topic Re: 1MB Forwarder license expiring? in Getting Data In

1MB Forwarder license expiring?

Jason — Tue, 01 Mar 2011 22:46:18 GMT

At a few customers now I have seen a 1MB (forwarder) license with an expiration of early March. I'm not sure where this came from - was this a bug?

user@host $ bin/splunk show license
Current Daily Usage Amount:     0
Expiration date:                2011-03-08T01:07:37-0500
Expiration State:               7
License level:                  1 MB
Product:                        Enterprise
License violations:
Max Violations:
Peak usage:                     0 MB
Days remaining:                 6 day(s)
Violation Period:

Re: 1MB Forwarder license expiring?

Jason — Tue, 01 Mar 2011 23:16:04 GMT

The expiring license file starts with forwarder@splunk.com and the encrypted text began with RV7. When the license was changed to splunk-forwarder.license from the 4.1.6 64-bit linux tgz package, the date went back to 2020-06-08 as expected (that file starts with forwarder@splunk.com and the encrypted text starts with JbX).

Re: 1MB Forwarder license expiring?

David — Wed, 02 Mar 2011 02:27:56 GMT

There was a Splunk Answers a bit ago that said they accidentally shipped a bad forwarder.license in one release. It was a bit scant on details, so it's hard to confirm that it is your issue, but it certainly sounds like it.

http://answers.splunk.com/questions/11192/splunk-forwarder-license

Re: 1MB Forwarder license expiring?

gkanapathy — Wed, 02 Mar 2011 02:35:09 GMT

This was a bug in one of the releases. You should be able to replace it with the forwarder license from a current release of Splunk. Note that this is mostly of no consequence on a forwarder, since the results of a license lockout are that you can't search, and there is (or should be) nothing to search on a forwarder.

Re: 1MB Forwarder license expiring?

yannK — Wed, 02 Mar 2011 08:20:28 GMT

A simple solution is to download a splunk 4.1.7 zip/tar.gz and use the forwarder license shipped in it /etc/splunk-forwarder.license

But at this step, why not upgrade directly to 4.1.7

Re: 1MB Forwarder license expiring?

Ellen — Wed, 02 Mar 2011 23:49:35 GMT

This is a known issue. More details and options can be found here:
http://answers.splunk.com/questions/12167/why-is-the-license-on-the-forwarder-search-head-displaying-a-message-it-is-expiri

Re: 1MB Forwarder license expiring?

Jason — Wed, 02 Mar 2011 23:56:33 GMT

Upgrading will not change the license by default.

Re: 1MB Forwarder license expiring?

Jason — Wed, 02 Mar 2011 23:58:08 GMT

Thanks - This link actually has a copy of the correct license for folks out there. Good to know it's a known bug.

Re: 1MB Forwarder license expiring?

Jason — Wed, 02 Mar 2011 23:58:32 GMT

More details (and proper license) in #12167.

Re: 1MB Forwarder license expiring?

Jason — Fri, 11 Mar 2011 05:22:04 GMT

But for other non-indexing uses, such as on a search head, it is of vital importance.