How can I log in to update an expired Splunk license?

[ekzp]

Hi, I have a Splunk installation running on a Windows 2016 Server.

it looks like the 60-day trial license expired. The advice is to log in as an administrator to update the license. I'd happily do it, but I can't log in anymore. I am getting the following error: "Login failed. Your license is expired. Please login as an administrator to update the license." — I am using the one and only "admin" account. The password hasn't changed.

I tried to move the passwd file and use admin/changeme as suggested in many posts, however I am getting the same result.

I also noticed that the Splunk Web service has stopped. I'm wondering whether it is related to the expired license. I attempted to start it manually, but it stopped again within 20 seconds, saying that the service didn't respond for 300,000 milliseconds. It bailed out just after some 20 seconds — how on earth can it say that when it didn't respond for 300,000 milliseconds????

My problem is that the licenses expiration triggered some weird and unexpected behaviour, I am locked out, I have no way to update the license, and I can find no working answer.

It looks like a chicken-and-egg problem: I need to log on to fix it, which I can't because Splunk locked me out because the license expired.

How can I log in again to update the license?

Thank you.

[ekzp]

Found the answer at https://answers.splunk.com/answers/51245/heavy-forwarder-change-trial-license-to-forwarder-license-c....

Swapped to Free license and I am logged on to the web GUI again.

Thanks dkeck, you saved the day. Tried to award points but the portal didn't let me to - sorry...

[dkeck · Accepted solution]

Hi,

just a thought, did you try managing the license via CLI? This way you might can go around using the UI

https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/LicenserCLIcommands