Splunk license exceeded

[ukothan_78]

we run in an issue with the Indexer ... if there are 5 Times an drop of the max day volume .. the indexer will be disable ... what is the case now with our installation 

Error in tsats command: your Splunk license expired or you have exceeded license limit too many times.  Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK

The license is now free and no way back to Enterprise trial , there is no way back  when the license is expired.

[PickleRick]

And there is no going back to trial license. It is by design.

Also remember that while searching is blocked, your environment is indexing so on the one hand you're not losing data but on the other - you might be still generating violations...

[richgalloway]

Once you've exceeded the ingest limit five times you are in violation of the free license and Splunk will only let you search the internal indexes.  The fix is to wait for the violations to expire (about 30 days, IIRC) or buy a license.