Types of Splunk Enterprise licenses

Each Splunk software instance requires a license. Splunk software licenses specify the features you have access to and how much data can be indexed. As a customer, you'll work with licenses for a Splunk platform instance like Splunk Enterprise, and a premium app license like Enterprise Security.

Splunk platform licenses

Splunk platform licenses are the most common license types, and they are designed to allow various levels of access to Splunk Enterprise features and a defined volume of indexed data per day.

The Splunk Enterprise license

The Enterprise license is measured by daily data ingestion, and must be purchased. Here are the conditions for this license type:

• The Enterprise license gives you access to all Splunk Enterprise features.
• The Enterprise license is for single-instance and distributed installations of Splunk Enterprise.
• The Enterprise licenses can be stacked and assigned to license pools. For information on splitting or allocating portions of a license, see Allocate license volume.
• The Enterprise license can be purchased by daily indexing volume. For purchasing information, see Splunk Enterprise Pricing FAQ.
• The Enterprise license cannot stack with an infrastructure-based license.
• The Enterprise license does not currently enforce license violations for license stacks of 100 GB of data per day or more.
• The Enterprise license prevents searching if your license stack is less than 100 GB of data per day and there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?

Contact Splunk Sales for information about purchasing the Enterprise license for Splunk Enterprise.

The Splunk Enterprise infrastructure license

The Enterprise infrastructure license is measured by vCPU allocation, and must be purchased. Here are the conditions for this license type:

• The Enterprise infrastructure license gives you access to all Splunk Enterprise features.
• The Enterprise infrastructure license is for single-instance and distributed installations.
• The Enterprise infrastructure licenses can be stacked and assigned to pools. For information on splitting or allocating portions of a license, see Allocate license volume.
• The Enterprise infrastructure license can be purchased by number of vCPUs. For purchasing information, see Infrastructure-Based Pricing.
• The Enterprise infrastructure license cannot stack with a volume-based license.
• The Enterprise infrastructure license does not currently enforce license violations for exceeding vCPU usage.

Contact Splunk Sales for information about purchasing the Enterprise license for Splunk Enterprise.

The Splunk Enterprise trial license

When you download and install Splunk Enterprise, a Splunk Enterprise Trial license is automatically generated for that instance. Here are the conditions for this license type:

• The Enterprise Trial license gives access to all Splunk Enterprise features.
• The Enterprise Trial license is for standalone, single-instance installations of Splunk Enterprise only.
• The Enterprise Trial license cannot be stacked with other licenses.
• The Enterprise Trial license expires 60 days after you install the Splunk Enterprise instance.
• The Enterprise Trial license allows you to index 500 MB of data per day. If you exceed that limit you receive a license warning.
• The Enterprise Trial license prevents searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?

If you want to set up a trial Splunk Enterprise distributed deployment consisting of multiple Splunk Enterprise instances communicating with each other, each instance must use its own self-generated Enterprise Trial license. You cannot use centralized license management with the Enterprise Trial license.

Sales Trial license

A Sales Trial license is for customers who cannot use the Enterprise Trial license due to the time or indexing volume limits. Ask for a Sales Trial license if you are preparing a pilot or proof of concept for a large deployment and want to create a trial with a longer duration or to allow more indexing volume. Contact Splunk Sales or your sales representative with your request.

Dev/Test license

A Dev/Test license is available for customers who want to operate Splunk software in a non-production environment. Here are the conditions for this license type:

• The Dev/Test license gives limited access to Splunk Enterprise features.
• The Dev/Test license is for standalone, single-instance use only installations.
• The Dev/Test license cannot be stacked with other licenses.
• The Dev/Test license expires after 6 months.
• The Dev/Test license allows you to index 50 GB of data per day. If you exceed that you will receive a license warning.
• The Dev/Test license will prevent searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?
• Instances of Splunk Enterprise with a Dev/Test license are indicated by a Dev/Test stamp in Splunk Web.

A Dev/Test license can't stack with a Splunk Enterprise license. If you install a Dev/Test license with a Splunk Enterprise license, it replaces the Splunk Enterprise license file.

To request a Dev/Test license, see Personalized Dev/Test Licenses for Splunk Customers.

Free license

The Free license allows a completely free Splunk Enterprise instance with limited functionality and license usage.

• The Free license gives access to some Splunk Enterprise features.
• The Free license is for a standalone, single-instance installation of Splunk Enterprise only.
• The Free license cannot be stacked with other licenses.
• The Free license does not expire.
• The Free license allows you to index 500 MB of data per day. If you exceed that you will receive a license warning.
• The Free license prevents searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?

For a list of features that are disabled in Splunk Free, see About Splunk Free.

Forwarder license

The Forwarder license is an embedded license within Splunk Enterprise. It is designed to allow unlimited forwarding, along with a subset of Splunk Enterprise features needed for configuration management, authentication, and sending data.

The universal forwarder installs the Forwarder license by default. Heavy forwarders and light forwarders must be configured manually to use the Forwarder license.

A heavy forwarder is often used to perform more complex functions than the Forwarder license allows. Access to features such as advanced authentication, alerting, distributed search, KVStore, and indexing require an Enterprise license. You can configure the heavy forwarder as a peer to a license master to gain access to those features. To learn how to configure a connection for license management, see Manage license slaves

Beta license

Beta software releases require their own Beta licenses, which are not compatible with other Splunk software releases. Beta licenses typically enable specific Splunk Enterprise features for a specified Beta release duration.

Compare Splunk Enterprise licenses

Consult this table for a comparison of Splunk Enterprise license types.

License conditions	Enterprise: with less than 100 GB of data per day license stack	Enterprise: with 100 GB of data per day or larger license stack	Enterprise: Infrastructure (vCPU)	Dev/Test	Sales Trial	Free
Currently blocks search while in violation	Yes	No	No	varies	Yes	Yes
Logs internally and displays message in Splunk Web when in warning or violation	Yes	Yes	No	Yes	Yes	Yes
Stacks with other licenses	Yes	Yes	No	No	Yes	No
Enables full Splunk Enterprise feature set	Yes	Yes	Yes	No	Yes	No

Splunk Premium App license

A license for a Splunk premium app is used in conjunction with a Splunk Enterprise or Splunk Cloud license to access the functionality of an app.

Splunk for Industrial IoT license

Splunk for Industrial IoT has its own license which is not stackable with other licenses. This license gives you access to Splunk Enterprise and an entitlement for a set of apps. For more information about this license, see Licensing for Splunk for Industrial IoT.