Types of Splunk Enterprise licenses

Each Splunk software instance requires a license. Splunk software licenses specify the features you have access to and how much data can be indexed. As a customer, you'll work with licenses for a Splunk platform instance like Splunk Enterprise, and a premium app license like Enterprise Security.

Splunk Enterprise licenses

The Splunk Enterprise licenses are the most common license types. They provide access to the full set of Splunk Enterprise features within a defined limit of indexed data per day, or vCPU count.

The Splunk Enterprise license

The Enterprise license is measured by daily data ingestion, and must be purchased. Here are the conditions for this license type:

• The Enterprise license gives you access to all Splunk Enterprise features.
• The Enterprise license is for single-instance and distributed installations of Splunk Enterprise.
• The Enterprise licenses can be stacked and assigned to license pools. For information on splitting or allocating portions of a license, see Allocate license volume.
• The Enterprise license can be purchased by daily indexing volume. For purchasing information, see Splunk Enterprise Pricing FAQ.
• The Enterprise license cannot stack with an infrastructure-based license.
• The Enterprise license does not currently enforce license violations for license stacks of 100 GB of data per day or more.
• The Enterprise license prevents searching if your license stack is less than 100 GB of data per day and there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?

Contact Splunk Sales for information about purchasing the Enterprise license for Splunk Enterprise.

The Splunk Enterprise infrastructure license

The Enterprise infrastructure license is measured by vCPU allocation, and must be purchased. Here are the conditions for this license type:

• The Enterprise infrastructure license gives you access to all Splunk Enterprise features.
• The Enterprise infrastructure license is for single-instance and distributed installations.
• The Enterprise infrastructure licenses can be stacked and assigned to pools. For information on splitting or allocating portions of a license, see Allocate license volume.
• The Enterprise infrastructure license can be purchased by number of vCPUs. For purchasing information, see Infrastructure-Based Pricing.
• The Enterprise infrastructure license cannot stack with a volume-based license.
• The Enterprise infrastructure license does not currently enforce license violations for exceeding vCPU usage.

Contact Splunk Sales for information about purchasing the Enterprise license for Splunk Enterprise.

Compare Splunk Enterprise licenses

Consult this table for a comparison of Splunk Enterprise license types:

License conditions	Enterprise: with less than 100 GB of data per day license stack	Enterprise: with 100 GB of data per day or larger license stack	Enterprise: Infrastructure (vCPU)
Currently blocks search while in violation	Yes	No	No
Logs internally and displays message in Splunk Web when in warning or violation	Yes	Yes	No
Stacks with other licenses	Yes	Yes	No
Enables full Splunk Enterprise feature set	Yes	Yes	Yes

Splunk developer licenses

There are two different Splunk developer licenses, the Dev/Test license and the Developer license:

The Splunk developer licenses are for development and testing, and cannot be used for production use cases.

Dev/Test license

The Dev/Test license is only available to customers that own a Splunk Enterprise license. It's used by customers with pre-production environments to test upgrades and evaluate customized app configuration changes before moving the changes into production. Here are the conditions for this license type:

• The Dev/Test license gives limited access to Splunk Enterprise features.
• The Dev/Test license is for standalone, single-instance use only installations.
• The Dev/Test license cannot be stacked with other licenses.
• The Dev/Test license expires after 6 months. You can submit a request to renew your license one week before it expires using the request form at Personalized Dev/Test Licenses for Splunk Customers.
• The Dev/Test license allows you to index 50 GB of data per day. If you exceed that you will receive a license warning.
• The Dev/Test license will prevent searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?
• Instances of Splunk Enterprise with a Dev/Test license are indicated by a "DEVTEST" stamp in Splunk Web.

A Dev/Test license will not stack with another license. For example, if you install a Dev/Test license after installing a Splunk Enterprise license, the Dev/Test license removes and replaces the Splunk Enterprise license file. You should maintain a copy of your Dev/Test license should you need to reapply it.

