(If a license peer cannot communicate to a license manager for 72 hours or more, what will happen?)

Question

Options

• AThe license peer is placed in violation, and a warning is generated.
• BA license warning is generated, and there is no impact to the license peer.
• CWhat happens depends on license type.
• DThe license peer is placed in violation, and search is blocked.

• A
  4% (1)
• C
  4% (1)
• D
  93% (26)

Explanation

Per the Splunk Enterprise Licensing Documentation, a license peer (such as an indexer or search head) must regularly communicate with its license manager to report data usage and verify license validity. Splunk allows a 72-hour grace period during which the peer continues operating normally even if communication with the license manager fails. If this communication is not re-established within 72 hours, the peer enters a "license violation" state. In this state, the system blocks all search activities, including ad-hoc and scheduled searches, but continues to ingest and index data. Administrative and licensing-related searches may still run for diagnostic purposes, but user searches are restricted. The intent of this design is to prevent prolonged unlicensed data ingestion while ensuring the environment remains compliant. The 72-hour rule is hard-coded in Splunk Enterprise and applies uniformly across license types (Enterprise or Distributed). This ensures consistent licensing enforcement across distributed deployments. Warnings are generated during the grace period, but after 72 hours, searches are automatically blocked until the peer successfully reconnects to its license manager. - Managing Licenses in a Distributed Environment - License Manager and Peer Communication Workflow - Splunk License Enforcement and Violation Behavior - Splunk Enterprise Admin Manual - License Usage and Reporting Policies

No community discussion yet for this question.