Getting Started Manual

Splunk Light features

Splunk Light delivers log search and analysis for individuals, small businesses, and work groups within larger organizations. It provides monitoring and troubleshooting solutions for the system administrators, support analysts, application teams, and developers who work with logs and are responsible for multiple use cases across multiple platforms.

Key features and capabilities

Events indexing

Add data from a variety of sources: upload files to Splunk Light, monitor files or directories, receive data from Splunk Forwarders, or enable pre-defined data sources from Splunk Add-ons. You can index logs, clickstream data, configurations, traps and alerts, messages, scripts, performance data and statistics from your applications, servers, mainframes and network devices—physical, virtual and in the cloud. See About adding data to Splunk Light in the Getting Started Manual.

Metrics indexing

Gather metrics from your technology infrastructure, security systems, and business applications and store this data into a new type of index that is optimized for ingestion and retrieval of metrics. Splunk Light provides pretrained source types that support line protocols for common metrics agents such as StatsD and collect, but you can also create custom transformations to work with additional clients. See Overview of metrics in the Splunk Enterprise Metrics manual.

Freeform search

Freeform search supports intuitive Boolean, nested, quoted string and wildcard searches familiar to anyone comfortable on the web. Includes real-time search, timerange search, and transaction-level search.

Monitor and alerting

Monitor for specific conditions and correlate events from multiple data sources across your IT infrastructure so you can monitor more meaningful and complex events.

Reporting and analysis

Generate reports on an immense amount of data instantly. Provides access to key data for a specified time window to make business-critical, real time decisions. Easily report on search results and on correlated events.

Custom Dashboards

Create custom dashboards and interactive views for different types of users, technical and non-technical. Integrate reports with search results. Edit dashboards using a simple drag-and-drop interface.

Add-ons

You can extend the capabilities of Splunk Light by installing and enabling additional Splunk Add-ons. Splunk Light includes a set of add-ons that you can install and enable to configure new data inputs. You can also browse Splunkbase for more Splunk Light compatible add-ons to install. See Configure an add-on to add data in Splunk Light in the Getting Started Manual.

Splunk Light Free versus Splunk Light

The following table lists the Splunk Light features enabled by the license type.

Features	Splunk Light Free	Splunk Light
Daily Indexing Volume	Up to 500MB	Up to 20GB
Search and Reporting	Yes	Yes
Dashboards	Yes	Yes
Alerting	No	Yes
Accounts	1 Admin	Up to 5, Admin and User
Add-ons	Yes	Yes

See About Splunk Light licensing in the Installation Manual.

Differences between Splunk Light and Splunk Enterprise

Features	Splunk Enterprise	Splunk Light
Maximum daily indexing volume	Unlimited	20GB
Maximum users	Unlimited	5
Data collection add-ons	Yes	Yes
Apps	Yes	No
Monitoring and alerting	Yes	Yes
Dashboards and reports	Yes	Yes
Search and analysis	Yes	Yes
Automatic data enrichment	Yes	Yes
Anomaly detection	Yes	Yes
Scalability	Unlimited	Single Server
Access control	Customizable	User and Admin only

See Splunk Light versus Splunk Enterprise Comparison.

Upgrade to Splunk Enterprise

You can upgrade and migrate from Splunk Light to Splunk Enterprise. See About upgrading and migrating Splunk Light in the Installation Manual.