Search is not working

[Bero]

I want to use the free version of Splunk with a daily limit of 500 MB to search my logs.
I have about 30 - 40 MB new logs per day so it should work fine.

I have changed license type to free in Manager/Licensing.

Now when I search I got this:

Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK

Is there any solution for this problem ?

[Dimitri_McKay]

And if you are already a Splunk Customer and have installed a new or upgraded license remember that new licenses don't clear violations. If you are a customer who purchased a license you'll need to speak to your account rep for a 'reset license' to clear the violation state before the error will go away.

[Simeon · Accepted solution]

Splunk initially offers the option to use:

1. Enterprise trial license (60 days I believe)
2. Free License

At the end of the trial period, you must switch over to the free license or contact Splunk (purchase one, further evaluate, etc...).

It is likely that you are on an expired license, or you indexed too much data in one day (maybe you indexed a lot of historic data). There are searches that can find out your daily volume:

index=_internal earliest=-24h source=*metrics.log per_index_thruput | eval mb=kb/1024 | stats sum(mb) by series

The above search will tell you the amount of data (by index) indexed in the last 24 hours.

[Bero]

Thanks for the answer. it seems that I have too much historical data and I was too fast with switching to the free Splunk. I think I reinstall and use the evaluation version. Later we should decide if we buy it or not.