Trial license to free license poolsize=0?

[gibrich]

My trial license expired just after I left for a trip. Now that I have returned and upgraded to 6.2, I have converted to a free license, but I find that on every intervening day -- more than the limit of 3 -- I received a license violation warning: "This pool has exceeded its configured poolsize=0 bytes. A warning has been recorded for all members." I index a steady 50MB per day, yet I am locked out of Search functionality, and the documentation suggests that my only recourse is to wait until the warnings roll out of the 30-day window, because I simply didn't think to convert manually to a free license before I left.

<suggestion>It seems to me that when the trial license expires unattended, it would be very reasonable to convert it automatically to a free license for indexing volume purposes, if nothing else, to avoid this kind of total interruption of functionality. Why is this not the case? </suggestion>

Is there any other way to resolve these warnings other than waiting for a full month, since I can't afford an Enterprise license? Is there any way to get at the raw data gathered by my custom scripts from the past week while I am locked out of Search, so I can go back to manual analysis in the meantime?

[marionbates]

This is infuriating. I have uninstalled, rm -rf 'd /opt/splunk, got a new trial license for Light, installed fresh from RPM, and it STILL says "violation" -- this is on a FRESH install, no inputs defined. I'd already conceded to give up all my old data from the trial. I don't know how to resolve this. We'll have to use another tool. Would NOT recommend.

[cjj1977]

I had a similar problem, converting from a Splunk Light license to a Free one, which I was prompted to do when I logged in after the Light license expired. Although the conversion seemed to work automatically, and I verified this in the System | License information screen, I still wasn't able to search.

In my case I left things alone for a few days and then when I checked 5 days later I was able to search, so you won't have to wait a full month. Seems to be that you have to wait between 1-5 days. I can't be more precise that that.

[grijhwani]

No way without intervention from Splunk sales support.