License Management
Units and structure
Licenses are measured in indexing volume per day (GB/day) and organized into a stack: keys grouped into pools, governed by a license manager (historically called the license master), with peers/slaves (indexers) reporting to it. Forwarders need no license. Pools let you carve quota out for specific indexers or groups.
Warnings and violations
Usage is evaluated over a rolling window of recent days, not a calendar day and not a reset-period counter. Exceeding quota creates a license violation: a warning period (typically about 14 days) to correct usage, after which search is suspended for users until usage falls back under the quota. Because the window is historical, deleting data does not instantly clear a violation. Peers must be able to reach the license manager; prolonged loss of contact also drives peers into a violation state.
Traps
- Enterprise trial (time-limited, low daily volume) versus the Free license (no distributed features, no alerting/authentication features).
- Confusing a warning with a violation - only the violation blocks searches.
- Believing a license key is bound to a single indexer; only pools create that mapping.
- Trusting the UI's projected numbers blindly; the CLI/REST view is authoritative.
Rule of thumb
Use splunk show license, splunk list licenser-pools, and splunk list licenser-slaves. When over quota, the fix is to reduce indexed volume (filter at the forwarder, drop events in transforms, shorten retention scope) or add capacity - never to delete buckets hoping to reset the meter.