License Error: This pool has exceeded its configured poolsize=1 bytes

[tlrebecchi]

Can any one help. I installed slunk enterprise 2 weeks ago. I started receiving this error 5 days after the install.

This pool has exceeded its configured poolsize=1 bytes. A warning has been recorded for all members.

On the license page I see this.

Licenses Volume Expiration Status
Effective daily volume 0 MB

Pools Indexers Volume used today

auto_generated_pool_enterprise 26 MB / Unlimited Edit | Delete
SplunkServer 26 MB (2,749,118,300%)

Any idea why this is happening?

Thanks

[eavent_splunk]

For anyone else stumbling across this answer - "poolsize=1 bytes" is consistent with the license Splunk Cloud provides for Heavy Forwarder, Deployment Server, and Hybrid Search hosts. In that scenario, no indexing should be occurring locally and any single event being indexed will trigger this license warning.

To avoid this particular Splunk Cloud scenario, ensure your hosts are setup to forward data to Splunk Cloud, so there is no chance of local indexing occurring. If you do end up in violation, request a license reset key from Splunk Support.

[renjith_nair]

Hi @tlrebecchi ,

It looks like one of you license pool has hit the daily limit. If you have an enterprise license , you could adjust the pool size by adding it from the free pool (license which you haven't assigned to any pool yet) or readjust from other license pools. Please have a look at http://docs.splunk.com/Documentation/Splunk/latest/Admin/Createalicensepool for more information about license pool and administrating it.

In general how splunk license works : http://docs.splunk.com/Documentation/Splunk/latest/Admin/HowSplunklicensingworks

[tlrebecchi]

Renjith.nair
Thank you for the response. I tried what you suggest with not luck. I am way under the daily limit, however I am way over by percentage. As of this morning i have this for my indexer: 0 MB (35,934,700%). How can my percent be this high? I believe this is the problem, but I could be wrong. I am thinking the VMWARE app is causing the problem. I have attached a screen shot my license page. I am going to uninstall the vmware app, just in case.

Thanks

[renjith_nair]

Hi @tlrebecchi ,

As you mentioned, it looks like the VMWare app is pushing a lot of stuff. Can you check the VMWare index and see if its part of the auto_generated_pool? And do you have a separate indexer for VMWare?

[tlrebecchi]

No, one indexer for everything. I only have one ESXi host with 2 VMs running. I am thinking when I install "App-VMware" if affected the licensing. However, I am still in the trial mode App-VMware" and still within the 60 day enterprise license. This should not be giving me license errors. This still does not explain why I have unlimited for ingest, but at am 35,934,700% over the ingest limit.

I am just going to reinstall the OS and Splunk and no VMware apps. Overall, I guess I could use the practice of installing Splunk on Linux.

Thank you for all of you help.