License issues

License issues

If you are having trouble with your license, here are some things to look at.

Cannot login

To login for the first time after applying an Enterprise license (converting from Free), use the username "admin" with the password "changeme". If you later clean (reset) your user data, this is what it will be reset to.

If admin/changeme doesn't work and you just applied a new license to 3.x (not a beta,) then you may have the wrong type of license. 3.0 GA changed the license format, so previous versions (including licenses created for beta releases) will not work. A 3.x instance with a 2.x license will advise you to contact support for a new license and not allow you to login with your username and password. A 2.x instance with a 3.x license will only say "Incorrect username or password" when you try to login.

If you were using a free license, switch to the new format license:

• Stop Splunk (./splunk stop)
• Copy $SPLUNK_HOME/etc/splunk-free.license to $SPLUNK_HOME/etc/splunk.license
• Start Splunk (./splunk start)

If you get a message that your license is invalid, check that it was correctly installed. A valid Enterprise license key begins with the email address of the original recipient from the Splunk Store and is a single line with no spaces. (The free license will begin with "freelicense".) It may be a bare key or be enclosed in a block of XML like this:

<license>
    <user>freelicense</user>
    <expiration-date>2017-07-17</expiration-date>
    <creation-date>2007-07-17</creation-date>
    <bytelimit>500</bytelimit>
        <licenseKey>freelicense;m9LkX5oOpeie+8cCsRg9fdmI6H/A1v0LQUkHx/0SsJMxsy9dXrAcNMgjxcU8j7crCR6tdewuozjNLsGRbPXWMoQf6f5etIIYHNo/WwH/3bJ04qJiq6GikRjg8ySqjcwvaSMLGS4a3CxHtKOwivqCZ+uS1wuiKaYSSZu5DYJMCfO6eAg1xvBQ+VOSmDW3NSVpFKiImrYwmeNqNyDHgaNKCZoF6h5WMYslpk7taF1cdLCaq3tvqwnPXqVGfK9Q+CnA3/vynnA+5WWcFH6fiTgI8nYFUYayb1s5FqjKCOjDpgDsLdLtpOQsEqxJbLFoPPP1tfv8KVKS0NfzZHYZkyNLXA==</licenseKey>
    <productName>free</productName>
</license>

If you have a problem applying a new license from the UI, you can also do it from the command line. Create a file splunk.license in the $SPLUNK_HOME/etc directory containing the license. Ensure the key does not have any added spaces or line breaks and then restart Splunk.

metrics.log

The metrics.log file contains indexing statistics like events per second and throughput for various categories. It is not a complete accounting, however. Metrics entries report the top 10 items for each group over a 30 second period. For example, if you have 20 hosts, there will be a "thruput_per_host" record for the top 10 hosts by size of the input raw data for each period.

License violation warning

If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message will persist for 14 days. If you have more than 7 violations in a rolling 30-day window, you will be unable to search. Search access will return when you no longer have 7 violations in the previous 30 days or apply a different license with a larger volume limit. Note that Splunk will not stop indexing your data for a license violation but only block your access to it for the period you are exceeding your license.

Go to the Admin page, License & Usage tab to verify your license information. Here you can see your License Level daily usage limit, Peak Usage and other information.

If you are adding compressed files, it is the size of the uncompressed data that is counted towards your daily volume. Also, adding custom indexed fields, creating metaevents or adding to the raw event text (with either a transform or a custom processor) will increase your indexed volume. Internal Splunk events are not counted against your licensed volume.

Advanced license troubleshooting

From the CLI, do splunk show license to see the license summary:

Product: Splunk Server

License Level: 10240 MB/day peak indexing

Peak Usage: 0.00 GB/day

Peak %: 0.0%

Expiration Date: 01/18/2038

Time Remaining: 11112 days

This search will show you the periodic license check from splunkd, from the _internal index:

index::_internal audit NOT v3

The events returned actually come from splunkd.log, so you could also search for "Audit" in the file. This can be helpful for monitoring reported indexed volume over a longer period of time than what is kept in the _internal index. For 3.0.1, the value of totalBytesAtRollover is the cumulative data indexed, for 3.0.2 and above it is totalCumulativeBytesAtRollover and todaysBytesIndexed is the daily amount. These audit records are generated by splunkd a few times a day, so statistics on new events will not be immediately available.

