Security

how to identify whether splunk had an enterprise license/ how to remove authentication for accessing splunk

bellaed
Path Finder

Experts,
I am working on a splunk instance which was already in use by some engineers. and i want to migrate it to 5.x. can u clear these doubts for me?
1. I doubt splunk had an enterprise license? But now i can see only Produce:free ,and Days remaining:8763 days, how can I infer whether i was a paid instance or free from beginning?
2. There isn't any credentials provided to the instance.. servername(ipaddr):8000 is directly loading the splunk instance. when i checked the access Access Controls/Authentication methos/authoverview I could see an error in the page, and couldn't able to find out how it is done.
3. UnboundLocalError: local variable 'msgid' referenced before assignment.... this is the error mentioned above..
4. the splunk instance is in 4.x

As i am new to Splunk I am expecting your help...
Thanks
Bella

Tags (3)
0 Karma

DaveSavage
Builder

Check under the Manager tab Bella. Your license status will show there...which I suspect you may have found. If it says a free licence then they must have let it roll over from the trial state to free, together with the limitations. There is documentation available for this. If you bought an enterprise licence then you ot the engineers would or should have applied the key...and that would be visible too.
Re 2. If you mean access credentials - no it won't have under the free license.
Re 3. Will check that error message
Br
D

0 Karma

bellaed
Path Finder

thanks Dave,Ayn . You are right. I tried installing a free license in. my box. And it is accessable without credentials
So 4.x instance, it can be the one that was moved from enterprise trial license to free license?
Then if I am installing a 5.x instance, is there any option to remove credentials?

0 Karma

Ayn
Legend

Because login is not enabled this is definitely a free license.

0 Karma

DaveSavage
Builder

Re 3. Not entirely sure, but I'd start looking at what event types and look up tables may have been created by them....and whether the latter are still visible to you. Then check your local version of props.conf to see if some source types were defined, which are no longer available.

0 Karma

DaveSavage
Builder
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...