Documentation: 3.2
|  Print Version Contents
This page last updated: 04/15/08 05:04pm

License issues

If you are having trouble with your license, here are some things to look at.

Cannot login

To log in for the first time after applying an Enterprise license (converting from free), use the default username "admin" with the password "changeme". If you later clean (reset) your user data, your username/password is reset to this default.

If admin/changeme doesn't work and you just applied a new license to 3.x (not a beta,) then you may have the wrong type of license. 3.0 GA changed the license format, so previous versions (including licenses created for beta releases) do not work. A 3.x instance with a 2.x license advises you to contact support for a new license and not allow you to login with your username and password. A 2.x instance with a 3.x license only says Incorrect username or password when you try to log in.

If you are using a free license, switch to the new format license:

  • Stop Splunk
    • ./splunk stop
  • Copy your new license into $SPLUNK_HOME/etc/splunk.license or paste it into the License area in Splunk Web's Admin section.
  • Start Splunk
    • ./splunk start

If you get a message that your license is invalid, check that it was correctly installed. Ensure the key does not have any added spaces or line breaks. Also, a valid Enterprise license key begins with the email address of the original recipient from the Splunk Store and is a single line with no spaces. (The free license begins "freelicense".) It may be a bare key or be enclosed in a block of XML like this:

<license>
    <user>freelicense</user>
    <expiration-date>2017-07-17</expiration-date>
    <creation-date>2007-07-17</creation-date>
    <bytelimit>500</bytelimit>
<licenseKey>freelicense;m9LkX5oOpeie+8cCsRg9fdmI6H/A1v0LQUkHx/0SsJMxsy9dXrAcNMgjxcU8j7crCR6tdewuozjNLsGRbPXWMoQf6f5etIIYHNo/WwH/3bJ04qJiq6GikRjg8ySqjcwvaSMLGS4a3CxHtKOwivqCZ+uS1wuiKaYSSZu5DYJMCfO6eAg1xvBQ+VOSmDW3NSVpFKiImrYwmeNqNyDHgaNKCZoF6h5WMYslpk7taF1cdLCaq3tvqwnPXqVGfK9Q+CnA3/vynnA+5WWcFH6fiTgI8nYFUYayb1s5FqjKCOjDpgDsLdLtpOQsEqxJbLFoPPP1tfv8KVKS0NfzZHYZkyNLXA==</licenseKey>
    <productName>free</productName>
</license>

metrics.log

The $SPLUNK_HOME/var/log/splunk/metrics.log file contains indexing statistics like events per second and throughput for various categories. It is not a complete accounting, however. Metrics entries report the top 10 items for each group over a 30 second period. For example, if you have 20 hosts, there will be a thruput_per_host record for the top 10 hosts by size of the input raw data for each period.

License violation warning

If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have more than 7 violations in a rolling 30-day window, you will be unable to search. Search access returns when you no longer have 7 violations in the previous 30 days or apply a different license with a larger volume limit. Note that Splunk will not stop indexing your data for a license violation but only block your access to it for the period you exceed your license.

To verify your license information in Splunk Web, go to the Admin page, License & Usage tab to verify your license information. Here you can see your License Level daily usage limit, Peak Usage and other information.

If you are adding compressed files, the size of the uncompressed data is counted towards your daily volume. Also, adding custom indexed fields or adding to the raw event text (with either a transform or a custom processor) increases your indexed volume. Internal Splunk events are not counted against your licensed volume.

Advanced license troubleshooting

From the CLI, use the command

splunk show license

to see the license summary:

Product:             Splunk Server
License Level:       10240 MB/day peak indexing
Peak Usage:          0.00 GB/day
Peak %:              0.0%
Expiration Date:     01/18/2038
Time Remaining:      11112 days

This search shows the periodic license check from splunkd, from the _internal index:

index::_internal audit NOT v3

The events returned actually come from $SPLUNK_HOME/var/log/splunk/splunkd.log, so you could also search for "Audit" in the file. This can be helpful for monitoring reported indexed volume over a longer period of time than what is kept in the _internal index. The cumulative daily data indexed is totalCumulativeBytesAtRollover and todaysBytesIndexed. These audit records are generated by splunkd a few times a day, so statistics on new events will not be immediately available.

You can set some additional debugging options to monitor usage and license information.

The file $SPLUNK_HOME/etc/log.cfg controls the level of messages are created in Splunk's own logfiles, from NONE to DEBUG. You can set category.LicenseManager=DEBUG to see additional information about your license. (Restart for changes to take effect.) The output, found in splunkd.log, looks like this:

08-17-2007 07:43:27.631 INFO  LicenseManager - Checking License
08-17-2007 07:43:27.632 DEBUG LicenseManager - Checking for byte-count quota reached. byteCountSinceMeterReset=0, byteLimit=10240M
08-17-2007 07:43:27.632 DEBUG LicenseManager - Byte-count quota not exceeded.
08-17-2007 07:43:27.632 DEBUG LicenseManager - Checking for expiration...
08-17-2007 07:43:27.632 DEBUG LicenseManager - ... license has not expired
08-17-2007 07:43:27.632 DEBUG LicenseManager - checklicense returned: 0

You can also view your license status with this Python script:

import httplib
import time

def rpc(body):
   conn = httplib.HTTPSConnection('localhost:8089')
   conn.connect()
   conn.request("POST", "/rpc/", body)
   response = conn.getresponse()
   reply = response.read()
   return reply 

def main(): 
   xml = '''<call name="getLicenseInfo">
        <params>
        </params>
         </call>'''

   print rpc(xml)

if __name__ == '__main__':
   main()

Save this in a file (like "licensecheck.py") and edit the url for the management port of your instance (including http or https, as appropriate.) Then run "python licensecheck.py". The output is a block of XML containing the details of your license and current status:

<licenseInfo>
    <expirationDate>2147483647</expirationDate>
    <issueDate>1185551536</issueDate>
    <remainingTimeOnLicense>960114900</remainingTimeOnLicense>
    <timeToMeterReset>51653</timeToMeterReset>
    <currentByteCount>0</currentByteCount>
    <byteLimit>10240</byteLimit>
    <peakBytesPerDay>0</peakBytesPerDay>
    <totalBytesProcessedAtRollover>0</totalBytesProcessedAtRollover>
    <numberRollovers>3</numberRollovers>
    <byteQuotaExceededCount>0</byteQuotaExceededCount>
    <lastExceededDate>0</lastExceededDate>
    <expirationState>0</expirationState>
    <errorString></errorString>
    <previouslyKeyed>false</previouslyKeyed>
    <product>pro</product>
    <type>prod</type>
<addons></addons>
<maxViolationsHit>0</maxViolationsHit>
</licenseInfo>

I installed my license in a Preview release and now it doesn't work!

Splunk's Preview releases require a different license that is not compatible with other Splunk releases. Alternately, if you are evaluating a Preview release of Splunk, it will not run with a Free or Enterprise license. The preview licenses will typically enable Enterprise features, they are just restricted to Preview releases.

Previous: Splunkd is down    |    Next: Anonymize data samples

Comments

No comments have been submitted.

Log in to comment.