Discussing Splunk licensing models

We have got this far in the book without thinking about licenses. This is because the basic Splunk functionality can be appreciated using the free version of Splunk. Splunk Free is the implicit license that allows us to index 500 MB of data, run Splunk search queries, and create dashboards and reports. Splunk Free does not expire but only allows access to a limited number of Splunk Enterprise features. For example, Splunk Free does not allow for features such as clustering and will halt searching if there are license violations (three license warnings in a rolling 30-day window). Note that the AWS instances we created in Chapter 2, Setting Up the Splunk Environment, were not Splunk Free. The Splunk Enterprise AWS instances that we used are shipped with fully featured trial licenses, which are valid for 60 days. The license defaults to Splunk Free after the trial period.

Some of the other limitations of Splunk Free include the following:

...