Which features are not available in the Splunk free version?

Key limitations of Splunk Free

1. Data ingestion cap

• Daily limit: Up to 500 MB of data can be indexed per day.
• License violations: Exceeding this limit more than three times within a rolling 30-day window disables search functionality until compliance is restored.

2. Alerting and monitoring

• Unavailable features: Automated alerting and monitoring capabilities are not included.

3. User management

• Single-user access: Lacks user and role management; operates without login, granting full administrator access by default.

4. Deployment constraints

• Standalone operation: Supports only single-instance deployments; clustering and distributed search are not supported.

5. Report acceleration

• Disabled feature: Report acceleration summaries are not available.

These limitations make Splunk Free suitable for personal or small-scale projects but less ideal for enterprise environments requiring advanced features and scalability.