Why is this important?

If you are using too much of your license, which means taking on an unnecessary expense, it's a good idea to determine what data you are actually using and eliminate that which you are not. If you’re using too little, this is a good indication that Splunk is being underutilized and you should figure out what data is necessary to gain the maximum effectiveness from Splunk. Ultimately, knowing exactly where you are, and understanding which data and source types are important, will help you make better decisions with Splunk.

Also, feel free to check out the splunk> docs article for more details on how Splunk Enterprise licensing works.

What’s going on in this tutorial?

In this tutorial Tom will show you what you need to do in your Splunk Enterprise installation to gain a better understanding of Splunk license overage violations you might come across and what you should do to investigate these warnings.

Hope this helps!

Hopefully this tutorial will increase your understanding of Splunk license usage and drill down into some strategies that will make Splunk more valuable to you. If you have any further questions or comments, feel free to touch base with us on Twitter (@hurricanelabs), or if you're looking for more ways to get the most out Splunk find out how we can help.