topic Re: Indexers frequently going to internal indexes only due to errant License Expired messages in Splunk Enterprise

Indexers frequently going to internal indexes only due to errant License Expired messages

briancronrath — Mon, 19 Feb 2024 06:44:23 GMT

For the past couple weeks I will at least once per day have one of our indexers go into internal logs only mode, and the reason it states is that License is expired. It's a bogus message since the license definitely is not expired and also not even close to exceeded, and restarting splunk service on the indexer always clears the error. Unfortunately not much more is provided by the splunk logs that would indicate anything I can investigate.

Has anyone ever ran into similar, or might know where I can look to troubleshoot this further? It's making my life pretty tough because I have to constantly be restarting indexers due to this error.

Re: Indexers frequently going to internal indexes only due to errant License Expired messages

kiran_panchavat — Mon, 19 Feb 2024 08:12:30 GMT

Could you kindly paste the screenshot of the precise error you are receiving?

Re: Indexers frequently going to internal indexes only due to errant License Expired messages

briancronrath — Wed, 21 Feb 2024 17:22:09 GMT

Re: Indexers frequently going to internal indexes only due to errant License Expired messages

kiran_panchavat — Wed, 21 Feb 2024 17:51:27 GMT

@briancronrath

Your splunk deployment is encountering license enforcement restrictions because of that you were not able to search the data from the indexers.

License Enforcement: This means Splunk is enforcing limits based on your current license.

45 warnings: You've received 45 warnings for exceeding your limit within a 60-day window.

Search disabled: If you receive 45 more warnings, search functionality will be disabled.

Possible Causes:

Data Ingestion: You might be ingesting more data than your license allows.

License Type: Your current license might not accommodate your data volume or usage needs.

License Pool Quota: If using a license pool, a specific member exceeding its quota could trigger warnings.

Re: Indexers frequently going to internal indexes only due to errant License Expired messages

kiran_panchavat — Wed, 21 Feb 2024 17:53:32 GMT

@briancronrath

I would request you to contact Sales team to get a temporary reset license.