Getting Data In

Splunk 5 and search indexers



We were using a system which has a central Splunk head and multiple search peers where the search peers were DISABLED.

Is it possible that an upgrade to Splunk 5 re-enabled them ?

I went to Splunk Manager -> Licensing -> Enterprise license group and I see that ALL MY SEARCH PEERS AS WELL AS MY SEARCH HEAD are using up daily volume.

I doubt that that is the case (that an upgrade can re-activate configuration), but is it actually possible for something like this to happen ?

0 Karma

Splunk Employee
Splunk Employee

if the search was disabled for any license issue, you need a reset key to unlock the search.
If you have a support contract, file a ticket, otherwise, wait for 30 days for the automatic unlock.

0 Karma

New Member

i got solved problem for you!!!!

0 Karma


Hi there,

I phrased my question correctly now !

0 Karma


Not an answer, but a sidenote - I think you're confusing search heads and search peers here. A search head performs searches on search peers (peers are typically indexers).

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...