Deployment Architecture

after converting trial to free we get error "Daily indexing volume limit exceeded."

tmichiels
Explorer

Error : Daily indexing volume limit exceeded. See License Manager for details.xLicense warning issued within past 24 hours (Fri Jan 13 00:00:00 2012 Romance Standard Time). See License Manager for details

Last 24h index status:

series sum(MB)

_internal 29.7315712415
main 8.6885786455
_audit 0.196688716

And we never hit more than 50 MB/day, so I don't get this?

Now can't do anything anymore?

What went wrong and how to solve?

Tags (1)
0 Karma

marquiselee
Path Finder

I did a 'splunk clean all' that seems to have worked for me. it will wipe all indexed data tho.

best

0 Karma

marquiselee
Path Finder

Hi, I'm running into the same warnings. Did you ever find a resolution to this?

Best

0 Karma

FRoth
Contributor

I dont remember.
What I wasn't aware of is that 5 license warnings within a period of 30 days cause splunk search to deny its service.
When the earliest warning leaves this time period, splunk search will be up again.

0 Karma

FRoth
Contributor

I got 4 license warnings in the past (all time) and tried to keep the volume as low as possible. It seems that the expired Enterprise Trial License caused another warning that led to the deactivation of the search app.
If I had known this before, I would have switched the license myself to avoid the complete deactivation.

Jan 30, 2012 12:00:00 AM
(11 hours ago) Indexing quota exceeded for this pool, poolsz=0 bytes SV010842 auto_generated_pool_download-trial download-trial license_window

Jan 25, 2012 12:00:00 AM
(5 days ago) Indexing quota exceeded for this pool, poolsz=524288000 bytes SV010842 auto_generated_pool_download-trial download-trial license_window

Jan 10, 2012 12:00:00 AM
(2 weeks ago) Indexing quota exceeded for this pool, quota=524288000 bytes SV010842 auto_generated_pool_download-trial download-trial license_window

Jan 9, 2012 12:00:00 AM
(3 weeks ago) Indexing quota exceeded for this pool, quota=524288000 bytes SV010842 auto_generated_pool_download-trial download-trial license_window

Jan 8, 2012 12:00:00 AM
(3 weeks ago) Indexing quota exceeded for this pool, quota=524288000 bytes SV010842 auto_generated_pool_download-trial download-trial license_window

0 Karma

tmichiels
Explorer

Dear Splunk,

Please give us a solution for this ?

thx

0 Karma

FRoth
Contributor

Same problem here.
We had 400 MB per day in the Enterprise Trial License Period and switched this weekend.

Splunk throws this error although we did not hit the 500 MB limit.

Murphy's Law because we planned a presentation for the management last week which was postponed and now there is nothing to present. :,( Bad luck, eh

0 Karma

FRoth
Contributor

Message is: Jan 30, 2012 12:00:00 AM
(11 hours ago) Indexing quota exceeded for this pool, poolsz=0 bytes FRASV010842 auto_generated_pool_download-trial download-trial license_window

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...