Getting Data In

Why is the license on the forwarder/search head displaying a message it is expiring in x days on March 7, 2011?


I have a perpetual Enterprise license and having not been having any issues until the today when I started to see a message displaying my license is expiring in 7 days. I noticed that the license expiration is showing March 7, 2011. What do I need to do to get this fixed?


Re: Why is the license on the forwarder/search head displaying a message it is expiring in x days on March 7, 2011?


If your current splunk.license key has a prefix of ";", you have encountered a known issue (SPL-31628) where a splunk-forwarder.license is associated with an expiration date of 2011-03-07 and your current splunk.license is a copy of this license key.

The splunk.license key will have a key prefix similar to:;RV75...etc.

This has been fixed as of 4.1.4 with an updated splunk-forwarder.license file with a new expiration date for the key. eg. 2020-06-08

In many cases,the splunk.license file on a forwarder (lightweight) or dedicated search head instance is just a copy of the splunk-forwarder.license located in $SPLUNK_HOME/etc under *Nix and on Windows at %SPLUNK_HOME%\etc
The license content is not operating system specific.

Similar to license volume violations, an expired license will prevent searching but indexing continues. Searching will be available once the license issue is resolved.
An expired license on a forwarder will not affect its ability to continue to process data.

Do not confuse this with a splunk.license that has your own Enterprise license email address associated with it. If your splunk.license on your forwarder/dedicated search head instance does not start with ";" and there is no indication of an expiration, this issue is not applicable.

In some environments while the Splunk version may have been upgraded to 4.1.4 and above, it is possible the splunk.license on the forwarder/search head instance was never manually updated with the
new splunk-forwarder.license key with the new expiration date.
Thus it has retained its previous Splunk version's license copy (eg. 4.0.x or pre 4.1.4) and is now displaying an expiration message.
While it is beneficial to upgrade to the most current Splunk version, you do not have to upgrade your forwarder/search head instance just to fix the expired license; follow one of the steps below.

Options to resolve:

1) if you have a Splunk version 4.1.4 and up already installed, simply copy the splunk-forwarder.license to be the new splunk.license on your forwarder/search head instance where the expiration message is displayed and restart Splunk
2) use the following key to be your new splunk-forwarder.license key and splunk.license (on the LWF or dedicated search head) via either method below:

a) via SplunkWeb > Manager > License > Change License and replace the existing with the key below and restart Splunk
b) via an editor, replace the existing splunk.license and splunk-fowarder.license file content with the key below and restart Splunk;JbX7lUZTDqk0tPNS7I0KEEdJ2tLJh0j++r6GOsx3jcxL3/nxvzL5Zx1uNEZjvdRPsqf1jnG1LoT/t8ouO7vGP75RX5G10CjQN3ED4yaE62KXcv8z1kbLD9JE31/tN/oUORTTqp8Nshst9/hN4qne9LWlxGZBz0XlQXQLOsIx5cLQdfb8WHtQ5OpNavlFSbzDBVcbewr/4nV7EtFgXTpm4ynNuE9b/JZ9glpYsV5qUgqULm/hzR2d6gteFvv5qN5zFnNYcUHnhP2FqCiSKyovzKLmy5a3yM8S682XJ8/a7FKwiFks7+XIsMVTjFv/tDg2DfE58HuRCWqkLb37mDu/yA==

If you happen to see "Your license is expired" at the login screen, you can follow Option (1) above or continue with an admin login > select Enter a new license number > Continue > replace the existing license content with the above > select Save. Proceed to restart Splunk.

If you continue to have license expiration issues, please log a Support case and include the license key for further investigation.

View solution in original post


Re: Why is the license on the forwarder/search head displaying a message it is expiring in x days on March 7, 2011?

Ultra Champion

The splunk instances potentially concerned are :

  • search-heads
  • forwarders
  • light weight forwarders
  • deployment servers

ONLY If they are using an old copy of the splunk-forwarder.license in splunk.license unfortunately, an old installation will keep the existing license, and an upgrade of splunk will not fix the license.

to upgrade the license on each of your forwarders to a new one expiring in 2020.

  1. get the new splunk-forwarder.license
  2. use a script to copy it on the forwarders as $SPLUNK_HOME/etc/splunk.license
  3. restart splunk to apply

be careful not to erase the genuine license file on your indexers !!!