I have seen many questions about disabled due to licensing violation, but I applied a reset key and now I have this message during a search from the search head:
restricting search to internal indexes only (reason: [DISABLED_DUE_TO_GRACE_PERIOD,0])
The indexing cluster appears to be functioning and able to communicate to the license server on the search head. I am still unable to get back to normal searching after a licensing violation.
Any ideas? I will call Splunk tomorrow and ask support directly and post back.