|
I had a 500 MB license on a test Instance and went above that threshold for a while before I checked it (averaging around 800 MB), and so the search disabled itself. To remedy this, I installed a 10 GB dev license, but I still can't run any searches. Error message: Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK. It shows I have one stack with 10240 MB, with one pool that is using 607 MB out of 10240 MB, and the only server in the licensing group is listed as having consumed that 607 MB, but I still can't do any searches. Restarts and a forced upgrade also failed to resolve the issue. Is there any way to fix this without waiting for however long? |
|
Once you violate your license searching will be blocked until a reset (only available to enterprise customers) is applied or you return to license compliance (30 days without exceeding the license limit). Simply applying a larger license will not restore search functionality. |
since you have an enterprise license i would suggest contacting splunk support with a screenshot. Otherwise, if you can show us a screenshot here that would also help.
It doesnt really make sense to have a license pool of 10240MB and only using 607 but still being under violation.
The only thing that comes to mind is: are you sure that the indexer that is using 607MB (and was using 800MB in the past) is under this pool? Do you perhaps have a secondary pool? (screenshot should show this clearly..)
Per your suggestion, I opened a support case (#56332) for this issue. I'll update the ticket once with any outcomes, in case anyone else experiences the same problem.