Installation

Why do I get license violations on LWFs with the forwarder license?

chris
Motivator

We have license violations on a couple of our LWFs allthough I think they are set up with the correct forwarding license. The peak usage on most of them is around 4 MB. Is there a possibility to anaylyze this? Will the LWFs stop forwarding data once a threshold is reached?

Thanks for helping me

Chris

This is the output on the shell from one of the forwarders:

admin@lwf /opt/splunk
$ cat etc/splunk.license
forwarder@splunk.com;RV75Gkp9e37JQYTcBsllG+bUSUqGmAud3KqtF48TIIBny6XkjbQjGMzNg1/ 9TkDh5pgaqgpZ8idLCEYstbBph5q2VBYWfnWJpC42dPcmfzlkQcaR7MhSbMeK6P4EjEvbE4xH6tvdbfq ukQCg7N8rY0x/4YX9bKD/jhq0ETWFm1P74wyt6ZfBSdrT/J1midPvZEWIPN6ivoyYQMVNoYJHZDIyFzZ KprYLmLmbZamBrgYsm6rV+JrmUS0l/ltU0DWhaiLVdcF3iUWthgUlSZebGSSn7Wh+efs3XhD3kerwCGs Nr1dv+P4rmD7rcWhTvWexuh0u2/985QihMnZgwYwUNg==

admin@lwf /opt/splunk
$ bin/splunk show license
Current Daily Usage Amount: 0
Expiration date: 2011-03-08T07:07:37+0100
Expiration State: ok
License level: 1 MB
Product: Enterprise
License violations:
2010-11-11T00:02:42+0100 License violation #12
2010-11-08T00:00:05+0100 License violation #11
2010-11-05T00:00:03+0100 License violation #10
2010-11-02T00:05:00+0100 License violation #9
2010-10-31T00:04:58+0200 License violation #8
2010-10-28T00:04:55+0200 License violation #7
2010-10-25T00:04:54+0200 License violation #6
2010-10-23T00:04:53+0200 License violation #5
2010-10-20T00:04:45+0200 License violation #4
2010-10-17T00:04:41+0200 License violation #3
2010-10-14T00:04:38+0200 License violation #2
2010-06-09T00:02:52+0200 License violation #1
Max Violations:
Peak usage: 4 MB
Days remaining: 116 day(s)
Violation Period:

admin@lwf /opt/splunk
$ bin/splunk display local-index
Local indexing is disabled.

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

Your forwarder license is expired...

on 4.1.* please use this fix.
http://splunk-base.splunk.com/answers/12167/why-is-the-license-on-the-forwardersearch-head-displayin...

on 4.2.0, upgrade to 4.2.1 or above.
otherwise change your license group to "forwarder"
(remove the file $SPLUNK_HOME/etc/licenses/enterprise/splunk.license )

View solution in original post

yannK
Splunk Employee
Splunk Employee

Your forwarder license is expired...

on 4.1.* please use this fix.
http://splunk-base.splunk.com/answers/12167/why-is-the-license-on-the-forwardersearch-head-displayin...

on 4.2.0, upgrade to 4.2.1 or above.
otherwise change your license group to "forwarder"
(remove the file $SPLUNK_HOME/etc/licenses/enterprise/splunk.license )

shanleyj
Explorer

I am seeing the same behaviour. It seems to have occurred after I switched to load balancing between a pair of Splunk Indexers.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...