Currently we have a Enterprise license but with this license we can't to do run query.
splunk show the next error
Streamed search execute failed because: Error in 'UnifiedSearch':Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK.
Licenses are usually valid for a certain rate of indexed data per day. If you go to license page in manager, it should give you more information as to how much index quota you have and any warnings you have had by indexing more than your quota.
More information is needed to better help.
If you exceed your amount of data you are licensed to index more than 5 times within a 30 day rolling window, searching outside of the internal indexes is disabled until the 30 day rolling window expires. Meaning on the sixth violation, you won't be able to search your indexed data. You can either wait until your violations won't count against you, or email/call support if you have an enterprise support agreement and a reset license can be issued.
According to the docs, you will not be able to search when you hit your 5th violation, meaning you can only have a maximum of 4 violations in a 30 day rolling period to be able to continue to use Splunk.
"Violations occur when you exceed the
maximum indexing volume allowed for
your license. If you exceed your
licensed daily volume on any one
calendar day, you will get a violation
warning. The message persists for 14
days. If you have 5 or more warnings
on an Enterprise license or 3 warnings
on a Free license in a rolling 30-day
period, you are in violation of your
license and search will be disabled.
Search capabilities return when you
have fewer than 5 (Enterprise) or 3
(Free) warnings in the previous 30
days, or when you apply a temporary
reset license (available for
Enterprise only). To obtain a reset
license, contact your sales rep. The
license comes with instructions on how
to apply it."