topic Re: Why does Splunk enterprise license show: Status= FROM_THE_FUTURE? in Installation

Why does Splunk enterprise license show: Status= FROM_THE_FUTURE?

Bill_B — Mon, 28 Sep 2020 16:53:31 GMT

I am running Splunk 6.0.4 on linux. On the "Licensing" page, my enterprise license shows a status of "FROM_THE_FUTURE" instead of "valid" like in the documentation. Why is this and what does it mean?
Also, the volume of my license is 5,120 MB but Effective daily volume is 0 MB. Why?

Any help is greatly appreciated.

Re: Why does Splunk enterprise license show: Status= FROM_THE_FUTURE?

jgreenleaf — Mon, 28 Sep 2020 16:53:33 GMT

Licenses are only valid after they are issued, not before. This is to prevent you from buying a license and then sending it x time_units in the past, as that way splunk would miss out on x time_units of license fees.

To resolve this issue just run "ntpdate pool.ntp.org".

Re: Why does Splunk enterprise license show: Status= FROM_THE_FUTURE?

dshpritz — Thu, 19 Jun 2014 22:40:27 GMT

Re: Why does Splunk enterprise license show: Status= FROM_THE_FUTURE?

Bill_B — Thu, 19 Jun 2014 22:57:14 GMT

Thank you. This solves an entire licensing issue I have been working on. Turns out my servers thought it was 2013.

Re: Why does Splunk enterprise license show: Status= FROM_THE_FUTURE?

david_nelson-ga — Thu, 29 Jan 2015 22:27:22 GMT

I'm having the same problem but what is frustrating is two things:

1) This is a renewal license, not a beginning license. All my historic data has been collected under existing licenses.
2) Today is the day my 2014 license expires. It seems absurd to make me wait until midnight to add it.
3) How do I know its going to work? That is, how do I know the difference between "Don't worry, it will work in the morning" and a botched license file generation which means I'm flying blind for a few days while I hassle with Splunk to fix?

If everything works, it seems like unneeded stress for renewing customers. If it breaks, I am really not going to be happy and will start considering alternatives.

Re: Why does Splunk enterprise license show: Status= FROM_THE_FUTURE?

edeefelt — Wed, 30 Sep 2020 05:37:50 GMT

I seem to be showing three identical licenses (all the same size) which I'm guessing means they really all are the same license:
one expired
one good for another year (shows valid)
one good for two more years but shows FROM_THE_FUTURE
Is there a way to tell from the "All license details" page if these are all the same license?
I'm guessing this means an expired license was updated for a year, then for a second year but it doesn't go in to effect until the current one finishes (as pointed out by @David.nelson-gal)

Re: Why does Splunk enterprise license show: Status= FROM_THE_FUTURE?

bpenn_splunk — Thu, 04 Nov 2021 20:29:34 GMT

As an addition to this thread, one of my customers pointed out that they applied their renewal license and received the same "FROM_THE_FUTURE" status. The cause of this is that the "create date" field, which is in epoch form and the actual start date of the renewal, is in the future. This should clear once the create/start date arrives, but it may require a restart of Splunk.