Splunk Test Server License Issue

[greenpebble]

I am getting the following error message whenever I try to login to my Splunk test environment: user=************** is unavailable because the maximum user count for this license has been exceeded. 

I think this is because of a new license I recently uploaded to this box. As the old license was due to expire I recently got a new free Splunk license (10GB Splunk Developer License). I received/uploaded it to the test box on Friday, 3 days before the old one was due to expire. I then deleted the old license that day despite it having a few additional days. On Sunday (the day the old license was due to expire), I started getting this login issue. As I can't get past the login screen I can't try and reupload a different license, etc. 

Any suggestions? 

[isoutamo]

There are some limitations which licenses you could stacked to count towards combined license. I don’t know how it will behaves if there are violations for those rules in one stack.
Could it be that this is your issue?
You could check what is your current license stack an if needed remove old licenses and add just locally this developer license. As already said this license haven’t any limits for user amount, but e.g. free license has.

[defection-io · Accepted solution]

Hi @greenpebble !

Hmm, the 10 GB dev license usually has all of Splunk's functionality enabled, so that's odd you are seeing that message (I know the 50 GB license has some limitations). If you can't login at all, there are a couple of things you can try. Either, update the license from the CLI or temporarily remove all other users from the instance.

This Splunk doc has information about adding a license from the CLI: https://docs.splunk.com/Documentation/Splunk/latest/Admin/LicenserCLIcommands

Once you update the license, try restarting Splunk and attempting to login again. If you are still having issues, try this to temporarily remove all other users from the instance:

1. Stop Splunk.

2. Go to `$SPLUNK_HOME/etc/passwd` and make a backup of this file (Ex. `cp passwd passwd.bak`).

3. Edit the `passwd` file and remove all users except for the `admin` user. There should only be 1 line in the file when you are done.

4. Restart Splunk.

This should let you login as the `admin` user, since the other users are removed. Once you login and fix the license, you can restore the `passwd` file from the backup to add the users back.

Hope this helps!

[richgalloway]

You should be able to log in using the admin account.

[greenpebble]

It is the admin acc that I am trying to log in with and the issue is still persisting. 

[richgalloway]

Try this.  Make a backup of $SPLUNK_HOME/etc/passwd.  Edit the original file and remove all users except admin and restart Splunk.