Event count is different after upgrading from a Free to Enterprise license

[Ellen]

We recently purchased Splunk and upgraded from a Free license to an Enterprise license.
After I installed the new license and restarted some of our indexes did not appear in the UI and our summary page shows a smaller event count.
What happened? All I did was install a new license?

[paulahoffman]

Similar issue. I was using a temp Ent license. When it expired I installed a new Ent license and removed the temp license.

A couple of weeks later I found that the 'earliest event' under Manager/Indexes for this index was the same day I upgraded the license. I was unable to find any data other than 'summary_host' events for systems I searched for.
My system has multiple indexers. The searchhead was already configured as you suggested for the Manager/AccessControls/Roles/Admin to use the index. I updated an indexer to the same settings for Admin. However, the 'earliest event' did not change on the indexer.
Is the previous data (using the temp Ent license) still on the indexers or was it purged during the license update?
Thanks

[Jaci · Accepted solution]

The Splunk Free license is a single user product that does not use authentication or access controls. Indexes created with the Free license are not searchable because under the Enterprise license the admin role does not have permission.

To resolve this go to manager>>Access Controls>>Roles>>Admin and add the missing indexes to the "Indexes searched by default" list of selected indexes.