Installation

Why do I get license violations on LWFs with the forwarder license?

chris
Motivator

We have license violations on a couple of our LWFs allthough I think they are set up with the correct forwarding license. The peak usage on most of them is around 4 MB. Is there a possibility to anaylyze this? Will the LWFs stop forwarding data once a threshold is reached?

Thanks for helping me

Chris

This is the output on the shell from one of the forwarders:

admin@lwf /opt/splunk
$ cat etc/splunk.license
forwarder@splunk.com;RV75Gkp9e37JQYTcBsllG+bUSUqGmAud3KqtF48TIIBny6XkjbQjGMzNg1/ 9TkDh5pgaqgpZ8idLCEYstbBph5q2VBYWfnWJpC42dPcmfzlkQcaR7MhSbMeK6P4EjEvbE4xH6tvdbfq ukQCg7N8rY0x/4YX9bKD/jhq0ETWFm1P74wyt6ZfBSdrT/J1midPvZEWIPN6ivoyYQMVNoYJHZDIyFzZ KprYLmLmbZamBrgYsm6rV+JrmUS0l/ltU0DWhaiLVdcF3iUWthgUlSZebGSSn7Wh+efs3XhD3kerwCGs Nr1dv+P4rmD7rcWhTvWexuh0u2/985QihMnZgwYwUNg==

admin@lwf /opt/splunk
$ bin/splunk show license
Current Daily Usage Amount: 0
Expiration date: 2011-03-08T07:07:37+0100
Expiration State: ok
License level: 1 MB
Product: Enterprise
License violations:
2010-11-11T00:02:42+0100 License violation #12
2010-11-08T00:00:05+0100 License violation #11
2010-11-05T00:00:03+0100 License violation #10
2010-11-02T00:05:00+0100 License violation #9
2010-10-31T00:04:58+0200 License violation #8
2010-10-28T00:04:55+0200 License violation #7
2010-10-25T00:04:54+0200 License violation #6
2010-10-23T00:04:53+0200 License violation #5
2010-10-20T00:04:45+0200 License violation #4
2010-10-17T00:04:41+0200 License violation #3
2010-10-14T00:04:38+0200 License violation #2
2010-06-09T00:02:52+0200 License violation #1
Max Violations:
Peak usage: 4 MB
Days remaining: 116 day(s)
Violation Period:

admin@lwf /opt/splunk
$ bin/splunk display local-index
Local indexing is disabled.

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

Your forwarder license is expired...

on 4.1.* please use this fix.
http://splunk-base.splunk.com/answers/12167/why-is-the-license-on-the-forwardersearch-head-displayin...

on 4.2.0, upgrade to 4.2.1 or above.
otherwise change your license group to "forwarder"
(remove the file $SPLUNK_HOME/etc/licenses/enterprise/splunk.license )

View solution in original post

yannK
Splunk Employee
Splunk Employee

Your forwarder license is expired...

on 4.1.* please use this fix.
http://splunk-base.splunk.com/answers/12167/why-is-the-license-on-the-forwardersearch-head-displayin...

on 4.2.0, upgrade to 4.2.1 or above.
otherwise change your license group to "forwarder"
(remove the file $SPLUNK_HOME/etc/licenses/enterprise/splunk.license )

shanleyj
Explorer

I am seeing the same behaviour. It seems to have occurred after I switched to load balancing between a pair of Splunk Indexers.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...