We're on a perpetual 100G license without support.  Everything is fine as we're not using it in mission-critical operations and up until a week ago, didn't have a high volume of logs. Yesterday my reports failed because: "Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license " There was no warning until the lockout.  Then the little bell was lit up in the dashboard.   What happens if I exceed my purchased license capacity? The software will generate a warning if you exceed your licensed indexing volume on any one calendar day.   - If you exceed your daily indexing limit five or more times in a rolling 30-day period and have a license stack volume over or equal to 100 GB on Splunk Enterprise version 6.5 and above, the software will not deactivate your search functionality. Splunk Enterprise License Enforcement FAQ | Splunk .   Investigating our environment, a new data source was crazy, and exceeded 100GB/day for the last 5 days.  The crazy source was stopped, and now we're well below the threshold.  However we have 5 violations in the last 30 days, and it's going to stay that way for the next... 24 days or so. We waited a day and see that we're still locked out.   The thought of paying for Splunk support for our perpetual license because we were locked out would not sit well with senior management.  From what I read in the Splunk docs (above), a perpetual license 100GB+ is not supposed to lock out like this.  Our options seem to be: Reinstall Wait Pay to tell support that the license enforcement went crazy and we need them to unbreak it Are there any other tricks? ---- Update:  A colleague was able to get somebody at Splunk to correct the situation.   Thanks for everyone's input.  We're putting some additional monitoring in place.   ... View more