topic Re: Splunk unable to search auth.log after free trial expired? in Installation

Splunk unable to search auth.log after free trial expired?

wuming79 — Tue, 02 Jan 2018 06:49:16 GMT

Hi,

My splunk free license has expired but I can still upload auth.log to splunk, however, I was not able to search anything after data is uploaded. I was also unable to search my old data. Is this normal?

Re: Splunk unable to search auth.log after free trial expired?

mayurr98 — Tue, 02 Jan 2018 06:57:53 GMT

are you getting messages like "you have exceeded your license limit too many times"?

Re: Splunk unable to search auth.log after free trial expired?

wuming79 — Tue, 02 Jan 2018 07:00:40 GMT

nope. Only new version available message.

Re: Splunk unable to search auth.log after free trial expired?

mayurr98 — Tue, 02 Jan 2018 07:11:54 GMT

Hey

Let me tell you something about free license:
-- Disables alerts, authentication, clustering, distributed search,
summarization, and forwarding to non-Splunk servers
-- Allows 500mb/day of indexing and forwarding to other Splunk
instances

3 warnings on a Free license, in a rolling 30-day period, is a
violation.Thereafter you can not able to search any data though you can index it.

Refer this doc:
https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/MoreaboutSplunkFree

Let me know if this helps you!

Re: Splunk unable to search auth.log after free trial expired?

mayurr98 — Tue, 02 Jan 2018 07:15:00 GMT

check if its a trial license or free license ? trial is valid for 60 days thereafter you need to activate it as a free license

Re: Splunk unable to search auth.log after free trial expired?

wuming79 — Tue, 02 Jan 2018 07:40:19 GMT

Hi,

I'm none of the above. No violations for the past 30 days.

Re: Splunk unable to search auth.log after free trial expired?

micahkemp — Tue, 02 Jan 2018 16:22:46 GMT

What do you see when you try to search? A screenshot is probably very valuable to help troubleshoot.

Re: Splunk unable to search auth.log after free trial expired?

wuming79 — Wed, 03 Jan 2018 01:48:28 GMT

I'm not sure why. I just upload my data again but changing the host from default "splunk" to some other names and it works now.