https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190956#M7910 <P>The quick answer is that it is your job to ensure that you don't send too much data to Splunk and go over the free license limit. Splunk will not do it for you, and there is no way to configure it (easily) to make it so that it does.</P> <P>Part of it might be you doing some regular monitoring, and shutting things off when they get too chatty. Part of it might be reducing the number of your inputs. Part of it might be writing some props/transforms configuration stanzas to reduce the size of the inputs you are taking in. Part of it might be setting up multiple Splunk servers with free licenses and directing your traffic so that none of them goes over. But there is no way to tell Splunk, "Stop indexing at the free license limit."</P> Fri, 06 Feb 2015 14:27:07 GMT aweitzman 2015-02-06T14:27:07Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190952#M7906 <P>Hello,</P> <P>I just have 4 servers in my splunk forwarder configuration and I exceeded the free licence.</P> <P>I would like configure my server to use just a free licence but no exceed the limit.</P> <P>Can you help me for this configuration please.</P> <P>Best regards.</P> Fri, 23 Jan 2015 11:24:29 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190952#M7906 novoferm 2015-01-23T11:24:29Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190953#M7907 <P>Hi novoferm<BR /> For understand this let read Splunk-6.1.1-Admin manual <BR /> p93 (Free License)<BR /> P110 (What About Violations and Warnings)<BR /> P112 (How To Avoid License Violation and correcting License warning) </P> <P>NOTE : Search this manual in splunk Documentation</P> Fri, 23 Jan 2015 12:58:56 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190953#M7907 chimell 2015-01-23T12:58:56Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190954#M7908 <P>Thank you for your answer.<BR /> I'll read the manuel now</P> Fri, 23 Jan 2015 13:09:02 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190954#M7908 novoferm 2015-01-23T13:09:02Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190955#M7909 <P>Hello,<BR /> Sorry I have read the manual but I can't resolve my licence problem.<BR /> Could you help me please, to install again a free licence without exceed this limit.</P> Fri, 06 Feb 2015 13:00:23 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190955#M7909 novoferm 2015-02-06T13:00:23Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190956#M7910 <P>The quick answer is that it is your job to ensure that you don't send too much data to Splunk and go over the free license limit. Splunk will not do it for you, and there is no way to configure it (easily) to make it so that it does.</P> <P>Part of it might be you doing some regular monitoring, and shutting things off when they get too chatty. Part of it might be reducing the number of your inputs. Part of it might be writing some props/transforms configuration stanzas to reduce the size of the inputs you are taking in. Part of it might be setting up multiple Splunk servers with free licenses and directing your traffic so that none of them goes over. But there is no way to tell Splunk, "Stop indexing at the free license limit."</P> Fri, 06 Feb 2015 14:27:07 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190956#M7910 aweitzman 2015-02-06T14:27:07Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190957#M7911 <P>OK thank you for your answer.<BR /> I have reduced the number of logs in the inputs file.<BR /> Now i have just 2 servers which send the windows event log to splunk forwarder.</P> <P>[WinEventLog://Application]<BR /> disabled = 1<BR /> [WinEventLog://Security]<BR /> disabled = 1<BR /> [WinEventLog://System]<BR /> disabled = 0</P> <P>I think that the licence limit will be good now.</P> <P>And I wait that Splunk unlock the seach task? Or I must change anything else?</P> <P>Thank you a lot.</P> Fri, 06 Feb 2015 15:23:33 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190957#M7911 novoferm 2015-02-06T15:23:33Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190958#M7912 <P>Yes, once you're locked out of searching, you either need to pay for a license or wait until the lock time is over in order to search again.</P> Fri, 06 Feb 2015 15:37:26 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190958#M7912 aweitzman 2015-02-06T15:37:26Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190959#M7913 <P>OK thank you.</P> Fri, 06 Feb 2015 15:53:19 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190959#M7913 novoferm 2015-02-06T15:53:19Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190960#M7914 <P>Hello,</P> <P>Searching is locked yet after 2 days waiting.</P> <P>How many time is the lock time?</P> <P>best regards</P> Mon, 09 Feb 2015 09:48:16 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190960#M7914 novoferm 2015-02-09T09:48:16Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190961#M7915 <P>Hello,</P> <P>It takes 30 days to release the lock from the search.</P> <P>Best regards</P> Mon, 09 Feb 2015 09:50:40 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190961#M7915 rwissSLNL 2015-02-09T09:50:40Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190962#M7916 <P>It's possible to unlock before the 30 days?</P> Mon, 09 Feb 2015 09:57:00 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190962#M7916 novoferm 2015-02-09T09:57:00Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190963#M7917 <P>With a normal license you can request a reset license from Splunk.<BR /> But because you use a free license Splunk will not give a reset key.</P> <P>Best solution is to buy a license key.</P> Mon, 09 Feb 2015 10:16:23 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190963#M7917 rwissSLNL 2015-02-09T10:16:23Z https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190964#M7918 <P>OK thanks.</P> <P>I will wait 30 days.</P> <P>Best regards</P> Mon, 09 Feb 2015 10:25:09 GMT https://community.splunk.com/t5/Monitoring-Splunk/Licence-free-exceeded-limit/m-p/190964#M7918 novoferm 2015-02-09T10:25:09Z