I am running Splunk 6.0.4 on linux. On the "Licensing" page, my enterprise license shows a status of "FROMTHEFUTURE" instead of "valid" like in the documentation. Why is this and what does it mean?
Also, the volume of my license is 5,120 MB but Effective daily volume is 0 MB. Why?
Any help is greatly appreciated.
Licenses are only valid after they are issued, not before. This is to prevent you from buying a license and then sending it x timeunits in the past, as that way splunk would miss out on x timeunits of license fees.
To resolve this issue just run "ntpdate pool.ntp.org".
Thank you. This solves an entire licensing issue I have been working on. Turns out my servers thought it was 2013.
I'm having the same problem but what is frustrating is two things:
1) This is a renewal license, not a beginning license. All my historic data has been collected under existing licenses.
2) Today is the day my 2014 license expires. It seems absurd to make me wait until midnight to add it.
3) How do I know its going to work? That is, how do I know the difference between "Don't worry, it will work in the morning" and a botched license file generation which means I'm flying blind for a few days while I hassle with Splunk to fix?
If everything works, it seems like unneeded stress for renewing customers. If it breaks, I am really not going to be happy and will start considering alternatives.
I seem to be showing three identical licenses (all the same size) which I'm guessing means they really all are the same license:
one good for another year (shows valid)
one good for two more years but shows FROMTHEFUTURE
Is there a way to tell from the "All license details" page if these are all the same license?
I'm guessing this means an expired license was updated for a year, then for a second year but it doesn't go in to effect until the current one finishes (as pointed out by @david.nelson-gal)