SPLK-1003 · Domain 2 of 17

SPLK-1003 Domain 2: License Management

This topic covers which Splunk Enterprise licenses exist, how daily ingest is metered against them through the license manager, and what warnings and violations mean for searching and indexing.

Exam weight
5%
Official objectives
2
Estimated questions estimate
~3
Suggested study time estimate
3–5 hrs

About 10 min read Reviewed October 2026

Overview

Domain 2 has two official objectives. Identifying license types covers the Enterprise license, the Enterprise trial, the Free license, the forwarder license and developer or test licenses, along with how licenses are grouped into stacks and divided into pools. Understanding license violations covers how daily indexing volume is measured, when a warning is issued, when warnings become a violation and what Splunk restricts while a violation is in force.

At 5%, expect around three questions. They tend to be precise: what the daily metering window is, what counts toward usage, who reports to whom, and whether indexing stops during a violation. Hands-on work with the Licensing page in Splunk Web makes these facts easy to remember.

How it's tested

License questions are factual and scenario-based. A deployment is described with its daily volume, license stack and recent warnings, and you predict the outcome or choose the right configuration. Watch for options that claim data is dropped, or that disk usage counts against the license, since both are common distractors.

  • Predict the violation outcome

    Given a count of warnings in a rolling window, decide whether a violation occurs and what Splunk restricts.

  • Pick the license type

    A use case such as a lab, a forwarder or production indexing is described and you choose the appropriate license.

  • Configure stacks and pools

    You decide how to divide stack volume among indexers using pools on the license manager.

Reasoning it through

An indexer exceeded its pool quota on several days this month. The candidate must remember that each overage generates a warning, that enough warnings inside a rolling 30-day window cause a violation, and that indexing continues during a violation while non-internal search can be blocked on enforced licenses. Answers claiming data is discarded are wrong because ingestion is never halted.

Objectives 2

Official objectives from the Splunk outline, in outline order.

2.1 Identify license typesEnterprise, trial, Free, forwarder and developer licenses; stacks and pools.
What it means
Splunk Enterprise uses licenses to set how much data can be indexed per day. The main types are the Enterprise license for production ingest, a time-limited Enterprise trial installed by default, the Free license with a small daily limit and reduced features, the forwarder license used by forwarders that do not index locally, and developer or test licenses for non-production use. Licenses of compatible type combine into stacks, and stack volume is divided into pools for groups of indexers.
What to understand
Know the shape of each type. The Free license removes authentication, alerting and distributed search. Forwarder licenses allow forwarding without indexing volume. Enterprise licenses stack, so their volumes add together, while the license manager assigns pools to license peers. Daily usage is measured on raw data indexed each day, midnight to midnight on the license manager's clock, not on compressed size or summary data.
How it shows up
A deployment need is described and you choose the license type, or decide how pools and stacks should be set up.
Common confusion
Thinking the Free license still supports user logins and alerts, or that compressed disk size is what is metered.
2.2 Understand license violationsWarnings, violations and their effect on searching.
What it means
When a license pool indexes more than its daily quota, Splunk records a license warning for that day. If enough warnings accumulate within a rolling 30-day window, the stack enters a license violation. For enforced Enterprise licenses that threshold is five warnings, and for the Free license it is three. During a violation Splunk keeps indexing, but search can be blocked except against internal indexes.
What to understand
Focus on cause and effect. A single bad day is only a warning, and warnings expire as they age out of the 30-day window. Indexing is never paused, so no data is lost, but users may be unable to search non-internal indexes until the violation clears or a reset license is applied. Larger Enterprise licenses and newer no-enforcement keys do not block search, so read scenario details carefully.
How it shows up
You are given a warning history and asked whether a violation exists and what users can still do.
Common confusion
Believing Splunk drops incoming data in a violation instead of restricting search.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Enterprise license

    The production license that sets a daily indexing volume.

    Remember
    Enterprise licenses stack together.
    Tested as
    License type questions.
    Trap
    Assuming they cannot be combined.

  • Enterprise trial

    A time-limited license installed with a new Splunk Enterprise instance.

    Remember
    After 60 days you switch to the Free license or add an Enterprise license.
    Tested as
    Lab and new install questions.
    Trap
    Thinking it runs indefinitely.

  • Free license

    A small daily volume with reduced features.

    Remember
    No authentication, alerting or distributed search.
    Tested as
    Feature restriction items.
    Trap
    Expecting role-based access on it.

  • Forwarder license

    Lets an instance forward data without counting toward indexing volume.

    Remember
    Used on heavy forwarders that do not index locally.
    Tested as
    Forwarder setup questions.
    Trap
    Applying an Enterprise license to every forwarder.

  • License stack

    A group of compatible licenses whose volumes add together.

    Remember
    Stack volume is shared out through pools.
    Tested as
    Configuration questions.
    Trap
    Thinking each license must stay separate.

  • License pool

    A share of stack volume assigned to specific license peers.

    Remember
    Overage is counted per pool.
    Tested as
    Warning and pool questions.
    Trap
    Ignoring pools when predicting a warning.

  • License manager and peers

    Peers report daily ingest to the central license manager.

