Is it possible to receive a data violation warning by mistake (migrating from enterprise to free license)?

[amir_thales]

Hello,

I went from the "enterprise" license to the "free" license and there are 3 messages of violations that have appeared:

"This pool has exceeded its configured poolsize=0 bytes. A warning has been recorded for all members "

The messages insinuate that I have exceeded the fixed quota but I am sure not to have exceeded it because I checked in the monitoring console and I am below 500mb.

Before creating this topic I have searched but I have not found any precise answers to this problem.

Thank you for your help.

[mbagali_splunk · Accepted solution]

If you go over 500 MB/day more than 3 times in a 30 day period, Splunk Free continues to index your data, but disables search functionality until you are back down to 3 or fewer warnings in the 30 day period.

Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) warnings in the previous 30 days, or when you apply a temporary reset license (available for Enterprise only). To obtain a reset license, contact your sales representative.

You can use the list command to view messages (alerts or warnings) about the state of your licenses.
./splunk list licenser-messages

http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Aboutlicenseviolations

Not sure if you have gone through below post:

https://answers.splunk.com/answers/188988/trial-license-to-free-license-poolsize0.html

[amir_thales]

thank you @mbagali

If I understand correctly, I can not do anything without splunk intervention so I will have to wait 30 days to be able to analyze my data again and even if I solve this problem of quota exceeding it will still have to wait until the delay Of 30 days elapses.

Thank you
Amir

[lfedak_splunk]

Hey @amir_thales, Did you take a look at this http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/AboutSplunksLicenseUsageReportView ?
If it was a series of violations then the Splunk instance will continue to index data but it will be unsearchable for 30 days. I saw on some other posts cases of people reinstalling Splunk with success and/or contacting support. Another post pointed out that the license "also conveys capabilities, such as distributed search." I saw this as well by @somesoni2: "The license usage in Splunk is not only the size of raw data files it monitors but includes all associated files (index files and raw data file) which Splunk has to generate to make it searchable, so depending upon you data and processing rules, it can be larger than the actual data file."

[amir_thales]

Thank you for your response @lfedak.

As I said above I checked this via the monitoring tool there is a tab provided for this in tab: "indexing" -> "use of the license" -> "use of the license Last 30 days ".
I do not think splunk has created a tool that does not take the right information into account.

What I want to know, I prefer to solve the problem that to reinstall a splunk, is how to solve this problem of poolsize = 0?
What do I need to configure so that it disappears?

I have since yesterday cut off any data entry time to solve this problem but the 3 messages are still present.

thank you
Amir