Hi Splunk team,
I have a question when I search in Splunk console. I got an issue as below:
Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK.
And I used an enterprise license. Does anyone have an idea about this case? appreciate it.
Hi @zhoayang
as you are using developer license , you might have exceed daily license limit 5 times in 30 days.
to re enable searching you need to send an email to devinfo@splunk.com
also please check your daily ingestion limit for last 30 days
once you searching reset from splunk you might need to install your developer license again
Hi @zhoayang
I guess you are using using 60 days Enterprise version, and it got expried
plese check License expiry date Settings --> Licensing
you can change to Free license
please update your license settings from following steps and select free license
Settings --> Licensing - > change license group
that will fix the issue
Hi @zhoayang
as you are using developer license , you might have exceed daily license limit 5 times in 30 days.
to re enable searching you need to send an email to devinfo@splunk.com
also please check your daily ingestion limit for last 30 days
once you searching reset from splunk you might need to install your developer license again
Hi @SanjayReddy
great!! I think it is the reason why my indexer is in violation status. I found a lot of warnings in my alert console
that said This pool has exceeded its configured poolsize=0 bytes. A warning has been recorded for all members.
Maybe I should solve this problem then I will follow your advice. appreciate It! thanks again.
Hi, @SanjayReddy
Thanks for your reply. I check the expiration time and it doesn't expire now. and I also change the license group to a free license but still have the same issue.
I also have another discovery is my indexer is in violation. does it is the reason I got this issue? how to set the indexer to normal status?
thanks for your help.
Hi @zhoayang
since your license expiration time is still due and changing to free license will not help it would still give the same error so you can switch to your earlier license. Also as highlighted by your discovery the indexer is in violation if you had more than 5 or more warning in developers license it would give this error you have to resolve the indexer violation by either stopping the ingestion of the data to that particular violating index and wait for 24 hours and it would get resolved and you can start searching again
if you have multiple sources ingesting into that problematic index then disable the source which is the major contributor
i had a similar issue with my developers license and did the same action and after 24 hours all service of splunk were resumed
Hi @venky1544
Yeah. that's correct. In the alert console, it appeared plenty of warning logs said
This pool has exceeded its configured poolsize=0 bytes. A warning has been recorded for all members.
it will cause the indexer to become in violation status.
thanks for your reply. appreciate it.