Overall, free Splunk (particularly version 4) is a product per se and
can be used in production without worries, unless you happen to need
the added features of the non-free version.
If you have small amounts of data to index, the above is true.
What we found out was that if your data is in the range of the limit, you are in TROUBLE.
We figured: Heck, 500mb/day, that is a lot. If we exceed it, no big deal, we will only be able to search 500 mb of it.
According to the splunk answers site, if you hit the limits, the Splunk Search feature is disabled... for DAYS at a time.
This effectively KILLS your splunk system (if you can't search, the whole system is about as useful as a sack of sand).
"If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have 5 or more violations on an Enterprise license or 3 violations on a Free license in a rolling 30-day period, search will be disabled. Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) violations in the previous 30 days or when you apply a new license with a larger volume limit.
Note: During a license violation period, Splunk does not stop indexing your data. Splunk only blocks access while you exceed your license.
So even if you have a paid license, if you hit the limits you can effectively disable the system.