Learn about licensing

How Splunk Enterprise licensing works

Splunk Enterprise takes in data from sources that you designate and processes it so that you can analyze it. This process is called indexing. For information about the indexing process, see How Splunk software handles your data in Getting Data In.

Splunk Enterprise volume-based licenses specify how much data you can index per calendar day (from midnight to midnight by the clock on the license manager).

Any Splunk Enterprise instance that performs indexing must be licensed to do so. You can either run a standalone indexer with a license installed locally, or you can configure one of your Splunk Enterprise instances as a license manager and set up a license pool from which other indexers, configured as license peers, can draw.

For information about different types of licenses, see Types of Splunk licenses in the Admin Manual.

For information about license violations, see About license violations in the Admin Manual.

Understand your licenses

Survey what licenses you have:

  1. Log into Splunk Web on your license manager.
  2. Click Settings > Licensing.
  3. Make note of Enterprise and app licenses and their expiration dates.

Check your license usage:

  1. Log into Splunk Web on your license manager.
  2. Click Settings > Licensing.
  3. Click Usage report.

See About the license usage report view in the Admin Manual. This view is also accessible from the Indexing tab of the monitoring console.

Monitor your license usage

To prevent license violations, set up alerts for expiring licenses and licenses nearing quota. You can use the two platform alerts included with the monitoring console.

For more information, see:

Update Support contact

Splunk licenses are tied to your organization's customer account at Splunk. A customer account typically has one or several employees that are authorized to received Splunk Support after some training, in addition to a Splunk portal administrator who manages the list of authorized contacts. Make sure you understand how your organization contacts Support, before you need to.