Why am I receiving this license error?

[zhoayang]

Hi Splunk team,

I have a question when I search in Splunk console. I got an issue as below:

 Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK.

And I used an enterprise license. Does anyone have an idea about this case? appreciate it.

[SanjayReddy]

Hi @zhoayang 

I guess you are using using 60 days Enterprise version, and it got expried

plese check License expiry date Settings --> Licensing 

you can change to Free license 
please update your license settings from following steps and select free license 

Settings --> Licensing - > change license group

that will fix the issue

[zhoayang]

Hi @SanjayReddy 

Sorry forget to list the snapshot. it shows the license doesn't expire.

[SanjayReddy · Accepted solution]

Hi @zhoayang 

as you are using developer license , you might have exceed daily license limit 5 times in 30 days.

to re enable searching you need to send an email to devinfo@splunk.com 

also please check your daily ingestion limit  for last 30 days 

once you searching reset from splunk you might need to install your developer license again 

[zhoayang]

Hi @SanjayReddy 

great!! I think it is the reason why my indexer is in violation status. I found a lot of warnings in my alert console 

that said This pool has exceeded its configured poolsize=0 bytes. A warning has been recorded for all members.

Maybe I should solve this problem then I will follow your advice. appreciate It! thanks again.

[zhoayang]

Hi, @SanjayReddy

 Thanks for your reply. I check the expiration time and it doesn't expire now. and I also change the license group to a free license but still have the same issue. 

I also have another discovery is my indexer is in violation. does it is the reason I got this issue? how to set the indexer to normal status?

thanks for your help.

[venky1544]

Hi @zhoayang 

since your license expiration time is still due and changing to free license will not help it would still give the same error so you can switch to your earlier license. Also as highlighted by your discovery  the indexer is in violation if you had more than 5 or more warning in developers license it would give this error you have to resolve the indexer violation by either stopping the ingestion of the data to that particular violating index and wait for 24 hours and it would get resolved and you can start searching again

if you have multiple sources ingesting into that problematic index then disable the source which is the major contributor 

i had a similar issue with my developers license and did the same action and after 24 hours all service of splunk were resumed

[zhoayang]

Hi @venky1544 

Yeah. that's correct. In the alert console, it appeared plenty of warning logs said

This pool has exceeded its configured poolsize=0 bytes. A warning has been recorded for all members.

it will cause the indexer to become in violation status.

thanks for your reply. appreciate it.