Installation

License File - how know which license to remove from the License server

kcooper
Communicator

we have purchased a number of licenses over the years. The names of the files are pretty much the same except a number was added at the end of the name. (See example 1 below). we need to give 3 - 1 GB licenses to our Information Security group for their own Splunk enterprise environment. How do i know which license i need to remove from the license server? I would like to give the following licenses (see list of some of our files on the Splunk License server below) to them but how do I know which licenses to delete from the license server and which files those would be in the /opt/splunk/etc/license/enterprise directory (example 1 shows a list of files) . We have several other licenses that are 1,024 MB as well so it isn't like there are only 3 - 1 GB licenses.
ANy help is appreciated.

List from the LIcense server console
Licenses Volume Expiration Status
Splunk Enterprise 1,024 MB Jan 18, 2038 10:14:01 PM valid Delete
Splunk Enterprise 1,024 MB Jan 18, 2038 10:14:01 PM valid Delete
Splunk Enterprise 1,024 MB Jan 18, 2038 10:14:01 PM valid Delete

EXAMPLE 1
/opt/splunk/etc/licenses/enterprise
[root@splunklicbsrv01 enterprise]# ll
total 248
-rw------- 1 splunk splunk 362 Jun 6 2018 C:\Documents and Settings\jkamdar\Desktop\splunk.license
-rw------- 1 splunk splunk 1385 Jun 6 2018 FMX_splunk.license
-rw------- 1 splunk splunk 1386 Jun 6 2018 splunk-1.license
-rw------- 1 splunk splunk 1386 Jun 6 2018 splunk-20gb-Aug-2013.license
-rw------- 1 splunk splunk 1386 Jun 6 2018 splunk-2-1.license
-rw------- 1 splunk splunk 1386 Jun 6 2018 splunk-2.license
-rw------- 1 splunk splunk 1385 Jun 6 2018 splunk-3.license
-rw------- 1 splunk splunk 1384 Jun 6 2018 splunk-4-1.license
-rw------- 1 splunk splunk 1384 Jun 6 2018 splunk-4.license
-rw------- 1 splunk splunk 1385 Jun 6 2018 splunk-5.license
-rw------- 1 splunk splunk 1384 Jun 6 2018 splunk-9.2-rcf-1.license
-rw------- 1 splunk splunk 1384 Jun 6 2018 splunk-9.2-rcf.license
-rw------- 1 splunk splunk 1541 Sep 13 2018 SplunkCSOC.20180913.00541060.lic
-rw------- 1 splunk splunk 1385 Jun 6 2018 splunk.license
-rw------- 1 splunk splunk 1416 Jun 6 2018 Splunk.License-1-1.lic
-rw------- 1 splunk splunk 1416 Jun 6 2018 Splunk.License-1.lic
-rw------- 1 splunk splunk 1416 Jun 6 2018 Splunk.License-2.lic
-rw------- 1 splunk splunk 1416 Jun 6 2018 Splunk.License-3-1.lic
-rw------- 1 splunk splunk 1416 Jun 6 2018 Splunk.License-3.lic

Labels (1)
0 Karma

oscar84x
Contributor

These files are in XML. If you open it with an editor you can identify details like the size of the license (quote, in Bytes) and creation and expiration dates (in epoch time).

0 Karma

kcooper
Communicator

True but how do i know which ones to delete from the license gui (console). they are all named the same:
ex
Licenses volume expiration
Splunk Enterprise 1,024 MB Jan 18, 2038 10:14:01 PM
Splunk Enterprise 1,024 MB Jan 18, 2038 10:14:01 PM
Splunk Enterprise 1,024 MB Jan 18, 2038 10:14:01 PM

No way to know which ones to delete

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...