topic Re: License violation on forwarders? in Installation

License violation on forwarders?

jgauthier — Mon, 06 Jun 2011 19:44:11 GMT

All,

According to the splunk interface I have a warning:
"1 pool violation reported by 1 indexer"
Details:
"This pool contains 173 slave/s in violation"

Firstly, many of these are heavy forwarders, but some are light.
Also, I don't have any slave indexers (on purpose?) and I don't have 173 of anything.

Obviously, I am confused about something.

I have one splunk indexer, and maybe a dozen forwarders/heavy forwarders.

Re: License violation on forwarders?

piebob — Mon, 28 Sep 2020 09:39:04 GMT

is it at all possible that your indexer's licensing configuration allows it to accept connections from any indexers by default? by default, this is how the licenser is configured, from
http://www.splunk.com/base/Documentation/latest/Admin/Createalicensepool :

"When you install an Enterprise license onto a brand new Splunk server, Splunk automatically creates an Enterprise license stack called Splunk Enterprise Stack from it and defines a default license pool for it called auto_generated_pool_enterprise.

The default configuration for this default pool adds any license slave that connects to this license master to the pool. You can edit the pool to change this configuration, to add more indexers to it, or create a new license pool from this stack."

it seems like a long shot, but perhaps there are other indexers at your organization connecting as license slaves to your indexer?

another possibility is that you are using deployment server and that every time it restarts its deployment clients (the forwarders), they report into the indexer as a new license slave?

all very speculative, i'm afraid. i recommend submitting a case to Splunk Support.

Re: License violation on forwarders?

jgauthier — Wed, 08 Jun 2011 14:50:44 GMT

Thanks! Our organization only has the one indexer, and I'm not doing any form of deployment.

I will submit a case, if possible.