Security

License Error when saving Alert (Valid license)

philwhite
New Member

I am currently running Splunk 6.4.1 and I am tied into our license master but I am getting a licensing message on one of my search heads when saving an Alert. "This scheduled search will not run after the Enterprise Trial License expires". Our license is valid and I am getting no errors on the indexers about exceeded volume, etc. I do not have access to our license master so I can't easily verify what is going on, on that end. Is there anything that I can check so that I don't hit a brick wall in 50 days when it may or may not expire my license?

Tags (1)
0 Karma

philwhite
New Member

Unfortunately this search does not work on our search head. Thanks.

0 Karma

mcronkrite_splu
Splunk Employee
Splunk Employee

You are probably operating inside of a search head cluster. If so, try using curl to access the REST endpoints against the literal name of one of the search heads. For example: instead of going to https://mysplunk.company.com, go to https://mysearchhead01.company.com via Curl like this

curl -k -u alice:pass https://mysearchhead01.company.com/servicesNS/alice/myapp/saved/searches/mysearch \
        -d search="index=mai*"
0 Karma

phadnett_splunk
Splunk Employee
Splunk Employee

Hi philwhite, try using this search to find out if/when your license is expiring:

|rest /services/licenser/licenses | eval created=strftime(creation_time,"%m/%d/%y %H:%M:%S")| eval expires=strftime(expiration_time,"%m/%d/%y %H:%M:%S") | eval "size (GB)" = round(quota/1024/1024/1024, 3) | table status, "size (GB)", created, expires, label

You can always hit the rest endpoint to for the same information:
http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTlicenseExamples

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...