Purchase Capacity and Limitations, Splunk Offerings (August 2026)
Catalog row in Vendor License Sources · Cited
- Kind
- Product terms
- Format
- Document id
- purchase-capacity-and-limitations-august-2026.pdf
- Applies to
- Capacity metric and limitations for each Splunk Offering: Splunk Enterprise, Splunk Cloud Platform, Enterprise Security editions, SOAR, UBA, Attack Analyzer, Asset and Risk Intelligence, Observability products, Federated Search, limited source-type licenses. Effective date: the PDF states "Published: Aug 2026" without a day.
- Aliases
- Splunk Licensed Capacity; Purchase Capacity and Limitations
- Evidence
- Splunk Enterprise volume and vCPU licenses cannot be stacked; premium licenses must match
- Splunk vCPU equals a distinct hardware thread of execution
- DNS and Netflow limited-source ingest above its volume counts against the general license
- Data ingested through Splunk DSP counts against Splunk Enterprise capacity
- Federated Search DSU overage billed per TB at one-tenth of the DSU price
- Rapid Adoption Packages: 25GB maximum, single instance, not stackable
- Splunk SOAR User Seat: one user at a time
- Daily Indexing Volume definition
- Splunk Virtual Compute (SVC) definition
- Daily Processing Volume definition
- Data Scan Unit (DSU) definition
- User Behavior Analytics Monitored Account definition
- Ransomware Monitored Account definition
- SOAR Event definition
- User Seat (Splunk SOAR and Attack Analyzer) definition
- Daily Submissions (Splunk Attack Analyzer) definition
- Asset (Splunk Asset and Risk Intelligence) definition
- Metric Time Series (MTS) definition
- Trace Analyzed Per Minute (TAPM) definition
- Browser Test Run definition
- API Test Run definition
- Uptime Test Run definition
- Session (Splunk RUM) definition
- Database Instance (Splunk Database Monitoring) definition
- Endpoint (Splunk Enterprise for Cisco AnyConnect NVM) definition
- Node (Splunk Analytics for Hadoop) definition
- Span (Splunk Agent Observability) definition