Study guide
2.1 License Types, Stacks, Pools & Licensing Architecture
Splunk Enterprise Certified Admin SPLK-1003
Track your progress as you read
Finished sections get a check mark.
1 Introduction
About the Splunk Enterprise Certified Admin Exam
2 Chapter 1: Splunk Admin Basics
1.1 Splunk Enterprise Architecture & Core Components
3 Chapter 2: License Management
2.1 License Types, Stacks, Pools & Licensing Architecture 2.2 License Violations, Rolling Window Warnings & Troubleshooting
4 Chapter 3: Splunk Configuration Files
3.1 Splunk Configuration Directory Structure 3.2 Configuration Layering, Precedence & Resolution Rules 3.3 Using btool to Inspect & Debug Configurations
5 Chapter 4: Splunk Indexes
4.1 Index Structure: Directories, Buckets & Bucket Files 4.2 Bucket Types & the Hot-Warm-Cold-Frozen-Thawed Lifecycle 4.3 Checking Index Data Integrity 4.4 indexes.conf Options: Paths, Bucket Sizing & Volumes 4.5 The Fishbucket: File Tracking, CRC Collisions & Re-reading Files 4.6 Applying a Data Retention Policy
6 Chapter 5: Splunk User Management
5.1 Splunk Roles, Capabilities & Custom Role Design 5.2 User Account Administration, Search Restrictions & Limits
7 Chapter 6: Splunk Authentication Management
6.1 Integrating Splunk with LDAP 6.2 Other Authentication Options & Enabling Multifactor Authentication
8 Chapter 7: Getting Data In
7.1 CLI Administration & Basic Data Onboarding Workflows 7.2 Forwarder Types: Universal Forwarder vs. Heavy Forwarder
9 Chapter 8: Distributed Search
8.1 How Distributed Search Works 8.2 Roles of the Search Head and Search Peers 8.3 Configuring Search Peers & Distributed Search Groups 8.4 Search Head Scaling & Search Head Clustering (SHC)
10 Chapter 9: Getting Data In – Staging
9.1 Ingestion Pipeline Stages: Input, Parsing, Merging, Typing & Indexing 9.2 Pipeline Component Placement & Queue Management 9.3 Splunk Input Options
11 Chapter 10: Configuring Forwarders
10.1 Forwarder Setup & outputs.conf Load Balancing 10.2 Indexer Acknowledgment, Data Cloning & Forwarder Routing
12 Chapter 11: Forwarder Management
11.1 Deployment Management & the Deployment Server 11.2 Deployment Apps & Deployment Clients 11.3 Server Classes, Client Grouping & App Deployment Strategies 11.4 Forwarder Management Monitoring & Troubleshooting
13 Chapter 12: Monitor Inputs
12.1 File & Directory Monitoring Mechanics 12.2 Monitor Input Tuning: Whitelists, Blacklists & CRC Settings 12.3 Deploying a Remote Monitor Input, Network Shares & Archives
14 Chapter 13: Network and Scripted Inputs
13.1 Creating Network Inputs: TCP & UDP 13.2 Optional Settings for Network Inputs 13.3 Scripted Inputs & PowerShell Data Collection
15 Chapter 14: Agentless Inputs
14.1 Windows Management Instrumentation (WMI) Inputs 14.2 HTTP Event Collector (HEC) Architecture & Administration
16 Chapter 15: Fine Tuning Inputs
15.1 Input-Phase Processing & Default Metadata Assignment 15.2 Character Set Encoding & Handling Binary Data
17 Chapter 16: Parsing Phase and Data
16.1 Line Breaking & Event Segmentation 16.2 Timestamp Extraction, Time Zones & Clock Skew Handling 16.3 Validating Event Parsing with Data Preview
18 Chapter 17: Manipulating Raw Data
17.1 Transformation Mechanics: props.conf & transforms.conf 17.2 Data Masking, Redaction & SEDCMD 17.3 Event Routing, Dynamic Index Assignment & Filtering to nullQueue
2.1 License Types, Stacks, Pools & Licensing Architecture
Key Takeaways Explain This Topic AI
Volume-based Enterprise licenses stack into one daily quota; stacks of 100 GB/day or more never lose search, while stacks under 100 GB/day are in violation after 45 warnings in a rolling 60 days.
Splunk Free allows 500 MB/day on a standalone instance with no users or roles, no alerting, no distributed search, no clustering, and no deployment management, but scheduled searches and summary indexing still work.
Enterprise Trial (500 MB/day for 60 days), Dev/Test, and Developer licenses go into violation after 5 warnings in 30 days; Free after 3 warnings in 30 days.
A license peer points to its license manager with manager_uri in the [license] stanza of server.conf (master_uri is the deprecated name) and reports usage every minute.
If a license peer cannot reach the license manager for 72 hours, search is blocked on that peer; indexing continues.
