Licence Problem? / Cisco IronPort WSA SingleSource Licence not used

[hheile]

Hello,

i've created a splunk Server to analyze my ironport logs.
i always recieve licence Messages like Pool Limit exeded.

so, why is my pool not used?

Cisco IronPort WSA SingleSource 150.000 MB 19.01.2038 04:14:07
used space: 0%

means, the 150 GB Licence is NEVER used.
how can i fix this?

[yannK]

Please double check all those points, verify on the "manager/settings > licensing" page

• make sure that you have a special splunk license for cisco ironport, and that it is installed on the search-head.
• that the license is in a pool
• that your server is member of this pool
• if you have license-slaves (indexers usually), verify that they are also member of this pool
• and finally that the cisco data is using the correct sourcetypes required for this license. (see in the license file)