Is it normal for Splunk to issue licenses with no overlap? Getting error "failed to add because: license is from the future..."

New Member

I have two Splunk Enterprise term licenses which both expire soon (same expiry for both):
expiration_time 2015-03-11 16:59:59+10:00

My new license has the quota for both existing licenses combined.
It has the creation time set to 1426057200 ( 2015-03-11 17:00:00+10:00 )
When I attempt to add the new license I get an error:

"failed to add because: license is from the future; its active span has not begun yet"

Is it normal for Splunk to issue Licenses with no overlap?
Is there some way to add the new license in advance (I expect it to just sit there dormant until activation time)?

I find waiting for the current license to expire before loading the new license unacceptable. What will happen at the moment the license expires?

There will be no valid Enterprise licenses after the expiry - will it convert to the Free edition with no security?

If someone could please describe the usual experience when renewing licenses I'd appreciate it.


Labels (1)
Tags (3)
0 Karma


When your license expires your indexes will keep indexing but searching via search heads will stop working.

If this is a critical issue speak to your sales rep regarding this and see if you can get it reissued with a week/2 weeks inbetween.

You may be able to trick the license server into accepting the non valid license by changing its time while splunk is stopped but you'd have to stop anything from calling in while doing this (shutdown network interface or something). Start splunk, install the license (valid as your machine is in the future) then shutdown again. Correct the time and then restart splunk and i'd expect the license wouldn't be active (but still listed as installed).

It's only a guess as I havn't tried it myself.

0 Karma