    Remember
    Peers are indexers that index data.
    Tested as
    Architecture items.
    Trap
    Calling forwarders license peers.

  • License warning

    Recorded when a pool exceeds its daily quota.

    Remember
    Warnings age out of a rolling 30-day window.
    Tested as
    Violation path questions.
    Trap
    Treating one warning as a violation.

  • License violation

    Reached after too many warnings in 30 days.

    Remember
    Indexing continues; search can be blocked on enforced licenses.
    Tested as
    Outcome questions.
    Trap
    Believing data stops being indexed.

  • What counts toward usage

    Raw event data indexed per day.

    Remember
    Internal indexes and summary indexing do not count against the license.
    Tested as
    Metering questions.
    Trap
    Using compressed disk size.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Splunk license types

ConceptMeaningKey differenceCommon trap
Enterprise Production daily volume Stacks, full features Thinking stacks are not allowed
Enterprise trial Default on new installs Expires after 60 days Assuming it lasts forever
Free Small daily limit No logins, alerts or distributed search Expecting authentication
Forwarder Forward-only instances No indexing volume Using Enterprise on all forwarders

Warning versus violation

ConceptMeaningKey differenceCommon trap
Warning One day over pool quota Recorded, no restriction yet Treating it as a violation
Violation Too many warnings in 30 days Search may be blocked, indexing continues Assuming data loss

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Data is dropped

    What candidates pick
    Say incoming events are discarded during a violation.
    Why it looks right
    Penalties sound like they would stop ingestion.
    Why it's wrong
    Splunk keeps indexing so nothing is lost; the restriction applies to searching non-internal data.

    Clue to watch for The question asks what happens to incoming data.

  2. One warning is a violation

    What candidates pick
    Declare a violation after a single over-quota day.
    Why it looks right
    Warnings feel like a breach.
    Why it's wrong
    A violation requires repeated warnings inside a rolling 30-day window.

    Clue to watch for The scenario mentions only one or two overages.

  3. Disk size is metered

    What candidates pick
    Calculate usage from bucket size on disk.
    Why it looks right
    Storage is easy to measure.
    Why it's wrong
    Licensing measures the raw data volume indexed per day, before compression.

    Clue to watch for Options mention compressed storage.

  4. Free license has roles

    What candidates pick
    Plan role-based access on a Free license.
    Why it looks right
    Roles exist on every other license.
    Why it's wrong
    The Free license disables authentication, so everyone is effectively admin.

    Clue to watch for The deployment runs on the Free license.

  5. Forwarders are peers

    What candidates pick
    Point universal forwarders at the license manager as peers.
    Why it looks right
    Forwarders send data, so they seem to consume license.
    Why it's wrong
    License peers are indexers; volume is counted where data is indexed.

    Clue to watch for The question asks which instances report usage.

Answer framework

Apply these steps to any licensing scenario in SPLK-1003.

  1. Identify the license type in play, because Free, trial, forwarder and Enterprise licenses each impose different feature limits and quotas.
  2. Work out which pool the indexer belongs to, since daily quotas and warnings are calculated per pool on the license manager.
  3. Count over-quota days inside the rolling 30-day window and compare them to the threshold for that license type.
  4. If a violation exists, remember that indexing continues and decide what search access is restricted for non-internal indexes.
  5. Reject any option based on disk size, forwarder peers or data loss, and choose the one that matches documented metering and enforcement behaviour for that license.

Practice question

An indexer on an enforced Enterprise license has exceeded its pool quota on five separate days within the last 30 days. Users report problems. Which statement describes the expected behaviour of Splunk Enterprise in this situation?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Learn licensing as two short lists and one timeline. The first list is license types with their purpose and limits. The second is the license architecture: stacks, pools, the license manager and the peers that report to it. Write both on a card and review them until you can reproduce them from memory.

The timeline is the path from a heavy ingest day to a violation. Draw a 30-day window, mark over-quota days as warnings, and note the threshold that turns warnings into a violation and what is restricted. Practise with invented scenarios that vary the number and dates of warnings.

In a lab, open Settings, Licensing in Splunk Web, view the trial license, create a pool and look at the usage report. Seeing the screens makes the vocabulary concrete. Then answer a short set of licensing practice items, paying special attention to options that claim data loss, because that distractor appears often in study material and is always wrong.

FAQ

How much of SPLK-1003 is License Management?

License Management is 5% of the blueprint, about three questions, split across identifying license types and understanding violations.

Does Splunk stop indexing when the license is exceeded?

No. Indexing continues. Repeated overages lead to a violation, which can block searching of non-internal indexes on enforced licenses.

How is daily license usage calculated?

By the volume of raw data indexed each day, measured on the license manager's clock. Compressed disk size does not matter.

What is a license pool?

A portion of a license stack's volume allocated to specific indexers, so usage and warnings are tracked per pool.

What does the Free license lack?

Authentication and user roles, alerting and scheduled searches, distributed search, deployment management and clustering. It suits personal or test use only.

Do forwarders need an Enterprise license?

Universal forwarders include their own license. Heavy forwarders that only forward can use the forwarder license rather than consuming indexing volume.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered license types, stacks, pools and violations. Test whether you can predict Splunk's behaviour from a warning history under exam timing.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going