Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times.



How long do I have to wait before my free license will be enabled again? Is there any way that I can get this license reset so that I can start searching again?


Licensing alerts notify you of excessive indexing warnings and licensing misconfigurations. Learn more
1 pool warning reported by 1 indexer Correct by midnight to avoid violation Learn more
1 pool violation reported by 1 indexer Correct by midnight to avoid violation Learn more
4 license window warnings reported by 1 indexer 1 week ago

Labels (1)
Tags (3)


Yeah all I can say is that splunk has the worst customer service when it comes to the trail and free version issues. I installed splunk and never really used it but it keeps saying I have exceed my limit and that I need to call splunk. When I do they say we do not support the free version and its been way over 30 days and no reset. Horrible support and company. The funny thing is I am the IT manager for my company and my company is try go with another SEIM and getting ready to get rid of Splunk which I have been fighting for them to keep. After dealing with this frustration I am not going fight anymore to keep Splunk in my company.


But when you move from trial to free.. you get slammed with a ton of warning and violations thus making the 'free' version because a bit of a pita since search wont work for 30 days. Horrible user experience in this scenario.


"If you have 5 or more warnings on an Enterprise license or 3 warnings on a Free license in a rolling 30-day period, you are in violation of your license and search will be disabled."

So, your search will be disabled until you have less than 3 violations in the last 30 days. Or, if you apply a reset license, which could be obtained from support.

0 Karma



Thank you for this information, I also read this article. I would actually like to know how long my search will be disabled for by calculating the alerts above?


0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...