topic Re: Splunk Indexing is Paused Internal Grace Period? in Getting Data In

Splunk Indexing is Paused Internal Grace Period?

velayudhan — Mon, 13 Feb 2023 17:07:13 GMT

Hi All

We are Using the Splunk Enterprise version with the Perpetual License Model with Index Capacity of 5 GB .

We are all of sudden facing issue in the Indexing of the data when the Limit is not yet breached in the Last 30 days .

Can you please Guide on this case .

Re: Splunk Indexing is Paused Internal Grace Period

gcusello — Sun, 12 Feb 2023 06:39:09 GMT

Hi @velayudhan,

some stupid questions to understand:

when does your violation start: in the last day or before the last 30 days?

if before, you need a reset key, it isn't sufficient to wait for 30 days without violations.

Is you License master on the same server of indexers? if not, did you used IP or dns name to address the license Master from the Indexers?

If dns server, use IP because maybe there a dns resolution problem.

Anyway, you have to ask a reset key to Splunk Support.

Ciao.

Giuseppe

Re: Splunk Indexing is Paused Internal Grace Period

velayudhan — Mon, 13 Feb 2023 04:26:47 GMT

HI guliceo

Thanks for the update

Some additional Clarity About Splunk Environment

Splunk System is under License Limit of 5 GB per day and there is no means of Violation in the System

License master is on the Splunk Search Head only

Can you suggest a good way to reach the Splunk Team ?

Re: Splunk Indexing is Paused Internal Grace Period

gcusello — Mon, 13 Feb 2023 07:06:37 GMT

Hi @velayudhan,

at first, you're using a distributed architecture, so did you configured all your Splunk servers as Forwarders and are they sending logs to indexers?

In a distributed architecture like your, it's a best practice that all the Splunk servers send theyr logs to Indexers and all server 8except Indexers) are configured as Forwarders.

Then Indexers are connected to the License Master, are you using IP address or dns name to address the License Master on Indexers? if dns, use IP.

Try this, if you not solve, you can open a case to Splunk Support on partners.splunk.com (if you're a Splunk Partners) or on www.splunk.com/en_us/about-splunk/contact-us.html#customer-support (if you're a customer).

Ciao.

Giuseppe

Re: Splunk Indexing is Paused Internal Grace Period?

velayudhan — Wed, 15 Feb 2023 04:40:29 GMT

Hi
Thanks for the update

Myself not able to create an Ticket on the Splunk System can you guide on the same ?

Re: Splunk Indexing is Paused Internal Grace Period?

gcusello — Wed, 15 Feb 2023 07:29:43 GMT

Hi @velayudhan,

at first, are you a Customer or a Splunk partner?

because you have to use a different portal:

partners.splunk.com (if you're a Splunk Partners),
www.splunk.com/en_us/about-splunk/contact-us.html#customer-support (if you're a customer).

then, if you're a customer, you must be enabled to open cases: usually when a contract is activated the customer communicate three emails of reference people to open cases, I don't know if you are enabled, otherwise, someone else in your organization must open the case.

If you're a partner, usually partners aren't enabled to open cases for the customers, because when you open a case you have to indicate the Entitlement, except if the customer enables you to open cases.

Ciao.

Giuseppe