All Apps and Add-ons

License Error: This pool has exceeded its configured poolsize=1 bytes

tlrebecchi
New Member

Can any one help. I installed slunk enterprise 2 weeks ago. I started receiving this error 5 days after the install.

This pool has exceeded its configured poolsize=1 bytes. A warning has been recorded for all members.

On the license page I see this.

Licenses Volume Expiration Status
Effective daily volume 0 MB

Pools Indexers Volume used today

auto_generated_pool_enterprise 26 MB / Unlimited Edit | Delete
SplunkServer 26 MB (2,749,118,300%)

Any idea why this is happening?

Thanks

Tags (1)
0 Karma

eavent_splunk
Splunk Employee
Splunk Employee

For anyone else stumbling across this answer - "poolsize=1 bytes" is consistent with the license Splunk Cloud provides for Heavy Forwarder, Deployment Server, and Hybrid Search hosts. In that scenario, no indexing should be occurring locally and any single event being indexed will trigger this license warning.

To avoid this particular Splunk Cloud scenario, ensure your hosts are setup to forward data to Splunk Cloud, so there is no chance of local indexing occurring. If you do end up in violation, request a license reset key from Splunk Support.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @tlrebecchi ,

It looks like one of you license pool has hit the daily limit. If you have an enterprise license , you could adjust the pool size by adding it from the free pool (license which you haven't assigned to any pool yet) or readjust from other license pools. Please have a look at http://docs.splunk.com/Documentation/Splunk/latest/Admin/Createalicensepool for more information about license pool and administrating it.

In general how splunk license works : http://docs.splunk.com/Documentation/Splunk/latest/Admin/HowSplunklicensingworks

Happy Splunking!
0 Karma

tlrebecchi
New Member

Renjith.nair
Thank you for the response. I tried what you suggest with not luck. I am way under the daily limit, however I am way over by percentage. As of this morning i have this for my indexer: 0 MB (35,934,700%). How can my percent be this high? I believe this is the problem, but I could be wrong. I am thinking the VMWARE app is causing the problem. I have attached a screen shot my license page. I am going to uninstall the vmware app, just in case.

alt text
Thanks

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @tlrebecchi ,

As you mentioned, it looks like the VMWare app is pushing a lot of stuff. Can you check the VMWare index and see if its part of the auto_generated_pool? And do you have a separate indexer for VMWare?

Happy Splunking!
0 Karma

tlrebecchi
New Member

No, one indexer for everything. I only have one ESXi host with 2 VMs running. I am thinking when I install "App-VMware" if affected the licensing. However, I am still in the trial mode App-VMware" and still within the 60 day enterprise license. This should not be giving me license errors. This still does not explain why I have unlimited for ingest, but at am 35,934,700% over the ingest limit.

I am just going to reinstall the OS and Splunk and no VMware apps. Overall, I guess I could use the practice of installing Splunk on Linux.

Thank you for all of you help.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...