Each Splunk software instance requires a license. Splunk software licenses specify the features you have access to and how much data can be indexed. As a customer, you'll work with licenses for a Splunk platform instance like Splunk Enterprise.
Splunk Enterprise licenses
The Splunk Enterprise licenses are the most common license types. They provide access to the full set of Splunk Enterprise features within a defined limit of indexed data per day, or vCPU count.
The Splunk Enterprise license
The Enterprise license is measured by daily data ingestion, and must be purchased. Here are the conditions for this license type:
- The Enterprise license gives you access to all Splunk Enterprise features.
- The Enterprise license is for single-instance and distributed installations of Splunk Enterprise.
- The Enterprise licenses can be stacked and assigned to license pools. For information on splitting or allocating portions of a license, see Allocate license volume.
- The Enterprise license can be purchased by daily indexing volume. Pricing and purchasing information is available on the Splunk website.
- The Enterprise license cannot stack with an infrastructure-based license.
- The Enterprise license does not currently enforce license violations for license stacks of 100 GB of data per day or more.
- The Enterprise license prevents searching if your license stack is less than 100 GB of data per day and there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?
Contact Splunk for information about purchasing the Enterprise license for Splunk Enterprise.
The Splunk Enterprise infrastructure license
The Enterprise infrastructure license is measured by vCPU allocation, and must be purchased. Here are the conditions for this license type:
- The Enterprise infrastructure license gives you access to all Splunk Enterprise features.
- The Enterprise infrastructure license is for single-instance and distributed installations.
- The Enterprise infrastructure licenses can be stacked and assigned to pools. For information on splitting or allocating portions of a license, see Allocate license volume.
- The Enterprise infrastructure license can be purchased by number of vCPUs. Pricing and purchasing information is available on the Splunk website.
- The Enterprise infrastructure license cannot stack with a volume-based license.
- The Enterprise infrastructure license does not currently enforce license violations for exceeding vCPU usage.
Contact Splunk for information about purchasing the Enterprise license for Splunk Enterprise.
Compare Splunk Enterprise licenses
Consult this table for a comparison of Splunk Enterprise license types:
| Currently blocks search while in violation | Yes | No | No |
| Logs internally and displays message in Splunk Web when in warning or violation | Yes | Yes | No |
| Stacks with other licenses | Yes | Yes | No |
| Enables full Splunk Enterprise feature set | Yes | Yes | Yes |
Splunk developer licenses
There are two different Splunk developer licenses, the Dev/Test license and the Developer license:
The Splunk developer licenses are for development and testing, and cannot be used for production use cases.
Dev/Test license
The Dev/Test license is only available to customers that own a Splunk Enterprise license. It's used by customers with pre-production environments to test upgrades and evaluate customized app configuration changes before moving the changes into production. Here are the conditions for this license type:
- The Dev/Test license gives limited access to Splunk Enterprise features.
- The Dev/Test license is for standalone, single-instance use only installations.
- The Dev/Test license cannot be stacked with other licenses.
- The Dev/Test license expires after 6 months. You can submit a request to renew your license one week before it expires using the request form at Personalized Dev/Test Licenses for Splunk Customers.
- The Dev/Test license allows you to index 50 GB of data per day. If you exceed that you will receive a license warning.
- The Dev/Test license will prevent searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?
- Instances of Splunk Enterprise with a Dev/Test license are indicated by a "DEVTEST" stamp in Splunk Web.
A Dev/Test license will not stack with another license. For example, if you install a Dev/Test license after installing a Splunk Enterprise license, the Dev/Test license removes and replaces the Splunk Enterprise license file. You should maintain a copy of your Dev/Test license should you need to reapply it.
To request a Dev/Test license, see Personalized Dev/Test Licenses for Splunk Customers.
Developer license
The Developer license offers features used when developing Splunkbase apps or private apps, and to facilitate app testing in a Splunk Enterprise distributed environment before deployment or release. Here are the conditions for this license type:
- The Developer license gives you access to all Splunk Enterprise features.
- The Developer license is for single-instance and distributed installations of Splunk Enterprise.
- The Developer license cannot be stacked with other licenses.
- The Developer license expires after 6 months. You can submit a request to renew your license one week before it expires using the request form at Splunk Developer License Signup.
- The Developer license allows you to index 10 GB of data per day. If you exceed that you will receive a license warning.
- The Developer license will prevent searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?
To request a Developer license, see Splunk Developer License Signup.
Compare Splunk developer licenses
Consult this table for a comparison of Splunk developer license types.
| Currently blocks search while in violation | Varies | Yes |
| Logs internally and displays message in Splunk Web when in warning or violation | Yes | Yes |
| Stacks with other licenses | No | No |
| Enables full Splunk Enterprise feature set | No | Yes |
Other types of licenses
Splunk provides other licenses with reduced functionality for specific uses:
The Splunk Enterprise trial license
When you download and install Splunk Enterprise, a Splunk Enterprise Trial license is automatically generated for that instance. Here are the conditions for this license type:
- The Enterprise Trial license gives access to all Splunk Enterprise features.
- The Enterprise Trial license is for standalone, single-instance installations of Splunk Enterprise only.
- The Enterprise Trial license cannot be stacked with other licenses.
