Why is the license on the forwarder/search head displaying a message it is expiring in x days on March 7, 2011?

If your current splunk.license key has a prefix of "forwarder@splunk.com;", you have encountered a known issue (SPL-31628) where a splunk-forwarder.license is associated with an expiration date of 2011-03-07 and your current splunk.license is a copy of this license key.

The splunk.license key will have a key prefix similar to:
forwarder@splunk.com;RV75...etc.

This has been fixed as of 4.1.4 with an updated splunk-forwarder.license file with a new expiration date for the key. eg. 2020-06-08

In many cases,the splunk.license file on a forwarder (lightweight) or dedicated search head instance is just a copy of the splunk-forwarder.license located in $SPLUNK_HOME/etc under *Nix and on Windows at %SPLUNK_HOME%\etc
The license content is not operating system specific.

Similar to license volume violations, an expired license will prevent searching but indexing continues. Searching will be available once the license issue is resolved.
An expired license on a forwarder will not affect its ability to continue to process data.

Note:
Do not confuse this with a splunk.license that has your own Enterprise license email address associated with it. If your splunk.license on your forwarder/dedicated search head instance does not start with "forwarder@splunk.com;" and there is no indication of an expiration, this issue is not applicable.

In some environments while the Splunk version may have been upgraded to 4.1.4 and above, it is possible the splunk.license on the forwarder/search head instance was never manually updated with the
new splunk-forwarder.license key with the new expiration date.
Thus it has retained its previous Splunk version's license copy (eg. 4.0.x or pre 4.1.4) and is now displaying an expiration message.
While it is beneficial to upgrade to the most current Splunk version, you do not have to upgrade your forwarder/search head instance just to fix the expired license; follow one of the steps below.

Options to resolve:

1) if you have a Splunk version 4.1.4 and up already installed, simply copy the splunk-forwarder.license to be the new splunk.license on your forwarder/search head instance where the expiration message is displayed and restart Splunk
or
2) use the following key to be your new splunk-forwarder.license key and splunk.license (on the LWF or dedicated search head) via either method below:

a) via SplunkWeb > Manager > License > Change License and replace the existing with the key below and restart Splunk
or
b) via an editor, replace the existing splunk.license and splunk-fowarder.license file content with the key below and restart Splunk

forwarder@splunk.com;JbX7lUZTDqk0tPNS7I0KEEdJ2tLJh0j++r6GOsx3jcxL3/nxvzL5Zx1uNEZjvdRPsqf1jnG1LoT/t8ouO7vGP75RX5G10CjQN3ED4yaE62KXcv8z1kbLD9JE31/tN/oUORTTqp8Nshst9/hN4qne9LWlxGZBz0XlQXQLOsIx5cLQdfb8WHtQ5OpNavlFSbzDBVcbewr/4nV7EtFgXTpm4ynNuE9b/JZ9glpYsV5qUgqULm/hzR2d6gteFvv5qN5zFnNYcUHnhP2FqCiSKyovzKLmy5a3yM8S682XJ8/a7FKwiFks7+XIsMVTjFv/tDg2DfE58HuRCWqkLb37mDu/yA==

If you happen to see "Your license is expired" at the login screen, you can follow Option (1) above or continue with an admin login > select Enter a new license number > Continue > replace the existing forwarder@splunk.com license content with the above > select Save. Proceed to restart Splunk.

If you continue to have license expiration issues, please log a Support case and include the license key for further investigation.