You can set some additional debugging options to monitor usage and license information.

The file log.cfg controls the level of messages are created in Splunk's own logfiles, from none to full DEBUG. You can set "category.LicenseManager=DEBUG" to see additional information about your license. (Restart for changes to take effect.) The output, found in splunkd.log, looks like this:

08-17-2007 07:43:27.631 INFO  LicenseManager - Checking License
08-17-2007 07:43:27.632 DEBUG LicenseManager - Checking for byte-count quota reached. byteCountSinceMeterReset=0, byteLimit=10240M
08-17-2007 07:43:27.632 DEBUG LicenseManager - Byte-count quota not exceeded.
08-17-2007 07:43:27.632 DEBUG LicenseManager - Checking for expiration...
08-17-2007 07:43:27.632 DEBUG LicenseManager - ... license has not expired
08-17-2007 07:43:27.632 DEBUG LicenseManager - checklicense returned: 0

You can also view your license status with this Python script:

from SOAPpy import SOAPProxy
def main():
   url = 'https://localhost:8089'
   namespace = 'urn:m2c-ManagementService'
   server = SOAPProxy(url, namespace)
   xml = '''<call name="getLicenseInfo">
       <params>
       </params>
        </call>'''
   print server.invokeAPI(apiData=xml)
if __name__ == '__main__':
   main()

Save this in a file (like "licensecheck.py") and edit the url for the management port of your instance (including http or https, as appropriate.) As the user who runs Splunk, set your environment with "source $SPLUNK_HOME/bin/setSplunkEnv" (include the path to your splunk/bin directory if $SPLUNK_HOME is not already set.) Then run "python licensecheck.py". The output is a block of XML containing the details of your license and current status:

<licenseInfo>
    <expirationDate>2147483647</expirationDate>
    <issueDate>1185551536</issueDate>
    <remainingTimeOnLicense>960114900</remainingTimeOnLicense>
    <timeToMeterReset>51653</timeToMeterReset>
    <currentByteCount>0</currentByteCount>
    <byteLimit>10240</byteLimit>
    <peakBytesPerDay>0</peakBytesPerDay>
    <totalBytesProcessedAtRollover>0</totalBytesProcessedAtRollover>
    <numberRollovers>3</numberRollovers>
    <byteQuotaExceededCount>0</byteQuotaExceededCount>
    <lastExceededDate>0</lastExceededDate>
    <expirationState>0</expirationState>
    <errorString></errorString>
    <previouslyKeyed>false</previouslyKeyed>
    <product>pro</product>
    <type>prod</type>
<addons></addons>
<maxViolationsHit>0</maxViolationsHit>
</licenseInfo>

Cannot access License & Usage tab

A bug in 3.0.1 may cause a "Malformed XML or SOAP" exception when attempting to access the License & Usage tab on the Admin page. Other features continue to function, as this does not crash splunkd but only causes it to return incorrect information to the UI. Version 3.0.2 resolves this issue and includes a utility to repair the corrupted hashDb file. If you experience this issue, here are the steps to resolve the problem.

Important If you are not affected by this issue, running the utility program will corrupt your hashDb/data file. Only follow these instructions if you need to resolve this specific issue. Do not run fix-hashdb-lic more than once.

First, upgrade to 3.0.2 so it won't happen again. Then:

• Stop Splunk.
• Go to the $SPLUNK_HOME/bin directory.
• "source setSplunkEnv"
• "fix-hashdb-lic /opt/splunk/var/lib/splunk/hashDb/data" (replacing "/opt/splunk/var/lib/splunk/hashDb/data" with the path to your hashDb/data file as appropriate.)
• Restart Splunk.

Note: fix-hashdb-lic does not print a message on correct invocation. The existing file will be copied to data-licfix.bak

You then should be able to correcctly access the License & Usage tab on the Admin page.

I installed my license in a Preview release and now it doesn't work!

Preview releases use a different license, regular ones are not compatible. The included Preview license enables all the Enterprise features already, so there is no need to apply a different license.

• Was this topic useful?
• Post a comment