Currently I am on the 500 MB trial, but will probably move to the free license. I had exceeded the 500MB limit two days in a row, but I have made some changes in what I am eating and am now under the limit. When will the red message / indexing violation notice go away now that I am legit?
After 14 days.
EDIT: Take note of the first bolded bit... 3 more violations on your current license or 1 more on a free license and you'll be locked out...
From http://www.splunk.com/base/Documentation/latest/Installation/AboutSplunklicenses
License violations
Violations occur when you exceed the maximum indexing volume allowed for your license. If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have 5 or more violations on an Enterprise license or 3 violations on a Free license in a rolling 30-day period, search will be disabled. Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) violations in the previous 30 days or when you apply a new license with a larger volume limit.
During a license violation period:
Got License Violations? Click here to troubleshoot.
After 14 days.
EDIT: Take note of the first bolded bit... 3 more violations on your current license or 1 more on a free license and you'll be locked out...
From http://www.splunk.com/base/Documentation/latest/Installation/AboutSplunklicenses
License violations
Violations occur when you exceed the maximum indexing volume allowed for your license. If you exceed your licensed daily volume on any one calendar day, you will get a violation warning. The message persists for 14 days. If you have 5 or more violations on an Enterprise license or 3 violations on a Free license in a rolling 30-day period, search will be disabled. Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) violations in the previous 30 days or when you apply a new license with a larger volume limit.
During a license violation period:
Got License Violations? Click here to troubleshoot.