topic Re: Splunk license in Dashboards & Visualizations

Splunk license

LogUx — Mon, 29 Jan 2024 07:25:08 GMT

Hello Splunker!!

My Splunk Enterprise license expired on January 29th, and because of that, I have renewed the license. But I missed some events during the license expiration period. How can I get back missed events so they will show up in the below graph?

uagraw01_1-1706513002053.png

Re: Splunk license

gcusello — Mon, 29 Jan 2024 07:32:54 GMT

Hi @LogUx ,

it depends on how you are receiving those logs: if they are syslogs that you directly receive in Splunk (in other words not using rsyslog or syslog-ng) you missed them, for this reason is a best practice us a syslog server insted of Splunk.

if they come from files or wineventlog, it depends on the retention of these data in the original systems.

If you still have the files, you should try to read them again using the crcSal = <SOURCE> option.

Ciao.

Giuseppe

Re: Splunk license

LogUx — Mon, 29 Jan 2024 08:32:35 GMT

@gcusello We are receiving the data through ActiveMQ.

Re: Splunk license

gcusello — Mon, 29 Jan 2024 08:44:51 GMT

Hi @LogUx,

I don't know this add-on and the source, check if it's possible to send again data , otherwise they are lost.

Ciao.

Giuseppe

Re: Splunk license

PickleRick — Mon, 29 Jan 2024 09:33:25 GMT

What report is this? Licensing errors can make your environment stop searching but they shouldn't prevent you from indexing as far as I remember.

Re: Splunk license

LogUx — Mon, 29 Jan 2024 10:26:13 GMT

So you mean after the restart of the Splunk, the previous data should visible.

Re: Splunk license

gcusello — Mon, 29 Jan 2024 10:29:09 GMT

Hi @LogUx ,

if you were in License Violation, Indexing didn't stop, only searching was stopped, so you should have all the logs, also in the no licensing period.

If you haven't (as from your screenshot), there is another reason for this, as I described in my answer.

Ciao.

Giuseppe