Last updated: September 2026
License Types, Stacks, Pools & Licensing Architecture
In Splunk Enterprise, licensing governs both software capabilities and daily indexing throughput. The licensing subsystem ensures enterprise environments maintain operational stability while enforcing contracted data volume or computational capacity. For an enterprise administrator, configuring and managing licensing requires a precise understanding of license types, the client-manager communication topology, configuration stanzas in server.conf , and how raw quota is aggregated into stacks and carved into operational pools.
Splunk License Types
Every Splunk Enterprise instance runs under a license that decides both which features are available and how much data it may index per day. The blueprint objective "Identify license types" expects you to tell these apart:
License Type Daily Limit What It Unlocks Warning / Violation Rule
Enterprise (volume-based) The purchased GB/day, stackable Full feature set, single-instance or distributed Stacks of 100 GB/day or more : warnings only, search is never disabled. Stacks under 100 GB/day : 45 warnings in a rolling 60 days puts the pool in violation and blocks search
Enterprise infrastructure (vCPU) Measured in vCPUs on search heads and indexers, not GB/day Full feature set Does not currently violate; cannot stack with volume licenses
Enterprise Trial 500 MB/day for 60 days (installed by default) Full feature set during the trial 5 or more warnings in a rolling 30 days = violation; no reset license
Dev/Test Per the customer order (personalized version: 50 GB/day, 6 months) Non-production testing 5 or more warnings in a rolling 30 days = violation; cannot stack
Developer 10 GB/day, 6 months, renewable Developing content for Splunkbase 5 or more warnings in a rolling 30 days = violation; cannot stack
Free 500 MB/day, never expires Standalone single instance with many features removed 3 or more warnings in a rolling 30 days = violation
- Forwarder Not for indexing Lets a heavy forwarder collect, parse, route, and forward data Not applicable
- Enterprise License
The Enterprise license is the core operational license for production deployments. It unlocks the entire suite of distributed Splunk capabilities:
Clustering and Scalability: Supports indexer clustering (data replication and high availability) and search head clustering.
Security and Governance: Supports native, LDAP, SAML, scripted authentication, and multifactor authentication, with role-based access control.
Automation and Acceleration: Supports alerting, scheduled searches, report acceleration, and data model acceleration.
Stacking Properties: Volume-based Enterprise licenses are additive. If an organization owns a 100 GB/day license and buys a 250 GB/day expansion, both license files are installed on the license manager and stack into a single 350 GB/day Enterprise stack.
Free License
A new installation starts on the Enterprise Trial license. You can switch to Free at any time in Splunk Web: Settings > Licensing > Change License Group > Free license > Save , then restart. From the CLI, the equivalent is activating the Free license group ( splunk edit licenser-groups Free -is_active 1 ) and restarting.
Splunk's own list of what Splunk Free removes is the list to learn:
No users or roles: there is no login screen. Anyone who reaches Splunk Web or the CLI is effectively the admin user, and you cannot create users or roles.
No alerting (monitoring): alerts you defined no longer trigger. Scheduled searches still run , for example to populate dashboards and summary indexes .
No distributed search , including search head clustering.
No deployment management (the instance cannot act as a deployment server).
No indexer clustering.
No forwarding in TCP/HTTP format to non-Splunk software. Forwarding to other Splunk instances still works.
No report acceleration summaries and no ingest actions.
Volume cap: 500 MB per day. Three warnings in a rolling 30-day window block search while indexing continues.
Exam trap: Answers that say Free disables scheduled searches or summary indexing are wrong. Splunk's documentation says that after you switch to Free you can still schedule searches for dashboards and summary indexing; only the alerts stop.
Forwarder License
Universal forwarders carry their own forwarder license. A heavy forwarder is a full Splunk Enterprise instance that you normally switch to the Forwarder license group. Under a Forwarder license:
The instance can collect, parse, mask, filter, and route data, and forward it to indexers over the Splunk-to-Splunk protocol.
It is not licensed to index data locally. Forwarded data is metered once, when an indexer indexes it.
Licensing Models: Volume-Based vs. Infrastructure (vCPU)
Splunk Enterprise can be licensed in two commercial ways, and the two cannot be combined in one stack:
1. Volume-Based Licensing (GB/day)
Metric: The raw, uncompressed volume of data that enters the indexing pipeline each day (midnight to midnight on the license manager's clock).
Stacking: Volume licenses stack with each other and can be split into pools.
Enforcement: Stacks under 100 GB/day can lose search after too many warnings. Stacks of 100 GB/day or more generate warnings but never disable search.
Operational focus: Watch daily ingest, filter unwanted events before indexing (for example with nullQueue routing), and keep an eye on the license usage report.
2. Infrastructure Licensing (vCPU)
Metric: The total number of vCPUs (logical CPUs reported by the operating system) on the deployment's search heads and indexers .
