2.1 License Types, Stacks, Pools & Licensing Architecture

License Types, Stacks, Pools & Licensing Architecture

In Splunk Enterprise, licensing governs both software capabilities and daily indexing throughput. The licensing subsystem ensures enterprise environments maintain operational stability while enforcing contracted data volume or computational capacity. For an enterprise administrator, configuring and managing licensing requires a precise understanding of license types, the client-manager communication topology, configuration stanzas in server.conf, and how raw quota is aggregated into stacks and carved into operational pools.

---

Splunk License Types

Every Splunk Enterprise instance runs under a license that decides both which features are available and how much data it may index per day. The blueprint objective "Identify license types" expects you to tell these apart:

Enterprise License

The Enterprise license is the core operational license for production deployments. It unlocks the entire suite of distributed Splunk capabilities:

• Clustering and Scalability: Supports indexer clustering (data replication and high availability) and search head clustering.
• Security and Governance: Supports native, LDAP, SAML, scripted authentication, and multifactor authentication, with role-based access control.
• Automation and Acceleration: Supports alerting, scheduled searches, report acceleration, and data model acceleration.
• Stacking Properties: Volume-based Enterprise licenses are additive. If an organization owns a 100 GB/day license and buys a 250 GB/day expansion, both license files are installed on the license manager and stack into a single 350 GB/day Enterprise stack.

Free License

A new installation starts on the Enterprise Trial license. You can switch to Free at any time in Splunk Web: Settings > Licensing > Change License Group > Free license > Save, then restart. From the CLI, the equivalent is activating the Free license group (splunk edit licenser-groups Free -is_active 1) and restarting.

Splunk's own list of what Splunk Free removes is the list to learn:

• No users or roles: there is no login screen. Anyone who reaches Splunk Web or the CLI is effectively the admin user, and you cannot create users or roles.
• No alerting (monitoring): alerts you defined no longer trigger. Scheduled searches still run, for example to populate dashboards and summary indexes.
• No distributed search, including search head clustering.
• No deployment management (the instance cannot act as a deployment server).
• No indexer clustering.
• No forwarding in TCP/HTTP format to non-Splunk software. Forwarding to other Splunk instances still works.
• No report acceleration summaries and no ingest actions.
• Volume cap: 500 MB per day. Three warnings in a rolling 30-day window block search while indexing continues.

Exam trap: Answers that say Free disables scheduled searches or summary indexing are wrong. Splunk's documentation says that after you switch to Free you can still schedule searches for dashboards and summary indexing; only the alerts stop.

Forwarder License

Universal forwarders carry their own forwarder license. A heavy forwarder is a full Splunk Enterprise instance that you normally switch to the Forwarder license group. Under a Forwarder license:

• The instance can collect, parse, mask, filter, and route data, and forward it to indexers over the Splunk-to-Splunk protocol.
• It is not licensed to index data locally. Forwarded data is metered once, when an indexer indexes it.

---

Licensing Models: Volume-Based vs. Infrastructure (vCPU)

Splunk Enterprise can be licensed in two commercial ways, and the two cannot be combined in one stack:

1. Volume-Based Licensing (GB/day)

• Metric: The raw, uncompressed volume of data that enters the indexing pipeline each day (midnight to midnight on the license manager's clock).
• Stacking: Volume licenses stack with each other and can be split into pools.
• Enforcement: Stacks under 100 GB/day can lose search after too many warnings. Stacks of 100 GB/day or more generate warnings but never disable search.
• Operational focus: Watch daily ingest, filter unwanted events before indexing (for example with nullQueue routing), and keep an eye on the license usage report.

2. Infrastructure Licensing (vCPU)

• Metric: The total number of vCPUs (logical CPUs reported by the operating system) on the deployment's search heads and indexers.
• Stacking: Infrastructure licenses stack with each other and can be pooled, but they cannot stack with volume-based licenses.
• Enforcement: An infrastructure license does not currently go into violation.
• Operational focus: Search efficiency and hardware sizing, because capacity is bought as compute, not as daily volume. You check vCPU counts in the Monitoring Console's CPU usage dashboards.

---

Licensing Architecture & Communication Flow

In a distributed deployment, licensing operates through a centralized client-server topology consisting of a License Manager and multiple license peers (formerly called license slaves).

