Hi novoferm
For understand this let read Splunk-6.1.1-Admin manual
p93 (Free License)
P110 (What About Violations and Warnings)
P112 (How To Avoid License Violation and correcting License warning)
NOTE : Search this manual in splunk Documentation
Hello,
Searching is locked yet after 2 days waiting.
How many time is the lock time?
best regards
Hello,
It takes 30 days to release the lock from the search.
Best regards
It's possible to unlock before the 30 days?
With a normal license you can request a reset license from Splunk.
But because you use a free license Splunk will not give a reset key.
Best solution is to buy a license key.
OK thanks.
I will wait 30 days.
Best regards
Hello,
Sorry I have read the manual but I can't resolve my licence problem.
Could you help me please, to install again a free licence without exceed this limit.
The quick answer is that it is your job to ensure that you don't send too much data to Splunk and go over the free license limit. Splunk will not do it for you, and there is no way to configure it (easily) to make it so that it does.
Part of it might be you doing some regular monitoring, and shutting things off when they get too chatty. Part of it might be reducing the number of your inputs. Part of it might be writing some props/transforms configuration stanzas to reduce the size of the inputs you are taking in. Part of it might be setting up multiple Splunk servers with free licenses and directing your traffic so that none of them goes over. But there is no way to tell Splunk, "Stop indexing at the free license limit."
OK thank you for your answer.
I have reduced the number of logs in the inputs file.
Now i have just 2 servers which send the windows event log to splunk forwarder.
[WinEventLog://Application]
disabled = 1
[WinEventLog://Security]
disabled = 1
[WinEventLog://System]
disabled = 0
I think that the licence limit will be good now.
And I wait that Splunk unlock the seach task? Or I must change anything else?
Thank you a lot.
Yes, once you're locked out of searching, you either need to pay for a license or wait until the lock time is over in order to search again.
OK thank you.
Thank you for your answer.
I'll read the manuel now