Splunk Search

Error

SN1
Path Finder

Hello i am seeing this error
MSE-SVSPLUNKI01] restricting search to internal indexes only (reason: [DISABLED_DUE_TO_GRACE_PERIOD,0])

how to resolve this.

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @SN1 

How did you get on? Let us know if you need help diagnosing issues connecting to a licenser server (if applicable) or adding a new license.

For more info on how to add a new license check out https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/Installalicense

 

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@SN1 

The error message "DISABLED_DUE_TO_GRACE_PERIOD" typically indicates that your Splunk instance is in a grace period due to a licensing issue

  • Check License Server Connectivity: Ensure indexers can communicate with the license server.
  • Restart Splunk Services: Run splunk restart on your indexers.
  • Verify License Configuration: Ensure your license is valid and not expired.
  • Check pass4SymmKey: Ensure it matches between the license server and indexers.
  • Ensure that your Splunk indexers can communicate with the license server. This often involves checking network connectivity and DNS resolution.
  • Verify that the license server's address is correctly listed in the server.conf file on your indexers

Solved: Receiving "DISABLED_DUE_TO_GRACE_PERIOD" - Splunk Community 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @SN1 

It sounds like your license has expired or not installed correctly.

Go to https://yourSplunkInstance/en-US/manager/system/licensing and check that the license is showing as valid.

If your license isnt showing here, or if it cannot connect to your license server (if applicable) then you will need to resolve this before being able to search non-internal indexes

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...