Splunk® Light

Installation Manual

Download manual as PDF

This documentation does not apply to the most recent version of SplunkLight. Click here for the latest version.
Download topic as PDF

About Splunk Light licensing

Splunk Light licenses control the indexing volume and feature set of the Splunk Light product. Users can increase the indexing volume capacity on a per-GB basis.

Splunk Light license types

Splunk Light ships with a trial license. When the trial expires, you can buy a paid license or use the free license.

License Type Description
Splunk Light Trial Included with the download package.  Offers a daily indexing volume capacity up to 5 GB and up to 5 administrator or user accounts. Access to all features for 30 days.
Splunk Light Free Offers a daily indexing volume capacity up to 500 MB and has one admin account. Access to all features, with the exception of alerting. This license is valid for one year, with extensions beyond one year available by contacting Splunk.
Splunk Light Perpetual Offers a daily indexing volume capacity up to 20 GB and up to 5 administrator or user accounts.
Splunk Light Term Offers a daily indexing volume capacity up to 20 GB and up to 5 administrator or user accounts. You can renew this license at the end of its subscription term.

Splunk Light features by license type

The following table lists the Splunk Light features enabled by the license type.

Features Splunk Light Trial Splunk Light Free Splunk Light
Daily Indexing Volume Up to 5GB Up to 500MB Up to 20GB
Search and Reporting Yes Yes Yes
Dashboards Yes Yes Yes
Alerting Yes No Yes
Accounts Up to 5, Admin and User 1 Admin Up to 5, Admin and User
Add-ons Yes Yes Yes

Exceeding your license

Warnings and violations occur when you exceed the maximum daily indexing volume allowed for your license.

Warnings

If you exceed your daily indexing volume on any calendar day, you get a warning. The message persists for fourteen days. You have until midnight to resolve it before it counts against the total number of warnings within the rolling 30-day period.

Violations

If you have five or more warnings in a rolling 30-day period, you are in violation of your license. During a license violation period:

  • Splunk Light continues to index your data.
  • Search is disabled, except for searches to the _internal index.

Although you cannot search existing or incoming data inputs, you can still use search to troubleshoot the licensing issue.

Search capabilities return when you have fewer than five warnings in the previous 30 days or when you apply a reset license.

License expiration

When your Splunk Light Trial expires, you can purchase a paid license (term or perpetual), upgrade to Splunk Enterprise, or revert to the Splunk Light Free license.

When your Splunk Light Free license expires, you can purchase a paid license (term or perpetual), upgrade to Splunk Enterprise, or request another Splunk Light Free license by contacting Splunk.

Splunk Light Term license expiration

Update your license

Update your license to install a new Splunk Light license or install a Splunk Enterprise license to upgrade to Splunk Enterprise.

When your Splunk Light license expires and you upgrade to Splunk Enterprise, your data, searches, alerts, knowledge objects, and settings should migrate seamlessly. If you have add-ons enabled, they remain active and appear in the Apps browser view of Splunk Enterprise.

See About migrating Splunk Light and Update your Splunk Light license.

Revert to the Splunk Light Free license

When your Splunk Light license expires and you revert your instance to Splunk Light Free, your instance limits to a single account with administrator privileges. Previous settings such as accounts, passwords, and configurations persist, though you cannot modify them in Splunk Light Free. If you upgrade this instance back to Splunk Light (or upgrade to Splunk Enterprise), your previous configurations restore.

To log in after you revert to Splunk Light Free

If you have more than one admin account configured on the Splunk Light instance, after you revert to Splunk Light Free, the login account becomes the admin account that is first in alphabetical order.

To change this, do the following:

1. Stop Splunk Light Free.

2. Back up the original <SPLUNK_HOME>/etc/passwd file.

3. Edit <SPLUNK_HOME>/etc/passwd file to remove all entries except one Admin user.

4. Start Splunk Light Free.

5. Log in using the Admin account you saved.

When you upgrade back to Splunk Light or Splunk Enterprise, remember to restore the passwd file from the original backup.

Splunk Light Trial license expiration

When your Splunk Light Trial license expires, you can either purchase and install a new Splunk Light license, or purchase and install a Splunk Enterprise license to upgrade to Splunk Enterprise. You also have the option of converting your Splunk Light Trial license to a Splunk Light Free license.

Splunk Light Free license expiration

Your Splunk Light Free license has a one-year term.  When it expires you can either purchase and install a new Splunk Light license, or purchase and install a Splunk Enterprise license to upgrade to Splunk Enterprise. You also have the option of renewing your Splunk Light Free license by contacting Splunk.

PREVIOUS
Install and deploy a universal forwarder for Splunk Light
  NEXT
Update your Splunk Light license

This documentation applies to the following versions of Splunk® Light: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters