Since 4.2, Splunk ships with an internal and hard-coded list of revoked licenses which the product will reject. This list is updated with every maintenance release.
These licenses have been revoked after a customer request to split them into smaller chunks or merged into larger ones, which means that the purchased daily indexing volume associated with the revoked license has been reassigned to another license.
If you are unable to figure out how the daily volume of a given revoked license was reassigned (the valid license should be visible in your splunk.com account page) or believe that your license was wrongly revoked, please open a case with Splunk support @ http://www.splunk.com/index.php/submit_issue
