I’m trying to install a Splunk + Splunk App for Microsoft Exchange deployment. I followed the steps posted in Splunk.com (step by step). Everything went well until the last step when you need to install the Exchange App. When I did it, I lost access to the Forwarder Management section because Splunk told me that my license doesn’t allow me to access. I’m testing this deployment and I’m using the trial license (for both, Splunk and Exchange) since yesterday.
How could I fix this?
Forwarder Management is part of the Deployment Server functionality of Splunk, based upon what you've said this isn't available under the free license only under Enterprise or Trial. Its likely your trial expired at the same time as you installed this app (bit of co-incidence).
This is what you'll see when you select Settings -> Forwarder Management if the above holds true:
Forwarder management This is an
Enterprise-level feature. It is not
available with the installed set of
Solution: Get an Enterprise license, or get a trial extension (not sure you can do the latter).
Thanks for your answer @LewisWheeler.
I did all the installation with a Splunk in a trial license. Like I said, all was ok until the Microsoft Exchange App installation. After read your comment, it seems to be exactly that, the trial license was expired after the app installation, but I check the Settings > Licensing section and the expiration date for both licenses (Splunk Enterprise and Microsoft Exchange App) is April of this year.
Sounds like a bug to me then, i'd raise it with support however your unlikely to get anywhere as it'll have to go down as a P4 (Unless you have a Enterprise License sitting around - if so though you could just install that and use it).
Maybe worth uninstalling Splunk Enterprise completely and downloading the latest version and re-installing - if your using the latest version already then go down a sub version i.e. if your on 6.3.x then go down to latest of 6.2.x.
Then installing your Exchange App and see if you have the same behavior - I know its a bit of a pain but shouldn't take too much effort to do.
I'd recommend backing up all your app config including your default 'search' app - this is so you don't lose any dashboards or other knowledge objects (you should be able to just copy them back in after the fact).
Thank you @LewisWheeler.
We have a License for Enterprise, and when we upload it (and after a restart), we gain access to the Forwarder Managment again. Like you said, seems to be some kind of bug, but I don't know why.
Thanks again. Regards.