I have a perpetual Enterprise license and having not been having any issues until the today when I started to see a message displaying my license is expiring in 7 days. I noticed that the license expiration is showing March 7, 2011. What do I need to do to get this fixed?
asked 02 Mar '11, 02:23
If your current splunk.license key has a prefix of "firstname.lastname@example.org;", you have encountered a known issue (SPL-31628) where a splunk-forwarder.license is associated with an expiration date of 2011-03-07 and your current splunk.license is a copy of this license key.
The splunk.license key will have a key prefix similar to:
This has been fixed as of 4.1.4 with an updated splunk-forwarder.license file with a new expiration date for the key. eg. 2020-06-08
In many cases,the splunk.license file on a forwarder (lightweight) or dedicated search head instance is just a copy of the splunk-forwarder.license located in $SPLUNK_HOME/etc under *Nix and on Windows at %SPLUNK_HOME%\etc
Similar to license volume violations, an expired license will prevent searching but indexing continues.
Searching will be available once the license issue is resolved.
In some environments while the Splunk version may have been upgraded to 4.1.4 and above, it is possible the splunk.license on the forwarder/search head instance was never manually updated with the
Options to resolve:
1) if you have a Splunk version 4.1.4 and up already installed, simply copy the splunk-forwarder.license to be the new splunk.license on your forwarder/search head instance where the expiration message is displayed and restart Splunk
a) via SplunkWeb > Manager > License > Change License and replace the existing with the key below and restart Splunk
If you happen to see "Your license is expired" at the login screen, you can follow Option (1) above or continue with an admin login > select Enter a new license number > Continue > replace the existing email@example.com license content with the above > select Save. Proceed to restart Splunk.
If you continue to have license expiration issues, please log a Support case and include the license key for further investigation.
The splunk instances potentially concerned are :
ONLY If they are using an old copy of the splunk-forwarder.license in splunk.license unfortunately, an old installation will keep the existing license, and an upgrade of splunk will not fix the license.
to upgrade the license on each of your forwarders to a new one expiring in 2020.
be careful not to erase the genuine license file on your indexers !!!
answered 09 Mar '11, 00:48