Which are Splunk license types?

Splunk offers various license types to accommodate different user needs and deployment scenarios. Each license type determines the features available and the amount of data that can be indexed daily.

1. Splunk Enterprise Licenses

These licenses provide access to the full suite of Splunk Enterprise features. They are available in two primary models:

a. Volume-Based License

• Description: Allows indexing of a specified volume of data per day.
• Key Points:
  • Supports both single-instance and distributed deployments.
  • Licenses can be stacked and assigned to license pools.
  • If the license stack is less than 100 GB per day, exceeding the limit may result in search restrictions after a set number of warnings.

b. Infrastructure License

• Description: Based on the number of virtual CPUs (vCPUs) allocated to Splunk instances.
• Key Points:
  • Suitable for environments where infrastructure resources are a primary consideration.
  • Licenses can be stacked and assigned to pools.
  • Cannot be combined with volume-based licenses.

2. Splunk Free License

• Description: A limited version intended for personal or small-scale use.
• Key Points:
  • Allows indexing up to 500 MB of data per day.
  • Lacks certain enterprise features, such as user authentication and distributed search.

3. Forwarder License

• Description: Designed for Splunk forwarders that collect and send data to indexers.
• Key Points:
  • Enables data forwarding without local indexing.
  • Supports local authentication.
  • Universal forwarders automatically apply this license; light and heavy forwarders require manual configuration.

4. Developer Licenses

• Types:
  • Dev/Test License: For development and testing purposes.
  • Beta License: For evaluating Splunk beta releases.
• Key Points:
  • Provide access to enterprise features with certain restrictions.
  • Intended for non-production use.

5. Premium App Licenses

• Description: Required for accessing functionalities of premium Splunk applications, such as Splunk Enterprise Security or Splunk IT Service Intelligence.
• Key Points:
  • Used in conjunction with an Enterprise or Cloud license.
  • Ensure compatibility between the core Splunk license and the premium app license.

Understanding these license types helps organizations select the appropriate Splunk solution tailored to their specific requirements and scale.