Installation

License problem from Trial to Free again

machiasiaweb
New Member

Hi,

I just change splunk from Trial to Free. However, same as some other user asking, a warning messages comes out.

[EventsViewer module] Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK.

I checked the dailay volume use. There should be lower than 500MB

Licensed daily volume 500 MB
Volume used today 57 MB (11.36% of quota)

Also, I have checked other answer from here but looks cannot help me. Did any offical link can point me how to solve this problem?

Thanks!

Tags (1)
0 Karma

areguly
New Member

I am getting very similar problems. I am at 67mb today. I am looking at the historical graphs and never went over that, but I get the nagging message. Were you able to fix it?

0 Karma

Voltaire
Communicator

Try this command to check your index sizes
index=_internal earliest=-24h source=*metrics.log per_index_thruput | eval mb=kb/1024 | stats sum(mb) by series. There is also preconfigured searches that can assist you in measuring your indexes and data. YourSplunkServer/en-US/app/search/index_status
Try to limit the amount of information your splunk forwarders or Data inputs send\import to your indexer, Segregate your indexes per Data inputs. I stop all forwarders or data inputs, then sequentially enable the LWF's and data inputs to measure the license usage. Blacklist any superfluous or UN-needed data on your LWf's or Data inputs. Do you have any Apps running non-essential scheduled searches?

0 Karma

machiasiaweb
New Member

Just checked the the warning alert/warning message. It looks I have already reach the max warning/alert so it was disable the search?


1 pool warning reported by 1 indexer    Correct by midnight to avoid violation Learn more
1 pool violation reported by 1 indexer  Correct by midnight to avoid violation Learn more

Permanent

3 license window warnings reported by 1 indexer

Is there are any method to reduce the index build? by reduce the date of record can do it?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...