Using Splunk Enterprise and Splunk App for VMware trials, why are we seeing "auto_generated_pool_enterprise = 0mb" in the licensing section?

[runtbog]

Hi - This may be more of a general Splunk issue, however, I am giving Splunk a go to see if it can help us monitor our VMware environment.

Installed Trial Splunk - (Enterprise - not free) and VMware App (Trial) . Data is being collected - all good. However, in the licensing section we have :

auto_generated_pool_enterprise = 0mb

We cannot edit this value as we seem to be only licensed for 0mb - therefore getting a lot of over quota warnings. Which in turn will stop searching the data.

Why is this? Is this normal for the trial version? Are you suppose to get a trail license key to enter that bumps up the quota?

Thanks in advance
Russell

[samccet]

i have the similar issue.i couldn't find any document or solution for this..if someone had this issue and resolved please let us know the process to fix this issue.
Below are the warnings in the licencing page
In the Splunk > System > Licencing

1 pool warning reported by 1 indexer - correct by midnight to avoid violation
1 pool quota overage warning reported - correct by midnight to avoid violation

Under the Pools Table
auto_generated_pool_enterprise 17 MB / 0 MB

[kserra_splunk · Accepted solution]

HI Russell,

The vmware trial (and normal license) uses a 0mb value. When splunk indexes it indexes against the actual license you have and does not count against the vmware license. The vmware license exists only to tell splunk you have purchased that app.

The quota issue you cite sounds like a splunkd.log log message about a user going over disk quota. This is a separate issue which has to do with how much data each splunk search user can use on disk. If the error message are different than this please post examples.

Additionally there is a known issue with the vmware license on 3.1.3 version of vmware app. If you are on this app I would advise that you upgrade to 3.1.4

[dibrovs]

We have the same issue. Any ideas?

[runtbog]

Hi,

Thanks for the reply - im not sure that answers the problem. We are running 3.1.4

In the Splunk > System > Licencing

1 pool warning reported by 1 indexer - correct by midnight to avoid violation
1 pool quota overage warning reported - correct by midnight to avoid violation
1 license window warning reported by 1 indexer

Under the Pools Table
auto_generated_pool_enterprise 29 MB / 0 MB

If i try to edit that pool I get that the licensed maximum is 0mb. So as far as i can tell - we are going over licence straight away.

I've checked the licencing and we do have the Splunk Enterprise Trial active and valid.
Any ideas?