What happens with tracked alerts during license violation period?

[meno]

One of the things to remember when designing a Splunk 4.2.x HA environment is the behavior in case of license violations (>4 by midnight of the last 30 days on an Enterprise license). As mentioned here Splunk does not stop indexing data but search will be blocked.

Does this also apply to tracked alerts/scheduled searches? Or are only the searches executed by users via Gui blocked until license violation period ends?

[jbsplunk · Accepted solution]

Since searching is disabled, this would include both ad-hoc and saved searches. Since alerts are based on saved searches, you would not receive any alerts during the period of time in which the number of violations have caused search to be disabled.

You can find some useful searches that you can use to set up an alert on prior to your running into violations, which should help with providing a buffer for you to use for investigation to determine what is causing the violations. For useful searches in determining where the license volume comes from, and how to set up an alert when you get a violation, see the following page:

http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume