Splunk license

[LogUx]

Hello Splunker!!

My Splunk Enterprise license expired on January 29th, and because of that, I have renewed the license. But I missed some events during the license expiration period. How can I get back missed events so they will show up in the below graph?

uagraw01_1-1706513002053.png

[PickleRick]

What report is this? Licensing errors can make your environment stop searching but they shouldn't prevent you from indexing as far as I remember.

[LogUx]

So you mean after the restart of the Splunk, the previous data should visible.

[gcusello]

Hi @LogUx ,

if you were in License Violation, Indexing didn't stop, only searching was stopped, so you should have all the logs, also in the no licensing period.

If you haven't (as from your screenshot), there is another reason for this, as I described in my answer.

Ciao.

Giuseppe

[gcusello]

Hi @LogUx ,

it depends on how you are receiving those logs: if they are syslogs that you directly receive in Splunk (in other words not using rsyslog or syslog-ng) you missed them, for this reason is a best practice us a syslog server insted of Splunk.

if they come from files or wineventlog, it depends on the retention of these data in the original systems.

If you still have the files, you should try to read them again using the crcSal = <SOURCE> option.

Ciao.

Giuseppe

[LogUx]

@gcusello We are receiving the data through ActiveMQ.

[gcusello]

Hi @LogUx,

I don't know this add-on and the source, check if it's possible to send again data , otherwise they are lost.

Ciao.

Giuseppe