"License file has been revoked" ...


Folks :

A customer (with a valid contract) has experience problems with their license upgrading to the 4.2.1. Support generated a new license, but the message keeps comming back :

"License file has been revoked"

What can be done ?


Tags (2)

Splunk Employee
Splunk Employee

Since 4.2, Splunk ships with an internal and hard-coded list of revoked licenses which the product will reject. This list is updated with every maintenance release.

These licenses have been revoked after a customer request to split them into smaller chunks or merged into larger ones, which means that the purchased daily indexing volume associated with the revoked license has been reassigned to another license.

If you are unable to figure out how the daily volume of a given revoked license was reassigned (the valid license should be visible in your account page) or believe that your license was wrongly revoked, please open a case with Splunk support @

Splunk Employee
Splunk Employee

Arturo - email support, they're definitely the right folks to sort this out for you

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!