Obtain and configure a Splunk SOAR (On-premises) license

From the main menu, select Administration > Company Settings > License to view information about the license on your system.

There are two types of licenses available for Splunk SOAR (On-premises):

  • Community License
    This is the default, free license for everyone who registers for Splunk SOAR (On-premises) Community access and downloads Splunk SOAR (On-premises). This license is limited to a set number of actions per day. See Community License.
  • Seat-based License
    This license is governed by the number of users allowed to log in to Splunk SOAR (On-premises). Seat-based licensing is available in blocks of five seats and can vary by the number of tenants.

The number of tenants is purchased as an additional parameter for seat-based licenses.

Note: Contact your Splunk representative or Splunk Support at least 30 days before your license expiration date to ensure continuity of service.

Community license

Splunk SOAR (On-premises) installs with a default license, the Community License. The Community License is limited to:

  • 100 licensed actions per day
  • 1 tenant
  • 5 cases in the New or Open states

licensed actionsSplunk SOAR (On-premises) licensed actions

  • phantom.act()
  • phantom.prompt()

Using these actions via the REST API, a Playbook, or by executing an action in the Splunk SOAR (On-premises) graphical user interface counts as a licensed action. When used in the Visual Playbook Editor's debugger, these actions are not counted against the number of licensed actions.

No actions called from the Visual Playbook Editor's debugger count as a licensed action.

Note: The action limit is specifically the number of actions run, as opposed to Playbooks run. Running one Playbook may invoke several actions. Also, an action run against multiple assets will count as only one action. Keep this in mind if you are managing the number of actions taken per day.

Seat-based license

Splunk SOAR (On-premises) is licensed by the number of user accounts that can log in to Splunk SOAR (On-premises). This number includes local accounts in Splunk SOAR (On-premises), regardless of role, and accounts authenticated or managed by external services, like LDAP or SAML. The built-in user accounts for the Automation and the soar_local_admin users do not count against a seat-based license. Other local users assigned the admin role still count against a seat-based license.

If you reach the number of allocated seats in your license, you cannot provision new user accounts.

Seat limits must be purchased in increments of five.

Obtaining a license

To obtain a license, you must submit a license request and obtain a Splunk SOAR (On-premises) license file.

To obtain a trial license for Splunk SOAR (On-premises), contact the Splunk SOAR (On-premises) Sales department.

To request an updated copy of a current Splunk SOAR (On-premises) license, open a license request case at https://support.splunk.com or call +1(855)SPLUNK-S or +1(855)775-8657.

International Splunk Support numbers are located at https://www.splunk.com/en_us/about-us/contact.html#tabs/customer-support.

The expiration of the license is based on the terms listed in your company's entitlement.

Once you have your license file:

  1. From the main menu, select Administration.
  2. Select Company Settings > License.
  3. Click Upload Key.
  4. Provide the location of the key file on your system.
  5. Click Accept & Install. The license is applied automatically.

The information obtained from the license file is displayed on the page.

If any of the information shown is incorrect or you experience any difficulty loading the license file, open a support case at https://support.splunk.com or call +1(855)SPLUNK-S or +1(855)775-8657.