When your splunk license expires, if it’s personal dev license or any other type, and you are greeted with error
Splunk.License: failed to add because: cannot add lic w/ subgroupId=DevTest:xxxxxx@xxxxx.com to stack w/ subgroupId=ProductionThat means you need to remove your current license from the command line because GUI isn’t enough.
Go to your Splunk binaries folder in Splunk installation folder – In my case /opt/splunk/bin
Search for expired licenses, especially free tier
./splunk list licenses
You will see something like this
root@ravisplunk:/opt/splunk/bin# ./splunk list licenses
991E27D8CD115F60A620E52948A66C629689A09954FC25499AC8D4C9B126D391
allowedRoles:
assignableRoles:
creation_time:1719212400
disabled_features:
LDAPAuth
MultisiteClustering
SearchheadPooling
UnisiteClustering
expiration_time:1735113599
features:
Acceleration
AdvancedSearchCommands
AdvancedXML
Alerting
ArchiveToHdfs
Auth
ConditionalLicensingEnforcement
CustomRoles
DeployClient
DeployServer
FwdData
GuestPass
KVStore
LocalSearch
MultifactorAuth
NontableLookups
RcvData
RollingWindowAlerts
SAMLAuth
ScheduledAlerts
ScheduledReports
ScheduledSearch
ScriptedAuth
SigningProcessor
SplunkWeb
SubgroupId
SyslogOutputProcessor
group_id:Enterprise
guid:144826CE-B124-4056-A378-E3BB294F25C3
is_unlimited:0
label:Splunk Enterprise Term Non-Production License
license_hash:991E27D8CD115F60A620E52948A66C629689A09954FC25499AC8D4C9B126D391
max_retention_size:0
max_stack_quota:18446744073709551615
max_users:1
max_violations:5
quota:53687091200
relative_expiration_interval:0
relative_expiration_start:0
sourcetypes:
stack_id:enterprise
status:EXPIRED
subgroup_id:DevTest:xxxxxx@xxx.com
type:enterprise
window_period:30Remove expired free license by license_hash
./splunk remove licenses 940D1E309BADA73B8A2AA167186F025F3E0086CD0A7C7B859447C97E2118F37B
Add new dev license (that you got via email and scp to your server)
./splunk add licenses /home/ravi/Splunk.License
After that all that is left is to restart Splunk and enjoy it again!
./splunk restart