Splunk® Light

Installation Manual

Download manual as PDF

Download topic as PDF

About Splunk Light licensing

Splunk Light licenses control the indexing volume and feature set of the Splunk Light product.

Splunk Light license types

The following table lists the different license types available for Splunk Light.

License Type Description
Splunk Light Trial Included with the download package. Offers a daily indexing volume capacity up to 5GB and up to 5 administrator or user accounts. Access to all features for 30 days. When the trial expires, you are advised of your license usage to date and a license size is recommended based upon your usage. You can buy a paid license or use the free term-based license.
Splunk Light Free Offers a daily indexing volume capacity up to 500MB and has one admin account. Access to all features, with the exception of alerting. This license is term-based and valid for one year, with renewals beyond one year available by contacting Splunk.
Splunk Light Perpetual Offers a daily indexing volume capacity up to 20GB and up to 5 administrator or user accounts.
Splunk Light Term Offers a daily indexing volume capacity up to 20GB and up to 5 administrator or user accounts. You can renew this license at the end of its subscription term.

Splunk Light features by license type

The following table lists the Splunk Light features enabled by the license type.

Features Splunk Light Trial Splunk Light Free Splunk Light
Daily Indexing Volume Up to 5GB Up to 500MB Up to 20GB
Search and Reporting Yes Yes Yes
Dashboards Yes Yes Yes
Alerting Yes No Yes
Accounts Up to 5, Admin and User 1 Admin Up to 5, Admin and User
Add-ons Yes Yes Yes

Exceeding your license

Warnings and violations occur when you exceed the maximum daily indexing volume allowed for your license.

Warnings when you exceed your volume

If you exceed your daily indexing volume on any calendar day, you get a warning. The message persists for fourteen days. You have until midnight to resolve it before it counts against the total number of warnings within the rolling 30-day period.

License violations after five warnings

If you have five or more warnings in a rolling 30-day period, you are in violation of your license. During a license violation period, the following actions occur.

  • Splunk Light continues to index your data.
  • Search is disabled, except for searches to the _internal index.

Although you cannot search existing or incoming data inputs, you can use search to troubleshoot the licensing issue.

Search capabilities return when you have fewer than five warnings in the previous 30 days or when you apply a reset license.

License expiration

When your Splunk Light license is nearing expiration, a message appears in your Splunk Light instance before the expiration date. You have options to renew, upgrade, or revert your license, as defined in this section.

Splunk Light Term license expiration

If your Splunk Light term license expires, you have the following options.

  • Purchase and install a new Splunk Light paid license (perpetual or term).
  • Purchase and install a Splunk Enterprise license to upgrade to Splunk Enterprise.
    • When you upgrade to Splunk Enterprise, your data, searches, alerts, knowledge objects, and settings migrate seamlessly. **If you have add-ons enabled, they remain active and appear in the Apps browser view of Splunk Enterprise.
  • Revert to the Splunk Light Free license.
    • When you revert your instance to Splunk Light Free, your instance is limited to a single account with administrator privileges. Previous settings such as accounts, passwords, and configurations persist, but you cannot modify them in Splunk Light Free. See Logging in after you revert to Splunk Light Free in the Splunk Light Installation Manual.
    • If you upgrade this instance to Splunk Light (or upgrade to Splunk Enterprise), your previous configurations are restored.

Log in after you revert to Splunk Light Free

If you have more than one admin account configured on the Splunk Light instance, after you revert to Splunk Light Free the login account becomes the admin account that is first in alphabetical order. You can change this setting.

  1. Stop Splunk Light Free.
  2. Back up the original <SPLUNK_HOME>/etc/passwd file.
  3. Edit <SPLUNK_HOME>/etc/passwd file to remove all entries except one Admin user.
  4. Start Splunk Light Free.
  5. Log in using the Admin account you saved.
When you upgrade back to Splunk Light or Splunk Enterprise, restore the passwd file from the original backup.

Splunk Light Trial license expiration

Your Splunk Light Trial license has a 30-day term. When your Splunk Light Trial expires, you have the following options.

  • Purchase and install a new Splunk Light paid license (perpetual or term).
  • Purchase and install a Splunk Enterprise license to upgrade to Splunk Enterprise.
  • Convert your Splunk Light Trial license to a Splunk Light Free license. If you convert to a Splunk Light free license, you might lose much of the capacity available with your Splunk Light trial license. To retain your capacity, upgrade to a Splunk Light perpetual or term license.

Splunk Light Free license expiration

Your Splunk Light Free license has a one-year term.  When your Splunk Light Free license expires, you have the following options.

  • Purchase and install a new Splunk Light paid license (perpetual or term.)
  • Purchase and install a Splunk Enterprise license to upgrade to Splunk Enterprise.
  • Request another Splunk Light Free license by contacting Splunk.


For more information, see About upgrading and migrating Splunk Light and Update your Splunk Light license in the Installation Manual.

PREVIOUS
Share data in Splunk Light
  NEXT
Update your Splunk Light license

This documentation applies to the following versions of Splunk® Light: 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.1612 (cloud service only), 6.6.0, 6.6.1, 6.6.2, 6.6.3, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.3.0, 7.3.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters