I am working on a splunk instance which was already in use by some engineers. and i want to migrate it to 5.x. can u clear these doubts for me?
1. I doubt splunk had an enterprise license? But now i can see only Produce:free ,and Days remaining:8763 days, how can I infer whether i was a paid instance or free from beginning?
2. There isn't any credentials provided to the instance.. servername(ipaddr):8000 is directly loading the splunk instance. when i checked the access Access Controls/Authentication methos/authoverview I could see an error in the page, and couldn't able to find out how it is done.
3. UnboundLocalError: local variable 'msgid' referenced before assignment.... this is the error mentioned above..
4. the splunk instance is in 4.x
As i am new to Splunk I am expecting your help...
Check under the Manager tab Bella. Your license status will show there...which I suspect you may have found. If it says a free licence then they must have let it roll over from the trial state to free, together with the limitations. There is documentation available for this. If you bought an enterprise licence then you ot the engineers would or should have applied the key...and that would be visible too.
Re 2. If you mean access credentials - no it won't have under the free license.
Re 3. Will check that error message
Re 3. Not entirely sure, but I'd start looking at what event types and look up tables may have been created by them....and whether the latter are still visible to you. Then check your local version of props.conf to see if some source types were defined, which are no longer available.
thanks Dave,Ayn . You are right. I tried installing a free license in. my box. And it is accessable without credentials
So 4.x instance, it can be the one that was moved from enterprise trial license to free license?
Then if I am installing a 5.x instance, is there any option to remove credentials?