About Splunk Light licensing
Splunk Light licenses control the indexing volume and feature set of the Splunk Light product. Users can increase the indexing volume capacity on a per-GB basis.
Splunk Light license types
Splunk Light ships with a trial license. When the trial expires, you can buy a paid license or use the free license.
|Splunk Light Trial||Included with the download package. Offers a daily indexing volume capacity up to 5 GB and up to 5 administrator or user accounts. Access to all features for 30 days.|
|Splunk Light Free||Offers a daily indexing volume capacity up to 500 MB and has one admin account. Access to all features, with the exception of alerting. This license is valid for one year, with extensions beyond one year available by contacting Splunk.|
|Splunk Light Perpetual||Offers a daily indexing volume capacity up to 20 GB and up to 5 administrator or user accounts.|
|Splunk Light Term||Offers a daily indexing volume capacity up to 20 GB and up to 5 administrator or user accounts. You can renew this license at the end of its subscription term.|
Splunk Light features by license type
The following table lists the Splunk Light features enabled by the license type.
|Features||Splunk Light Trial||Splunk Light Free||Splunk Light|
|Daily Indexing Volume||Up to 5GB||Up to 500MB||Up to 20GB|
|Search and Reporting||Yes||Yes||Yes|
|Accounts||Up to 5, Admin and User||1 Admin||Up to 5, Admin and User|
Exceeding your license
Warnings and violations occur when you exceed the maximum daily indexing volume allowed for your license.
If you exceed your daily indexing volume on any calendar day, you get a warning. The message persists for fourteen days. You have until midnight to resolve it before it counts against the total number of warnings within the rolling 30-day period.
If you have five or more warnings in a rolling 30-day period, you are in violation of your license. During a license violation period:
- Splunk Light continues to index your data.
- Search is disabled, except for searches to the
Although you cannot search existing or incoming data inputs, you can still use search to troubleshoot the licensing issue.
Search capabilities return when you have fewer than five warnings in the previous 30 days or when you apply a reset license.
When your Splunk Light Trial expires, you can purchase a paid license (term or perpetual), upgrade to Splunk Enterprise, or revert to the Splunk Light Free license.
When your Splunk Light Free license expires, you can purchase a paid license (term or perpetual), upgrade to Splunk Enterprise, or request another Splunk Light Free license by contacting Splunk.
Splunk Light Term license expiration
Update your license
Update your license to install a new Splunk Light license or install a Splunk Enterprise license to upgrade to Splunk Enterprise.
When your Splunk Light license expires and you upgrade to Splunk Enterprise, your data, searches, alerts, knowledge objects, and settings should migrate seamlessly. If you have add-ons enabled, they remain active and appear in the Apps browser view of Splunk Enterprise.
Revert to the Splunk Light Free license
When your Splunk Light license expires and you revert your instance to Splunk Light Free, your instance limits to a single account with administrator privileges. Previous settings such as accounts, passwords, and configurations persist, though you cannot modify them in Splunk Light Free. If you upgrade this instance back to Splunk Light (or upgrade to Splunk Enterprise), your previous configurations restore.
To log in after you revert to Splunk Light Free
If you have more than one admin account configured on the Splunk Light instance, after you revert to Splunk Light Free, the login account becomes the admin account that is first in alphabetical order.
To change this, do the following:
1. Stop Splunk Light Free.
2. Back up the original
<SPLUNK_HOME>/etc/passwd file to remove all entries except one Admin user.
4. Start Splunk Light Free.
5. Log in using the Admin account you saved.
When you upgrade back to Splunk Light or Splunk Enterprise, remember to restore the passwd file from the original backup.
Splunk Light Trial license expiration
When your Splunk Light Trial license expires, you can either purchase and install a new Splunk Light license, or purchase and install a Splunk Enterprise license to upgrade to Splunk Enterprise. You also have the option of converting your Splunk Light Trial license to a Splunk Light Free license.
Splunk Light Free license expiration
Your Splunk Light Free license has a one-year term. When it expires you can either purchase and install a new Splunk Light license, or purchase and install a Splunk Enterprise license to upgrade to Splunk Enterprise. You also have the option of renewing your Splunk Light Free license by contacting Splunk.
Install and deploy a universal forwarder for Splunk Light
Update your Splunk Light license
This documentation applies to the following versions of Splunk® Light: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4