https://community.splunk.com/t5/Splunk-Enterprise/Why-does-slave-have-no-matching-license-pool-for-the-data-it/m-p/627671#M15158 <P>I found that after I installed&nbsp;<SPAN>ITE Work. It removed/override the trial enterprise license in Splunk.</SPAN></P><P><SPAN>I can see the trial license file in&nbsp;/opt/splunk/etc/licenses folder, but I cannot see in Splunk web/CLI.</SPAN></P><P><SPAN>As a result, it does not have license for * source type.</SPAN></P><P><SPAN>Does&nbsp;ITE Work can not use with trial license?</SPAN></P><P><SPAN>Thank you.</SPAN></P> Fri, 20 Jan 2023 03:11:25 GMT MT1234 2023-01-20T03:11:25Z https://community.splunk.com/t5/Splunk-Enterprise/Why-does-slave-have-no-matching-license-pool-for-the-data-it/m-p/627323#M15114 <P>Hello,</P> <P>I am new to Splunk and have testing purpose. I have installed Splunk within 30 days and installed the ITE content pack recently.</P> <P>I got below error when searching. I found that the document said that searching will be disabled when there are five or more alerts.</P> <P>But I don't know why my usage is full?</P> <P>Error in Search:</P> <P>Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting <A href="http://www.splunk.com/store" target="_blank" rel="noopener">www.splunk.com/store</A> or calling 866.GET.SPLUNK.</P> <P>Licensing Alert:</P> <P>slave had no matching license pool for the data it indexed</P> <P>Licensing Alert from CLI:</P> <P>4565f4ac328ca2cebf5d54342bd63c99<BR />category:orphan_peer<BR />create_time:1673625600<BR />description:slave had no matching license pool for the data it indexed<BR />peer_id:FDE1BB3F-01D3-4B27-B0FB-19AAE1CD27A0<BR />severity:WARN<BR />slave_id:FDE1BB3F-01D3-4B27-B0FB-19AAE1CD27A0</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Capture1.PNG" style="width: 977px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23402iA98D69956CB64961/image-size/large?v=v2&amp;px=999" role="button" title="Capture1.PNG" alt="Capture1.PNG" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Capture2.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23403i28279EA60DC6DBD9/image-size/large?v=v2&amp;px=999" role="button" title="Capture2.PNG" alt="Capture2.PNG" /></span></P> <P>Appreciate for any help.</P> Wed, 18 Jan 2023 18:45:24 GMT https://community.splunk.com/t5/Splunk-Enterprise/Why-does-slave-have-no-matching-license-pool-for-the-data-it/m-p/627323#M15114 MT1234 2023-01-18T18:45:24Z https://community.splunk.com/t5/Splunk-Enterprise/Why-does-slave-have-no-matching-license-pool-for-the-data-it/m-p/627671#M15158 <P>I found that after I installed&nbsp;<SPAN>ITE Work. It removed/override the trial enterprise license in Splunk.</SPAN></P><P><SPAN>I can see the trial license file in&nbsp;/opt/splunk/etc/licenses folder, but I cannot see in Splunk web/CLI.</SPAN></P><P><SPAN>As a result, it does not have license for * source type.</SPAN></P><P><SPAN>Does&nbsp;ITE Work can not use with trial license?</SPAN></P><P><SPAN>Thank you.</SPAN></P> Fri, 20 Jan 2023 03:11:25 GMT https://community.splunk.com/t5/Splunk-Enterprise/Why-does-slave-have-no-matching-license-pool-for-the-data-it/m-p/627671#M15158 MT1234 2023-01-20T03:11:25Z