Hi,
I installed a heavy forwarder on a box and, after a while, I found out that license was not working. ( By mistake, I forgot to change the license type to forwarder and instead ran it under enterprise trial license. )
Indexer name server-name
License expiration xxx x, xxxx 4:00:04 AM
Licensed daily volume 1 MB
Volume used today 0 MB (0% of quota)
Warning count 0
So, I contacted splunk and got the reset license and applied it. But, now after reboot I get the same message and my data doesn't show up in indexer. I am sure that they have an established connection because when I check for open ports they have a live connection.
Don't know what problem could be. Any idea? Thanks!
It sounds like forwarding is not enabled or working. You should run the following search on the indexer to see if it has even connected:
index=_internal source=*metrics.log tcpin_connections | timechart count by sourceIp
If there are no events, then it is likely your forwarder is not configured properly. you should then examine your outputs.conf settings and inputs.conf settings.
It sounds like forwarding is not enabled or working. You should run the following search on the indexer to see if it has even connected:
index=_internal source=*metrics.log tcpin_connections | timechart count by sourceIp
If there are no events, then it is likely your forwarder is not configured properly. you should then examine your outputs.conf settings and inputs.conf settings.