Splunk trial version 50GB

[kmalek826]

Hi ,

I got the 50 GB license , but when applying the license file it errors out with “Bad Request — In handler 'licenses': Splunk.License: failed to parse license because: Feature="SubgroupId" is unrecognized.” Any idea what may cause that .

Thank you
Khaled

[ddrillic · Accepted solution]

An identical error message with Splunk 6.2 at "failed to parse license because feature="SubgroupId" is unrecognized" when apply dev/test license

[acharlieh]

The 50GB Dev/Test trial license available from https://www.splunk.com/en_us/resources/personalized-dev-test-licenses.html is only for instances of Splunk 6.5.0 or higher. Does the Splunk instance you're attempting to install it on meet this version requirement?

This is mentioned in the FAQ: https://www.splunk.com/en_us/resources/personalized-dev-test-licenses/faq.html

[kmalek826]

Thank you so much Acharlieh for the detailed information, it works as expected after reinstalling the correct Splunk ver 6.5.0 and build 59c8927def0f , it has effective daily volume of 50GB , that's huge 🙂
Khaled

[kmalek826]

Yes, the version is Enterprise 6.5 , I requested the 6 months trail license and received via email , the error and fail to upload the license key , so it doesn't activate the 50GB
Thanks

[acharlieh]

The only way I have been able to reproduce the error you are describing is to install a version of Splunk prior to 6.5.0 and attempt to upload my dev/test license. To confirm you are in fact on a 6.5.0 or higher version of Splunk Enterprise, on the page where you're attempting to upload your dev/test license... in the lower left corner there is an "About" link. Clicking this will tell you the exact version of Splunk and the build identifier as well.

If you are on the release of 6.5.0 this build identifier should be 59c8927def0f. If your version number or build number are not this, then you should go to http://get.splunk.com and download and reinstall. (6.5.1 when released will have a different build number, but it is not released as of this writing so what that would be is unknown).

Where the error you are describing comes from, is that if open your issued DevTest License in a text editor (it's an XML file after all), you will see there are a list of enabled Features. One of these features, which is new to version 6.5, is SubgroupId, which if you look higher in your Dev/Test license you'll see a subgroup_id element and when you successfully set up your Splunk 6.5 with your license, that same subgroup_id shows up in the title bar of your Splunk Enterprise instance. Versions of Splunk prior to the release of 6.5.0 do not know about this feature, and thus produce the error you describe when you attempt to install this license