Free Licence Migration


Hi Guys,

I have been trialing Splunk now for the duration of the Free-Enterprise license and would now like to move over to the free license.

I have tried this on another test box which I have and I am still receiving this error when I try search the data:

Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting or calling 866.GET.SPLUNK.

On this test box I am not sending too much data (only one firewall), so would expect this not to exceed the 500Mb limit.

I have ran the below command on the test server to show a 48h period and its no-where near the limit, or is it?...

index=_internal earliest=-48h source=*metrics.log per_index_thruput | eval mb=kb/1024 | stats sum(mb) by series

series  sum(mb)

1 _audit 0.361480773
2 _internal 46.5331381808
3 main 78.1099844046

Can anyone advise on the best way to migrate or clear this error?


Tags (3)


Thanks Draineh,

Is there any search which can be run to see when you last hit a violation/came close to one?, that way I could get an idea of when I could expect to get access back in.

0 Karma


If you get 5 or more violations within a 30 day period then it will lock your search. It won't unlock again until you have 30 consecutive days free of any warnings (Splunk still indexes while search is locked) so it may not be related to the last 48 hours at all.
Once on the free license you can have only 3 violations within a 30 day period.

Also it could be the license expiring, you can switch to the free one via manager -> licensing and there is an option to switch to the free license.

See here for more detail;

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...