Free licence behaviour.

[grownup_splunk]

How to clean up licence violations and get the 'free' version working again?

The licensing /testing arrangement on spunk needs sorting out.
W hy must they act like microsoft and continually blame the user instead of clamping the data volume just prior to the licence being violated?

The setup....
Install load in a few logs and.... overshoot the licensing requirement, warning 1 (new user evaluation)

Cut back the data.... shutdown 'spunk' for a few days.... restart... and overshoot the licensing due to back-stored data, that on a daily basis would not trigger a licensing violation ( several more licence violations)... due to forgetting to set spunk to 'auto start' on the test server.

finally get "Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK." messages.....

drop back to 'free' version to try and clean up the mess...

Then on startup of 'free version":
"Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK."

Current data volume on test setup ~ .1gb
keeping in mind that this is a test server, just why must they make it so difficult to evaluate the product?

[MuS]

Hi there,

Although @piebob and @grijwhani already provided answers; I will answer your frist question: read this answer http://answers.splunk.com/answers/66786/free-license-reset.html and follow the instruction.

The second one is mostly in the eye of the beholder if something is too hard or not ....

cheers, MuS

[MuS]

Btw you also could signup here http://dev.splunk.com/page/developer_license_sign_up to get a dev license which is valid 60 or 90 days or contact any sales near you to get an enterprise trail license http://www.splunk.com/view/contact-us/SP-CAAAAH7

[grijhwani]

This behaviour is known, and described in the terms and conditions. What good is a logging system that dumps logs?

You, the administrator choose what you send to Splunk. You the administrator have the option to curtail that input. Why would you blame Splunk for simply protecting their development investment? After all they have no obligation to provide a free licence at all. Most companies would supply an evaluation licence only to prospective paying customers.

[piebob]

what exactly is your question?

here's how the licensing for Splunk Free works:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/MoreAboutSplunkFree

if you're actually evaluating the product for a potential paid implementation, you can get a larger trial license from sales.

[grownup_splunk]

It was actually an evaluation of the enterprise version

The gist of it was that the 'enterprise version' should have been good for 30 days eval at about 1gb per day.. but the licensing 'cut' access to the search functionality without us appearing to be over the 'limit'.
This occurred during an extended multi pronged network attack across multiple sites and was a good indication of the performance of the product.

Anyway the rep called me directly and after a long discussion and due to no fault of the product(other than the operation of the licensing), it was decided we would not be prepared to accept the situation as it currently stands.

[martin_mueller]

Note, the stack in the screenshot you posted is only 0.5gb/day, so you're bound to run into trouble if you intend to do 30 days at about 1gb per day.

[grownup_splunk]

ER usually the part of the sentence with the '?' ....