How to use license reset key

Applicability

Description

If you encounter a search stopping due to license expiry or exceed too much license limit, a error message will appear to inform the search is stopped:

Error: [Splunk_IDX] restricting search to internal indexes only (reason: [DISABLED_DUE_TO_GRACE_PERIOD,0])
Streamed search execute failed because: Error in ‘litsearch’ command: Your Splunk license expired or you have exceeded your license limit too many times.
Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK..

Investigation

• If you encounter a search stopping due to license expiry or exceed too much license limit, a error message will appear to inform the search is stopped:

Error: [Splunk_IDX] restricting search to internal indexes only (reason: [DISABLED_DUE_TO_GRACE_PERIOD,0])
Streamed search execute failed because: Error in ‘litsearch’ command: Your Splunk license expired or you have exceeded your license limit too many times.
Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK..

• Check the license usage from the License Manager --> Settings --> Licensing
• Check the license expiry date and also for the license limits

Resolution

• Review the Splunk document on License Violation Warnings

• Contact Splunk Sales or Splunk Support to re-enable search by obtaining a license reset key

• Once you obtain the license key, follow the below instructions to re-enable the license:

1. On the License Master, open the License Manager interface via Settings → Licensing

2. Click Add License and upload the license reset key file

3. Verify the reset key appears in the license stack and search is re-enabled

4. Re-install your original Enterprise license:

   • Click Add License again

   • Upload your original Enterprise .lic file

   • Verify that both the reset key and your original Enterprise license appear in the license stack

   • If you no longer have the original license file, download it from your Splunk account at splunk.com/account or contact Splunk Sales

5. Verify the following to confirm the license state is healthy:

   • No cle_pool_over_quota warnings are present under Settings → Licensing

   • The License Manager is accepting peer connections (no This license does not support being a remote manager errors in splunkd.log)

   • License pools and stacks are correctly populated (no orphaned pools referencing empty stacks)

6. Monitor splunkd.log on the License Manager for the next 24 hours to confirm no new license warnings accumulate

Note: The license reset key only clears the accumulated warning counter and temporarily re-enables search. It does not replace or restore your original Enterprise license. Failure to re-install the original license after applying the reset key will result in loss of remote manager capability, orphaned license pools, and re-occurrence of search restrictions.