https://community.splunk.com/t5/Installation/How-to-resolve-overreporting-of-license-usage-after-temporary/m-p/362204#M5031 <P>Our license server ran into a space issue where we ran under 1,000 MB of space available. Therefore, it stopped indexing. This went unnoticed for a few days, and it fixed itself for a day or two, and then went back under 1,000 MB again. This causes the license measurements to go completely off the charts. For example, our indexers are only consuming about 500 GB all together right now, but the license server things we're at 4.5TB. Is there a way to correct the license server's values?</P> Mon, 15 Jun 2020 23:39:42 GMT devinmclean 2020-06-15T23:39:42Z https://community.splunk.com/t5/Installation/How-to-resolve-overreporting-of-license-usage-after-temporary/m-p/362204#M5031 <P>Our license server ran into a space issue where we ran under 1,000 MB of space available. Therefore, it stopped indexing. This went unnoticed for a few days, and it fixed itself for a day or two, and then went back under 1,000 MB again. This causes the license measurements to go completely off the charts. For example, our indexers are only consuming about 500 GB all together right now, but the license server things we're at 4.5TB. Is there a way to correct the license server's values?</P> Mon, 15 Jun 2020 23:39:42 GMT https://community.splunk.com/t5/Installation/How-to-resolve-overreporting-of-license-usage-after-temporary/m-p/362204#M5031 devinmclean 2020-06-15T23:39:42Z https://community.splunk.com/t5/Installation/How-to-resolve-overreporting-of-license-usage-after-temporary/m-p/362205#M5032 <P>Hi @devinmclean,</P> <P>What is the size of your license? Usually when this happen you will need request a support for your Splunk team to fix your license.<BR /> Other thing to do is analysis how is the offender of this sudden increase and in some cases, disable the collect of data for a while for to do this.</P> <P>I hope help you.</P> <P>[ ]s<BR /> Rafael Martins</P> Fri, 29 Sep 2017 21:25:53 GMT https://community.splunk.com/t5/Installation/How-to-resolve-overreporting-of-license-usage-after-temporary/m-p/362205#M5032 rafamss 2017-09-29T21:25:53Z https://community.splunk.com/t5/Installation/How-to-resolve-overreporting-of-license-usage-after-temporary/m-p/362206#M5033 <P>Hey @rafamss,</P> <P>The license is not actually being exceeded. The license server is displaying incorrect information due to it shutting down and not indexing data (caused by the HD on the server being full). I'm wondering if anyone else has seen this kind of behavior and how to fix it.</P> Sat, 30 Sep 2017 00:50:30 GMT https://community.splunk.com/t5/Installation/How-to-resolve-overreporting-of-license-usage-after-temporary/m-p/362206#M5033 devinmclean 2017-09-30T00:50:30Z https://community.splunk.com/t5/Installation/How-to-resolve-overreporting-of-license-usage-after-temporary/m-p/362207#M5034 <P>Sure @devinmclean,</P> <P>I've never passed for any similar event like your, but try this tips, I hope this help you.</P> <P>By the way, did you look the log of license master? <CODE>$SPLUNK_HOME/var/log/splunk/license_usage.log</CODE> to find any anomalous event?</P> <P>A workarround would be delete the licenses of your environment and put this again.</P> <P>There is some know issues and workarrounds of Splunk 7.0 release notes, see this: <CODE><A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/ReleaseNotes/Knownissues" target="test_blank">http://docs.splunk.com/Documentation/Splunk/7.0.0/ReleaseNotes/Knownissues</A></CODE></P> <P>[ ]s<BR /> Rafael Martins</P> Mon, 02 Oct 2017 15:02:34 GMT https://community.splunk.com/t5/Installation/How-to-resolve-overreporting-of-license-usage-after-temporary/m-p/362207#M5034 rafamss 2017-10-02T15:02:34Z