Getting Data In

Why am I getting an error that my license has expired or have exceeded license violations?

Hi 🙂

Dears, I am using Splunk 6.4 as a heavy forwarder which send its logs to an indexer (6.3) .
Heavy forwarder has MySQL add-on installed on it. While trying to search indexed data, I got the error below that my license expired or has been violated, despite still having not indexed any data or expiration date hasn't come!

please advise ?
alt text

alt text


0 Karma

Revered Legend

The heavy forwarder should be added as license slave to your actual license master server. Use any of below method to update the same

0 Karma


Remember that licenses are not ONLY about how much data you index per day. The Enterprise license also conveys capabilities, such as distributed search. That's why you need to follow @somesoni2's suggestion.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!