you exceed that you will receive a license warning.
• The Developer license will prevent searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?

To request a Developer license, see Splunk Developer License Signup.

Free license

The Free license allows a completely free Splunk Enterprise instance with limited functionality and license usage.

• The Free license gives very limited access to Splunk Enterprise features.
• The Free license is for a standalone, single-instance use only installation.
• The Free license cannot be stacked with other licenses, see Allocate license volume.
• The Free license does not expire.
• The Free license allows you to index 500 MB per day. If you exceed that you will receive a license violation warning.
• The Free license will prevent searching if there are a number of license violation warnings. See About license violations.

For a list of features that are disabled in Splunk Free, see About Splunk Free.

Compare Splunk Enterprise license behavior

Consult this table for a comparison of the major Splunk Enterprise license types.

Behavior of license	Enterprise	Enterprise infrastructure	Dev/Test	Sales Trial	Free
Blocks search while in violation	No	No	varies	Yes	Yes
Logs internally and displays message in Splunk Web when in warning or violation	Yes	Yes	Yes	Yes	Yes
Stacks with additional licenses	Yes	Yes	No	Yes	No
Enables full Enterprise feature set	Yes	Yes	No	Yes	No

Forwarder license

The Forwarder license is an embedded license within Splunk Enterprise. It is designed to allow unlimited forwarding, along with a small subset of Splunk Enterprise features needed for configuration management, authentication, and sending data.

The universal forwarder installs the Forwarder license by default. Heavy forwarders and light forwarders must be manually configured to use the Forwarder license. For an example on how enable the Forwarder license using the CLI, see Select a different license group. To use Splunk Web, follow the procedure in How do I switch to the Splunk Free license? and select Forwarder.

A heavy forwarder is often used to perform more complex functions than the Forwarder license allows. Access to features such as advanced authentication, alerting, distributed search, KVStore, and indexing require an Enterprise license. You can configure the heavy forwarder as a license slave to the license master to gain access to those features. See Manage license slaves

Beta license

Beta software releases require their own Beta licenses, which are not compatible with other Splunk software releases. Beta licenses typically enable specific Splunk Enterprise features, but only for the specified Beta release.

Splunk Premium App license

A license for a Splunk premium app is used in conjunction with an Enterprise or Cloud license to access the functionality of an app.

Splunk for Industrial IoT license

Splunk for Industrial IoT has its own license which is not stackable with other licenses. This license gives you access to Splunk Enterprise and an entitlement for a set of apps. For more information about this license, see Licensing for Splunk for Industrial IoT.