To request a Dev/Test license, see Personalized Dev/Test Licenses for Splunk Customers.

Developer license

The Developer license offers features used when developing Splunkbase apps or private apps, and to facilitate app testing in a Splunk Enterprise distributed environment before deployment or release. Here are the conditions for this license type:

• The Developer license gives you access to all Splunk Enterprise features.
• The Developer license is for single-instance and distributed installations of Splunk Enterprise.
• The Developer license cannot be stacked with other licenses.
• The Developer license expires after 6 months. You can submit a request to renew your license one week before it expires using the request form at Splunk Developer License Signup.
• The Developer license allows you to index 10 GB of data per day. If you exceed that you will receive a license warning.
• The Developer license will prevent searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?

To request a Developer license, see Splunk Developer License Signup.

Compare Splunk developer licenses

Consult this table for a comparison of Splunk developer license types.

License conditions	Dev/Test	Developer
Currently blocks search while in violation	Varies	Yes
Logs internally and displays message in Splunk Web when in warning or violation	Yes	Yes
Stacks with other licenses	No	No
Enables full Splunk Enterprise feature set	No	Yes

Other types of licenses

Splunk provides other licenses with reduced functionality for specific uses:

The Splunk Enterprise trial license

When you download and install Splunk Enterprise, a Splunk Enterprise Trial license is automatically generated for that instance. Here are the conditions for this license type:

• The Enterprise Trial license gives access to all Splunk Enterprise features.
• The Enterprise Trial license is for standalone, single-instance installations of Splunk Enterprise only.
• The Enterprise Trial license cannot be stacked with other licenses.
• The Enterprise Trial license expires 60 days after you install the Splunk Enterprise instance.
• The Enterprise Trial license allows you to index 500 MB of data per day. If you exceed that limit you receive a license warning.
• The Enterprise Trial license prevents searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?

If you want to set up a trial Splunk Enterprise distributed deployment consisting of multiple Splunk Enterprise instances communicating with each other, each instance must use its own self-generated Enterprise Trial license. You cannot use centralized license management with the Enterprise Trial license.

Sales Trial license

A Sales Trial license is for customers who cannot use the Enterprise Trial license due to the time or indexing volume limits. Ask for a Sales Trial license if you are preparing a pilot or proof of concept for a large deployment and want to create a trial with a longer duration or to allow more indexing volume. Contact Splunk Sales or your sales representative with your request.

Free license

The Free license allows a completely free Splunk Enterprise instance with limited functionality and license usage. Here are the conditions for this license type:

• The Free license gives access to some Splunk Enterprise features.
• The Free license is for a standalone, single-instance installation of Splunk Enterprise only.
• The Free license cannot be stacked with other licenses.
• The Free license does not expire.
• The Free license allows you to index 500 MB of data per day. If you exceed that you will receive a license warning.
• The Free license prevents searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?

For a list of features that are disabled in Splunk Free, see About Splunk Free.

Forwarder license

The Forwarder license is an embedded license within Splunk Enterprise. It is designed to allow unlimited forwarding, along with a subset of Splunk Enterprise features needed for configuration management, authentication, and sending data.

The universal forwarder installs the Forwarder license by default. Heavy forwarders and light forwarders must be manually configured to use the Forwarder license.

A heavy forwarder is often used to perform more complex functions than the Forwarder license allows. Access to features such as advanced authentication, alerting, distributed search, KVStore, and indexing require an Enterprise license. You can configure the heavy forwarder as a peer to a license master to gain access to those features. To learn how to configure a connection for license management, see Manage license slaves

Beta license

Splunk beta software releases require their own Beta licenses, which are not compatible with other Splunk software releases. Beta licenses typically enable specific Splunk Enterprise features for a specified Beta release duration.

Splunk Premium App license

A license for a Splunk premium app is used in conjunction with a Splunk Enterprise license to access the functionality of an app. Splunk Premium apps include, but are not limited to, Splunk Enterprise Security and ITSI.