Free Licence Migration


Hi Guys,

I have been trialing Splunk now for the duration of the Free-Enterprise license and would now like to move over to the free license.

I have tried this on another test box which I have and I am still receiving this error when I try search the data:

Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting or calling 866.GET.SPLUNK.

On this test box I am not sending too much data (only one firewall), so would expect this not to exceed the 500Mb limit.

I have ran the below command on the test server to show a 48h period and its no-where near the limit, or is it?...

index=_internal earliest=-48h source=*metrics.log per_index_thruput | eval mb=kb/1024 | stats sum(mb) by series

series  sum(mb)

1 _audit 0.361480773
2 _internal 46.5331381808
3 main 78.1099844046

Can anyone advise on the best way to migrate or clear this error?


Tags (3)


Thanks Draineh,

Is there any search which can be run to see when you last hit a violation/came close to one?, that way I could get an idea of when I could expect to get access back in.

0 Karma


If you get 5 or more violations within a 30 day period then it will lock your search. It won't unlock again until you have 30 consecutive days free of any warnings (Splunk still indexes while search is locked) so it may not be related to the last 48 hours at all.
Once on the free license you can have only 3 violations within a 30 day period.

Also it could be the license expiring, you can switch to the free one via manager -> licensing and there is an option to switch to the free license.

See here for more detail;

Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...