Why "search" still disabled after renewed a larger license?

[sonicant]

Hi Splunk,

Recently we meet the issue of license limit but we did not notice this until we triggered the license violations for 7 times. So the search function was disabled, with a warning message on the top of the browser - "reached the maximum license violations for this time period". Today I updated the license from default trial license (500MB) to 5GB, and restarted splunk, but the search still disabled and we are continuing get this message.

Here is the new license info:

# ./splunk show license
Splunk username: admin
Password: 
Current Daily Usage Amount:     1844873670
Expiration date:                2010-09-29T13:30:42+0800
Expiration State:               ok
License level:                  5120 MB
Product:                        Enterprise
License violations: 
                2010-08-31T00:00:28+0800 License violation #7
                2010-08-30T00:04:20+0800 License violation #6
                2010-08-29T00:00:21+0800 License violation #5
                2010-08-28T00:00:53+0800 License violation #4
                2010-08-27T00:03:06+0800 License violation #3
                2010-08-26T00:01:19+0800 License violation #2
                2010-08-21T00:03:35+0800 License violation #1
Max Violations:                 5
Peak usage:                     3526 MB
Days remaining:                 29 day(s)
Violation Period:               30

And the error message always there: Error in 'UnifiedSearch': Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK.

Please help us! Thanks in advance!

Soni Jin Netis Technologies

[NightWa]

I ran into the same problem, did ./splunk clear all, and the problem was solved. thank you very much!

[neaves777]

None of these commands work.
E:\Program Files\ELO\bin>splunk show license
This command has been removed.

E:\Program Files\ELO\bin>splunk clear all

Command error: 'clear' is not a valid command. Did you mean the 'clean' command?

(NO I didn't mean 'clean')

[Brian_Osburn · Accepted solution]

Contact Splunk support and they should be able to get you a key that will reset the violations.

Brian

[sonicant]

Thanks Brian, I did a ./splunk clear all, then the lock went away~