Splunk License Types

Splunk Enterprise uses a volume-based licensing model. Your license determines how much data you can index per day.

Enterprise licenses allow full functionality with a daily indexing volume. Free licenses give you basic functionality but without authentication, alerting, or distributed search.

Forwarder licenses are used by Universal Forwarders — they don't count against your indexing volume since forwarders only send data, not index it.