I sent splunk an email for advice about swapping to a free licence before the trial ran out, but never got any help and have noticed today it must have ran out recently as I now have some licence violations. I've also updated the license to the free version today and also updated the application.
Under current it lists the following twice and that must correct by midnight to avoid violation
1 pool warning reported by 1 indexer
then under permanent it says
3 license window warnings reported by 1 indexer
then under local server information it reports
Licensed daily volume 500mb
Volume used today 0mb (0.003% of quota)
Warning count 3
How do i get rid of these errors without losing all my data as trying to find it through the help pages isn't very informative
Read this for your options:
The options you have are the following since you only have 500 MB per day for free:
You can do this to help you manage the data volumes:
FYI, while in violation, the indexer continues to index data, but can still record new daily license warnings.
With a splunk enterprise license with splunk support contract, you can ask for reset key.
If you are using splunk free, you have to wait 30 days without new warnings for the violation to reset by itself.
Otherwise, reinstall splunk and move the old buckets to the new install.