https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249557#M8043 <P>Violation alerts under licensing tab are not consistent and it seems to retrieve those messages using REST API. Re-framing my earlier question, is there a way to track the number of violations from the splunk logs?</P> Tue, 17 May 2016 04:16:39 GMT niklucky02 2016-05-17T04:16:39Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249556#M8042 <P>I have installed Splunk 6.2 version and it shows a license violation under category 'license_window'. Is there any way we can find out how many violations have occurred in last 30 days in version 6.2?</P> Mon, 16 May 2016 08:49:58 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249556#M8042 niklucky02 2016-05-16T08:49:58Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249557#M8043 <P>Violation alerts under licensing tab are not consistent and it seems to retrieve those messages using REST API. Re-framing my earlier question, is there a way to track the number of violations from the splunk logs?</P> Tue, 17 May 2016 04:16:39 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249557#M8043 niklucky02 2016-05-17T04:16:39Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249558#M8044 <P>The best way to do this is to monitor the 30 day License Usage Report View (LURV) in Settings &gt; LIcensing &gt; Usage Report &gt; Previous 30 Days</P> Thu, 19 May 2016 04:00:45 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249558#M8044 phadnett_splunk 2016-05-19T04:00:45Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249559#M8045 <P>@phadnett: I see some variations in the number of violations messages that I see under LURV and the reason I posed this question. My question is there a pattern inside splunk logs on the license master server that would help me to see that I have violated 3 times in last 30 days or an alternate splunk query?</P> Thu, 19 May 2016 05:26:04 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249559#M8045 niklucky02 2016-05-19T05:26:04Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249560#M8046 <P>@niklucky02 You could use a search like this to see each time a warning occurs for the pool. You have 5 or more warnings in a rolling 30-day period before a violation for the pool occurs.</P> <P>index=_internal sourcetype=splunkd component=LMStackMgr "A warning has been recorded for all members"</P> Sat, 21 May 2016 17:29:31 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249560#M8046 phadnett_splunk 2016-05-21T17:29:31Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249561#M8047 <P>Thanks Phadnett! The query worked but it was showing 5 violations whereas my search didn;t lock out. Anyways, I will keep this query as the message is exactly what I was looking for.</P> Mon, 30 May 2016 04:40:53 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-out-how-many-license-violations-have-occurred-in-the/m-p/249561#M8047 niklucky02 2016-05-30T04:40:53Z