How much data can the customer ingest before the search is locked out?

A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master.

How much data can the customer ingest before the search is locked out?
A . 300GB. After this limit, the search is locked out.
B . 500GB. After this limit, the search is locked out.
C . 800GB. After this limit, the search is locked out.
D . Search is not locked out. Violations are still recorded.

View Answer

Answer: D

Explanation:

Search is not locked out when a customer has installed a 500GB Enterprise license and a 300GB, no enforcement license on the same license master. The no enforcement license allows the customer to exceed the license quota without locking search, but violations are still recorded. The customer can ingest up to 800GB of data per day without violating the license, but if they ingest more than that, they will incur a violation. However, the violation will not lock search, as the no enforcement license overrides the enforcement policy of the Enterprise license. For more information, see [No enforcement licenses] and [License violations] in the Splunk documentation.