topic Re: splunk search issue. in Splunk Search

Why am I receiving this license error?

zhoayang — Fri, 04 Mar 2022 14:39:24 GMT

Hi Splunk team,

I have a question when I search in Splunk console. I got an issue as below:

Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK.

And I used an enterprise license. Does anyone have an idea about this case? appreciate it.

Re: splunk search issue.

SanjayReddy — Thu, 03 Mar 2022 08:08:29 GMT

Hi @zhoayang

I guess you are using using 60 days Enterprise version, and it got expried

plese check License expiry date Settings --> Licensing

you can change to Free license
please update your license settings from following steps and select free license

Settings --> Licensing - > change license group

that will fix the issue

Re: splunk search issue.

zhoayang — Thu, 03 Mar 2022 08:20:49 GMT

Hi, @SanjayReddy

Thanks for your reply. I check the expiration time and it doesn't expire now. and I also change the license group to a free license but still have the same issue.

I also have another discovery is my indexer is in violation. does it is the reason I got this issue? how to set the indexer to normal status?

thanks for your help.

Re: splunk search issue.

zhoayang — Thu, 03 Mar 2022 09:09:43 GMT

Hi @SanjayReddy

Sorry forget to list the snapshot. it shows the license doesn't expire.

Re: splunk search issue.

SanjayReddy — Thu, 03 Mar 2022 09:45:34 GMT

Hi @zhoayang

as you are using developer license , you might have exceed daily license limit 5 times in 30 days.

to re enable searching you need to send an email to devinfo@splunk.com

also please check your daily ingestion limit for last 30 days

once you searching reset from splunk you might need to install your developer license again

Re: splunk search issue.

venky1544 — Thu, 03 Mar 2022 13:04:13 GMT

Hi @zhoayang

since your license expiration time is still due and changing to free license will not help it would still give the same error so you can switch to your earlier license. Also as highlighted by your discovery the indexer is in violation if you had more than 5 or more warning in developers license it would give this error you have to resolve the indexer violation by either stopping the ingestion of the data to that particular violating index and wait for 24 hours and it would get resolved and you can start searching again

if you have multiple sources ingesting into that problematic index then disable the source which is the major contributor

i had a similar issue with my developers license and did the same action and after 24 hours all service of splunk were resumed

Re: splunk search issue.

zhoayang — Fri, 04 Mar 2022 02:16:59 GMT

Hi @SanjayReddy

great!! I think it is the reason why my indexer is in violation status. I found a lot of warnings in my alert console

that said This pool has exceeded its configured poolsize=0 bytes. A warning has been recorded for all members.

Maybe I should solve this problem then I will follow your advice. appreciate It! thanks again.

Re: splunk search issue.

zhoayang — Fri, 04 Mar 2022 02:23:01 GMT

Hi @venky1544

Yeah. that's correct. In the alert console, it appeared plenty of warning logs said

This pool has exceeded its configured poolsize=0 bytes. A warning has been recorded for all members.

it will cause the indexer to become in violation status.

thanks for your reply. appreciate it.