Stacking: Infrastructure licenses stack with each other and can be pooled, but they cannot stack with volume-based licenses .
Enforcement: An infrastructure license does not currently go into violation.
Operational focus: Search efficiency and hardware sizing, because capacity is bought as compute, not as daily volume. You check vCPU counts in the Monitoring Console's CPU usage dashboards.
Licensing Architecture & Communication Flow
In a distributed deployment, licensing operates through a centralized client-server topology consisting of a License Manager and multiple license peers (formerly called license slaves). ┌─────────────────────────────────┐
- │ License Manager │
- │ (Holds Enterprise Stack 500GB) │
- │ Port 8089 (REST API) │
- └───────┬─────────────────┬───────┘
- │ │
- Heartbeat/Usage │ (Every 1 min) │ Heartbeat/Usage
- Over REST (8089)│ │ Over REST (8089)
- ▼ ▼
- ┌─────────────────────────┐ ┌─────────────────────────┐
- │ Indexer 01 (Client) │ │ Indexer 02 (Client) │
- │ Assigned: Pool_Prod │ │ Assigned: Pool_Prod │
- │ Allocated: 400 GB │ │ Allocated: 400 GB │
- └─────────────────────────┘ └─────────────────────────┘
- The License Manager (LM)
Formerly called the license master, the License Manager acts as the single source of truth for licensing across the Splunk deployment.
Role: Holds all installed .lic license files, maintains the global license stack, enforces pool allocations, tracks daily usage across all registered clients, and manages rolling warning records.
Placement: The License Manager is often co-located with another management component (for example the Monitoring Console or a small deployment server). Every indexer, including every indexer-cluster peer, points to the designated License Manager.
License Peers (formerly Slaves)
A license peer is any Splunk Enterprise instance—most commonly an indexer—that indexes data and relies on the License Manager for daily quota authorization.
Reporting Frequency: Every minute, each license peer reports its license volume usage to the License Manager over the management port (default 8089 ).
Lost Contact (72 Hours): If a license peer cannot communicate with the License Manager, nothing changes at first. If the outage lasts 72 hours or more , the peer is placed in violation and search is blocked on that peer until it reconnects. Indexing continues the whole time, and you can find the problem in _internal ( LMTracker errors in splunkd.log ).
Configuration via server.conf
The relationship between a license client and the License Manager is established in $SPLUNK_HOME/etc/system/local/server.conf .
- On the license peer (indexer): [license]
- manager_uri = https://license-manager.corp.internal:8089
Note on Configuration Naming: Current server.conf.spec marks master_uri as deprecated and says to use manager_uri . The value self means the instance is its own license manager. Older configurations that still say master_uri keep working, but new work should use manager_uri .
In Splunk Web, the same change is Settings > Licensing > Change to Peer . You choose Designate a different Splunk instance as the license server , enter the manager's host and management port (default 8089), save, and restart.
- From the CLI: # On the license peer: point it at the license manager, then restart
- splunk edit licenser-localpeer -manager_uri 'https://license-manager.corp.internal:8089'
- splunk restart
- # On the license manager: list reporting peers, installed licenses, stacks, and pools
- splunk list licenser-peers
- splunk list licenses
- splunk list licenser-stacks
- splunk list licenser-pools
- License Stacks and License Pools
Splunk organizes installed license capacity using a two-tier structural hierarchy: License Stacks and License Pools .
License Stacks
A license stack represents an aggregation of licenses sharing the same underlying type.
Enterprise Stack: Combines all Enterprise volume license keys. When you add a new Enterprise license file, its daily quota automatically adds to the existing Enterprise stack.
Isolation Boundary: Licenses belonging to different types cannot combine into a shared stack. An Enterprise license, a Dev/Test license, and a Free license each reside in completely separate stacks. An indexer can only draw quota from one stack at any given time.
License Pools
A license pool is an administrative partition carved out of a license stack. Pools allow administrators to segment total capacity across business units, geographic regions, or functional environments.
Pool Allocation: An administrator carving a 500 GB Enterprise stack can allocate 400 GB to Pool_Prod and 100 GB to Pool_Dev .
Indexer Assignment: Each indexer client is explicitly assigned to a designated license pool. All data indexed by that indexer draws directly from its assigned pool's daily quota.
Default Pool: When you install the first Enterprise license, Splunk creates a default pool for the stack (shown as auto_generated_pool_enterprise ). Peers that are not explicitly assigned elsewhere can draw from it.
Pool Overages Count: Splunk's documentation lists a license pool reaching its daily volume limit as a condition that generates a license warning, even if the whole stack still has headroom. In a stack under 100 GB/day that is split into pools, search is disabled for a pool and its members after that pool collects 45 warnings in a rolling 60 days. Other pools stay searchable as long as they stay within their allocations. Size each pool for its real peak load.