                      ┌─────────────────────────────────┐
                      │         License Manager         │
                      │  (Holds Enterprise Stack 500GB) │
                      │      Port 8089 (REST API)       │
                      └───────┬─────────────────┬───────┘
                              │                 │
              Heartbeat/Usage │ (Every 1 min)   │ Heartbeat/Usage
              Over REST (8089)│                 │ Over REST (8089)
                              ▼                 ▼
             ┌─────────────────────────┐   ┌─────────────────────────┐
             │    Indexer 01 (Client)  │   │    Indexer 02 (Client)  │
             │   Assigned: Pool_Prod   │   │   Assigned: Pool_Prod   │
             │     Allocated: 400 GB   │   │     Allocated: 400 GB   │
             └─────────────────────────┘   └─────────────────────────┘

The License Manager (LM)

Formerly called the license master, the License Manager acts as the single source of truth for licensing across the Splunk deployment.

• Role: Holds all installed .lic license files, maintains the global license stack, enforces pool allocations, tracks daily usage across all registered clients, and manages rolling warning records.
• Placement: The License Manager is often co-located with another management component (for example the Monitoring Console or a small deployment server). Every indexer, including every indexer-cluster peer, points to the designated License Manager.

License Peers (formerly Slaves)

A license peer is any Splunk Enterprise instance—most commonly an indexer—that indexes data and relies on the License Manager for daily quota authorization.

• Reporting Frequency: Every minute, each license peer reports its license volume usage to the License Manager over the management port (default 8089).
• Lost Contact (72 Hours): If a license peer cannot communicate with the License Manager, nothing changes at first. If the outage lasts 72 hours or more, the peer is placed in violation and search is blocked on that peer until it reconnects. Indexing continues the whole time, and you can find the problem in _internal (LMTracker errors in splunkd.log).

Configuration via server.conf

The relationship between a license client and the License Manager is established in $SPLUNK_HOME/etc/system/local/server.conf.

On the license peer (indexer):

[license]
manager_uri = https://license-manager.corp.internal:8089

Note on Configuration Naming: Current server.conf.spec marks master_uri as deprecated and says to use manager_uri. The value self means the instance is its own license manager. Older configurations that still say master_uri keep working, but new work should use manager_uri.

In Splunk Web, the same change is Settings > Licensing > Change to Peer. You choose Designate a different Splunk instance as the license server, enter the manager's host and management port (default 8089), save, and restart.

From the CLI:

# On the license peer: point it at the license manager, then restart
splunk edit licenser-localpeer -manager_uri 'https://license-manager.corp.internal:8089'
splunk restart

# On the license manager: list reporting peers, installed licenses, stacks, and pools
splunk list licenser-peers
splunk list licenses
splunk list licenser-stacks
splunk list licenser-pools

---

License Stacks and License Pools

Splunk organizes installed license capacity using a two-tier structural hierarchy: License Stacks and License Pools.

License Stacks

A license stack represents an aggregation of licenses sharing the same underlying type.

• Enterprise Stack: Combines all Enterprise volume license keys. When you add a new Enterprise license file, its daily quota automatically adds to the existing Enterprise stack.
• Isolation Boundary: Licenses belonging to different types cannot combine into a shared stack. An Enterprise license, a Dev/Test license, and a Free license each reside in completely separate stacks. An indexer can only draw quota from one stack at any given time.

License Pools

A license pool is an administrative partition carved out of a license stack. Pools allow administrators to segment total capacity across business units, geographic regions, or functional environments.

• Pool Allocation: An administrator carving a 500 GB Enterprise stack can allocate 400 GB to Pool_Prod and 100 GB to Pool_Dev.
• Indexer Assignment: Each indexer client is explicitly assigned to a designated license pool. All data indexed by that indexer draws directly from its assigned pool's daily quota.
• Default Pool: When you install the first Enterprise license, Splunk creates a default pool for the stack (shown as auto_generated_pool_enterprise). Peers that are not explicitly assigned elsewhere can draw from it.
• Pool Overages Count: Splunk's documentation lists a license pool reaching its daily volume limit as a condition that generates a license warning, even if the whole stack still has headroom. In a stack under 100 GB/day that is split into pools, search is disabled for a pool and its members after that pool collects 45 warnings in a rolling 60 days. Other pools stay searchable as long as they stay within their allocations. Size each pool for its real peak load.