Installation

Strange license pool warning

wrangler2x
Motivator

I was looking at Manager -> Licensing this morning and I have this warning:

1 pool warning reported by 1 indexer    correct by midnight to avoid violation

If I drill into that I see this:

Severity    Time    Message Indexer Pool    Stack   Category
Correct by midnight to avoid violation Learn more    This pool contains slave(s) with 1 warnings    mylicensemasterhost-splunk  UCI_OIT_Security    enterprise  pool_warning_count

Yet the pool for my indexer shows only 1.167 MB (11.625%) and my only slave pool (200 MB) is showing zero.

I have two 5,120 MB licenses (10GB).

Why is the warning there?

Labels (1)
0 Karma

wrangler2x
Motivator

I had this happen again recently and I figured-out what was happening. The warning was issued sometime between when I went home and midnight. It was caused by another Splunk indexer on my campus to whom I am providing 200 MB of my license -- thus their system is a slave. They had something go nutso and went over their 200 MB, which generated the warning. When I saw it the next day, I went to take a look at the licensing and saw today's (the next day's) statistics, which of course were fine.

To see what is going on the day before, go to your base URL for your indexer/master, and add /en-GB/manager/search/licenseusage#historyTab to it (i.e., https://splunk-url:splunkport/en-GB/manager/search/licenseusage#historyTab). Then click on the *Previous 30 days tab. There is a drop-down labled Pool and there find the slave pool in question and select it.

You'll get two graphs. The top one is actual usage, in GB, and the bottom one is percentage used. Look for the bar that goes above 100% and that's the slave violation.

0 Karma

derek7128
New Member

Did you ever find out? I am getting a similar error message.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...