Admin Manual

Types of Splunk software licenses

Each Splunk software instance requires a license. As a customer, you'll work with licenses for a Splunk platform instance like Spunk Enterprise, and a premium app license like Enterprise Security. Splunk software licenses specify the features you have access to, and often how much data can be indexed.

Splunk Platform licenses

Splunk platform licenses are the most common license types, and are designed to allow various levels of access to Splunk Enterprise features and a defined license volume.

The Splunk Enterprise license

The Enterprise license must be purchased. Contact Splunk Sales for information.

• The Enterprise license gives access to all Splunk Enterprise features.
• The Enterprise license is for single-instance and distributed installations.
• The Enterprise licenses can be stacked, and assigned to pools. See Allocate license volume.
• The Enterprise license can be purchased by daily indexing volume. See Splunk Enterprise Pricing FAQ.
• The Enterprise license does not enforce license violations.

The Splunk Enterprise infrastructure license

The Enterprise infrastructure license must be purchased. Contact Splunk Sales for information.

• The Enterprise infrastructure license gives access to all Splunk Enterprise features.
• The Enterprise infrastructure license is for single-instance and distributed installations.
• The Enterprise infrastructure licenses can be stacked. See Allocate license volume.
• The Enterprise infrastructure license can be purchased by number of vCPUs. See Data-to-Everything Pricing FAQ
• The Enterprise infrastructure license cannot stack with a volume-based license.
• The Enterprise infrastructure license does not enforce license violations for exceeding vCPU usage.

The Splunk Enterprise Trial license

When you download and install a Splunk Enterprise package, a Splunk Enterprise Trial license is automatically generated for that instance.

• The Enterprise Trial license gives access to all Splunk Enterprise features.
• The Enterprise Trial license is for standalone, single-instance use only installations.
• The Enterprise Trial license cannot be stacked with other licenses, see Allocate license volume.
• The Enterprise Trial license expires 60 days after you install the Splunk platform instance.
• The Enterprise Trial license allows you to index 500 MB per day. If you exceed that you will receive a license violation warning.
• The Enterprise Trial license will prevent searching if there are a number of license violation warnings. See About license violations.

If you want to setup a trial Splunk Enterprise distributed deployment consisting of multiple Splunk Enterprise instances communicating with each other, each instance must use its own self-generated Enterprise Trial license. This differs from a distributed deployment running a Splunk Enterprise license, where you will configure a license master to host all licenses.

Sales Trial license

A sales trial license is for customers who cannot use the Enterprise Trial license due to the time or indexing volume limits. Ask for a Sales Trial license If you are preparing a pilot or proof of concept for a large deployment, and want to create a trial with a longer duration or to allow more indexing volume. Contact Splunk Sales or your sales representative with your request.

Dev/Test licenses

A Dev/Test license is available for customers who wants to operate Splunk software in a non-production environment. See Personalized Dev/Test Licenses for Splunk Customers.

• The Dev/Test license gives limited access to Splunk Enterprise features.
• The Dev/Test license is for standalone, single-instance use only installations.
• The Dev/Test license cannot be stacked with other licenses, see Allocate license volume.
• The Dev/Test license expires after 6 months.
• The Dev/Test license allows you to index 50 GB per day. If you exceed that you will receive a license violation warning.
• The Dev/Test license will prevent searching if there are a number of license violation warnings. See About license violations.
• After installing a Dev/Test license, you will see a Dev/Test stamp on the left side of the navigation bar in Splunk Web.

A Dev/Test license will not stack with a Splunk Enterprise license. If you install a Dev/Test license with a Splunk Enterprise license, it will replace the Splunk Enterprise license file.

Free license

The Free license allows a completely free Splunk Enterprise instance with limited functionality and license usage.

• The Free license gives very limited access to Splunk Enterprise features.
• The Free license is for a standalone, single-instance use only installation.
• The Free license cannot be stacked with other licenses, see Allocate license volume.
• The Free license does not expire.
• The Free license allows you to index 500 MB per day. If you exceed that you will receive a license violation warning.
• The Free license will prevent searching if there are a number of license violation warnings. See About license violations.

For a list of features that are disabled in Splunk Free, see About Splunk Free.

Compare Splunk Enterprise license behavior

Consult this table for a comparison of the major Splunk Enterprise license types.

Behavior of license	Enterprise	Enterprise infrastructure	Dev/Test	Sales Trial	Free
Blocks search while in violation	No	No	varies	Yes	Yes
Logs internally and displays message in Splunk Web when in warning or violation	Yes	Yes	Yes	Yes	Yes
Stacks with additional licenses	Yes	Yes	No	Yes	No
Enables full Enterprise feature set	Yes	Yes	No	Yes	No

Forwarder license

The Forwarder license is an embedded license within Splunk Enterprise. It is designed to allow unlimited forwarding, along with a small subset of Splunk Enterprise features needed for configuration management, authentication, and sending data.

The universal forwarder installs the Forwarder license by default. The other forwarder types; heavy forwarder and light forwarder must be manually configured to use the Forwarder license.

A heavy forwarder is often used to perform more complex functions than the Forwarder license allows. Access to features such as advanced authentication, alerting, distributed search, KVStore, and indexing require an Enterprise license. You can configure the heavy forwarder as a license slave to the license master to gain access to those features. See Manage license slaves

Beta license

Beta software releases require their own Beta licenses, which are not compatible with other Splunk software releases. Beta licenses typically enable specific Splunk Enterprise features, but only for the specified Beta release.

Splunk Premium App license

A license for a Splunk premium app is used in conjunction with an Enterprise or Cloud license to access the functionality of an app.

Splunk for Industrial IoT license

Splunk for Industrial IoT has its own license which is not stackable with other licenses. This license gives you access to Splunk Enterprise and an entitlement for a set of apps. For more information about this license, see Licensing for Splunk for Industrial IoT.