Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times.



How long do I have to wait before my free license will be enabled again? Is there any way that I can get this license reset so that I can start searching again?


Licensing alerts notify you of excessive indexing warnings and licensing misconfigurations. Learn more
1 pool warning reported by 1 indexer Correct by midnight to avoid violation Learn more
1 pool violation reported by 1 indexer Correct by midnight to avoid violation Learn more
4 license window warnings reported by 1 indexer 1 week ago

Labels (1)
Tags (3)


Yeah all I can say is that splunk has the worst customer service when it comes to the trail and free version issues. I installed splunk and never really used it but it keeps saying I have exceed my limit and that I need to call splunk. When I do they say we do not support the free version and its been way over 30 days and no reset. Horrible support and company. The funny thing is I am the IT manager for my company and my company is try go with another SEIM and getting ready to get rid of Splunk which I have been fighting for them to keep. After dealing with this frustration I am not going fight anymore to keep Splunk in my company.


But when you move from trial to free.. you get slammed with a ton of warning and violations thus making the 'free' version because a bit of a pita since search wont work for 30 days. Horrible user experience in this scenario.


"If you have 5 or more warnings on an Enterprise license or 3 warnings on a Free license in a rolling 30-day period, you are in violation of your license and search will be disabled."

So, your search will be disabled until you have less than 3 violations in the last 30 days. Or, if you apply a reset license, which could be obtained from support.

0 Karma



Thank you for this information, I also read this article. I would actually like to know how long my search will be disabled for by calculating the alerts above?


0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...