Installation

Event count is different after upgrading from a Free to Enterprise license

Ellen
Splunk Employee
Splunk Employee

We recently purchased Splunk and upgraded from a Free license to an Enterprise license.
After I installed the new license and restarted some of our indexes did not appear in the UI and our summary page shows a smaller event count.
What happened? All I did was install a new license?

Tags (3)
1 Solution

Jaci
Splunk Employee
Splunk Employee

The Splunk Free license is a single user product that does not use authentication or access controls. Indexes created with the Free license are not searchable because under the Enterprise license the admin role does not have permission.

To resolve this go to manager>>Access Controls>>Roles>>Admin and add the missing indexes to the "Indexes searched by default" list of selected indexes.

View solution in original post

paulahoffman
Explorer

Similar issue. I was using a temp Ent license. When it expired I installed a new Ent license and removed the temp license.

A couple of weeks later I found that the 'earliest event' under Manager/Indexes for this index was the same day I upgraded the license. I was unable to find any data other than 'summary_host' events for systems I searched for.
My system has multiple indexers. The searchhead was already configured as you suggested for the Manager/AccessControls/Roles/Admin to use the index. I updated an indexer to the same settings for Admin. However, the 'earliest event' did not change on the indexer.
Is the previous data (using the temp Ent license) still on the indexers or was it purged during the license update?
Thanks

0 Karma

Jaci
Splunk Employee
Splunk Employee

The Splunk Free license is a single user product that does not use authentication or access controls. Indexes created with the Free license are not searchable because under the Enterprise license the admin role does not have permission.

To resolve this go to manager>>Access Controls>>Roles>>Admin and add the missing indexes to the "Indexes searched by default" list of selected indexes.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...