forwarder license expired

[mmattek]

our 4.1 forwarder license expired 2011-03-08 where to get a new one?

[gkanapathy]

Some versions of 4.1 shipped with a forwarder license that expired too soon. You can get a forwarder licenseby downloading and unpacking the most recent 4.1 release.

Don't try to get it from 4.2, as it does not come with (or require) a separate forwarder license.

[Jason]

This post contains a copy of the proper license so you don't have to download and unpack: http://splunk-base.splunk.com/answers/12167/

[mmattek]

negative.. the splunk-forwarder.license file is exactly the same as the one as splunk.license.. that has already been done.

[MarioM]

and is your forwarder still forwarded data or did it stopped?

[MarioM]

Verify the forwarder is not indexing AND forwarding.

From the GUI, you would follow these steps...

1. click Manager > Forwarding and receiving > Forwarding defualts
2. Select radio button "No" for "Store a local copy of forwarded events?"
3. click Save button

This is equivalent to outputs.conf setting:

indexAndForward = false

[MarioM]

if it doesnot index data it doesnot need license.

You just need to do the following:

a. Windows:

    # copy %SPLUNK_HOME%\etc\splunk-forwarder.license %SPLUNK_HOME%\etc\splunk.license

b.  Nix:

    # cp $SPLUNK_HOME/etc/splunk-forwarder.license $SPLUNK_HOME/etc/splunk.license