- The Enterprise Trial license expires 60 days after you install the Splunk Enterprise instance.
- The Enterprise Trial license allows you to index 500 MB of data per day. If you exceed that limit you receive a license warning.
- The Enterprise Trial license prevents searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?
If you want to set up a trial Splunk Enterprise distributed deployment consisting of multiple Splunk Enterprise instances communicating with each other, each instance must use its own self-generated Enterprise Trial license. You cannot use centralized license management with the Enterprise Trial license.
Sales Trial license
A Sales Trial license is for customers who cannot use the Enterprise Trial license due to the time or indexing volume limits. Ask for a Sales Trial license if you are preparing a pilot or proof of concept for a large deployment and want to create a trial with a longer duration or to allow more indexing volume. Contact Splunk or your sales representative with your request.
Free license
The Free license allows a completely free Splunk Enterprise instance with limited functionality and license usage. Here are the conditions for this license type:
- The Free license gives access to some Splunk Enterprise features.
- The Free license is for a standalone, single-instance installation of Splunk Enterprise only.
- The Free license cannot be stacked with other licenses.
- The Free license does not expire.
- The Free license allows you to index 500 MB of data per day. If you exceed that you will receive a license warning.
- The Free license prevents searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation?
For a list of features that are disabled in Splunk Free, see About Splunk Free.
Forwarder license
The Forwarder license is an embedded license within Splunk Enterprise. It is designed to allow unlimited forwarding, along with a subset of Splunk Enterprise features needed for configuration management, authentication, and sending data.
The universal forwarder installs the Forwarder license by default. Heavy forwarders and light forwarders must be manually configured to use the Forwarder license. For an example on how enable the Forwarder license using the CLI, see Select a different license group. To use Splunk Web, follow the procedure in How do I switch to the Splunk Free license? and select Forwarder.
A heavy forwarder is often used to perform more complex functions than the Forwarder license allows. Access to features such as advanced authentication, alerting, distributed search, KVStore, and indexing require an Enterprise license. You can configure the heavy forwarder as a peer to a license manager to gain access to those features. To learn how to configure a connection for license management, see Manage license peers
Beta license
Splunk beta software releases require their own Beta licenses, which are not compatible with other Splunk software releases. Beta licenses typically enable specific Splunk Enterprise features for a specified Beta release duration.
Splunk Premium App license
Splunk Premium apps include, but are not limited to, Splunk Enterprise Security and Splunk IT Service Intelligence (ITSI). Premium apps are used in conjunction with a Splunk Enterprise license to access the functionality of the app.
Splunk Enterprise Security license
If you purchase Splunk Enterprise Security, you can download the app from the Splunk Support portal. Additionally, Splunk does not monitor data ingestion based on your license, irrespective of whether you are using the on-prem or the Cloud version. For example, if you purchase a 1 GB license for Splunk Enterprise and purchase another 1 GB for Splunk Enterprise Security app, you can ingest 2 GB of data, irrespective of the data set. Thus, you can monitor your own data ingestion and usage.
Splunk ITSI license
You need a license to use Splunk ITSI. For more information on Splunk ITSI license requirements, see ITSI license requirements.
Page 2
When data is sent to the Splunk platform, that data is indexed and stored on disk. Part of the indexing process is to measure the volume of data being ingested, and report that volume to the license manager for license volume tracking.
How data is measured
When ingesting event data, the measured data volume is based on the raw data that is placed into the indexing pipeline. It is not based on the amount of compressed data that is written to disk. Because the data is measured at the indexing pipeline, data that is filtered and dropped prior to indexing does not count against the license volume quota.
When ingesting metrics data, each metric event is measured by volume like event data. However, the per-event size measurement is capped at 150 bytes. Metric events that exceed 150 bytes are recorded as only 150 bytes. Metrics data draws from the same license quota as event data.
Data that is not measured
The Splunk software troubleshooting and internal communications logs that are indexed into the internal indexes such as _internal and _introspection do not count against your license volume quota.
The use of summary indexing and metric rollup summaries do not count against your license volume quota.
What happens if I exceed my license volume?
License warnings occur when you exceed the indexing volume allowed for your license. The indexing volume is measured daily from midnight to midnight using the system clock on the license manager. See About license violations.
How vCPU is calculated for infrastructure licensing
For Splunk software, a vCPU is any logical CPU core as reported by the host operating system. A vCPU can represent a physical core, a logical core created through the use of hyper-threading or simultaneous multithreading, or a shared logical CPU provided through virtualization. The term vCPU is commonly used when provisioning resources in virtualized environments and in cloud infrastructure allocations; but each implementation of vCPU is unique.
Splunk software uses the CPU's reported by the OS as the total vCPU's for each measured node.
Which nodes are measured for vCPU use?
The total vCPU count across all Splunk Enterprise search heads and indexers count towards the vCPU licensed capacity.
To check the vCPU count in your deployment, use the Resource Usage: CPU Usage dashboards in the Monitoring Console, and filter the report for the search head and indexer roles. See Resource Usage: CPU Usage in the Monitoring Splunk Enterprise manual.
License types and license management
There are multiple types of Splunk software licenses available, see Types of Splunk licenses.
To learn about Splunk software license management, see Allocate license volume.