THIS!
http://i.imgur.com/HVZ0P5k.jpg
I forgot to change the licence type and now I am locked out for a month!
What can i do?
If you contact your sales rep or support@splunk.com they often can help you get a reset license key fairly quickly.
This isn't an enterprise copy (this is a single node install) I can't call their licencing department to reset it... At least I don't think.
I will do so anyway.
(Edit: I'd like to to point out that this abrasive answer was posted in response to the original posting that Splunk was BS because he had allowed the licence to expire, forgotten to change it, and got locked out - all of which is expected behaviour if one bothers to read the documentation. The question has since been edited by others to be rather less abrasive.)
YOU allowed the licence expired (as the T&Cs tell you it will), YOU forgot to do something about it, YOU took 5 days to realise it had expired, and YOUR response is to throw a tantrum and dump a rant on the forum rather than seek proper help (like, oh, I don't know, reading the documentation and finding out you might be able to ask for a reset licence), and somehow that's all Splunk's fault?
Funny - with 1000s of users out there and you're having a licence problem because of your failure to manage it properly, and yet someone else is to blame.
Think again.
Actually, I assumed Splunk would work like their documentation said it would and "When your trial license expires, you will automatically be moved to a Splunk free license." But that isn't the case.
Second, your post seems more like a "tantrum" than my post did.
Third, as others have said, I did enter my contact information, I did setup my mail system and did expect Splunk to notify me on an issue.
I don't really agree with this position. Splunk should be actively communicating with the administrator whenever there are license overages, especially on sequential days.
I believe our license policy is reasonable, but our ability to communicate license problems to the administrator needs improvement.
Actual built in mail notifications to a splunk admin would be useful instead of having to log in to find out there are issues. Searches against index=_internal still work and just the right search might be able to send such an alert even if searching is down due to number of violations. I would have to play with it to come up with a specific search.