Issue with splunk reset license

[keerthana_k]

Hi,

We have a distributed Splunk deployment with a license master and 5 indexers connecting to it. We have recently added a fixed sourcetype enterprise license. After that we found that indexers were not added to the pool automatically. Due to this, we faced 5 license violations. We obtained the Splunk reset license and applied it on the system. Now the search functionality has been restored. However, we found that data got ingested into the reset license which does not have any volume and hence once more license warnings have started appearing. We deleted the reset license and manually added the indexers to the pool under the fixed sourcetype enterprise license but we find that the indexing volume is not updated in the pool.

Can anybody help me with this issue.

Thanks in advance,
Keerthana

[strive · Accepted solution]

Hi Keerthana,

If your fixed sourcetype license is wildcard based then you should have Splunk Version >= 6.3. It would be nice starting point to check your Splunk version and then upgrade it if necessary.

When the correct licenses are not available the indexers will be added under the pool whichever seems to fit the bill 🙂
In your case it was Reset License as it would not have restrictions.

Check Splunk Version and then proceed further.

Regards,
Strive