This can be useful for forensic review of large data sets. The major limitations of Splunk Free are the license volume restriction and removed features.
If you exceed that you will receive a license violation warning.
If you want to run Splunk Enterprise to practice searches, data ingestion, and other tasks without worrying about a license, Splunk Free is the tool for you.
