https://community.splunk.com/t5/Security/License-violations-help/m-p/71819#M14008 <P>thanks for the link, but i didn't find it of much use, as does not really tell you how to resolve the problems</P> <P>due the problems this app is causing i'm going to move to syslog watcher 4</P> Wed, 26 Sep 2012 19:03:05 GMT mmorley 2012-09-26T19:03:05Z https://community.splunk.com/t5/Security/License-violations-help/m-p/71817#M14006 <P>I sent splunk an email for advice about swapping to a free licence before the trial ran out, but never got any help and have noticed today it must have ran out recently as I now have some licence violations. I've also updated the license to the free version today and also updated the application.</P> <P>Under current it lists the following twice and that must correct by midnight to avoid violation</P> <P>1 pool warning reported by 1 indexer</P> <P>then under permanent it says</P> <P>3 license window warnings reported by 1 indexer</P> <P>then under local server information it reports</P> <P>Licensed daily volume 500mb<BR /> Volume used today 0mb (0.003% of quota)<BR /> Warning count 3</P> <P>How do i get rid of these errors without losing all my data as trying to find it through the help pages isn't very informative</P> Wed, 26 Sep 2012 18:17:21 GMT https://community.splunk.com/t5/Security/License-violations-help/m-p/71817#M14006 mmorley 2012-09-26T18:17:21Z https://community.splunk.com/t5/Security/License-violations-help/m-p/71818#M14007 <P>Read this for your options:</P> <P><A href="http://splunk-base.splunk.com/answers/43083/free-license-violation-how-to-fix-and-prevent-recurrence">http://splunk-base.splunk.com/answers/43083/free-license-violation-how-to-fix-and-prevent-recurrence</A></P> <P>The options you have are the following since you only have 500 MB per day for free:</P> <UL> <LI>buy a splunk enterprise license, and get a reset key from support. </LI> <LI>reinstall a new trial instance and migrate your data... every 30 days. </LI> <LI>limit the data volume</LI> </UL> <P>You can do this to help you manage the data volumes:</P> <P><A href="http://splunk-base.splunk.com/answers/32174/is-there-a-way-to-isolate-erratichigh-volume-sources-to-prevent-license-violations?page=1&amp;focusedAnswerId=32187#32187">http://splunk-base.splunk.com/answers/32174/is-there-a-way-to-isolate-erratichigh-volume-sources-to-prevent-license-violations?page=1&amp;focusedAnswerId=32187#32187</A></P> Wed, 26 Sep 2012 18:20:02 GMT https://community.splunk.com/t5/Security/License-violations-help/m-p/71818#M14007 sdaniels 2012-09-26T18:20:02Z https://community.splunk.com/t5/Security/License-violations-help/m-p/71819#M14008 <P>thanks for the link, but i didn't find it of much use, as does not really tell you how to resolve the problems</P> <P>due the problems this app is causing i'm going to move to syslog watcher 4</P> Wed, 26 Sep 2012 19:03:05 GMT https://community.splunk.com/t5/Security/License-violations-help/m-p/71819#M14008 mmorley 2012-09-26T19:03:05Z https://community.splunk.com/t5/Security/License-violations-help/m-p/71820#M14009 <P>FYI, while in violation, the indexer continues to index data, but can still record new daily license warnings.</P> <P>With a splunk enterprise license with splunk support contract, you can ask for reset key.<BR /> If you are using splunk free, you have to wait 30 days without new warnings for the violation to reset by itself.</P> <P>Otherwise, reinstall splunk and move the old buckets to the new install.</P> Thu, 27 Sep 2012 16:37:20 GMT https://community.splunk.com/t5/Security/License-violations-help/m-p/71820#M14009 yannK 2012-09-27T16:37:20Z