We received 4 alerts of License violations and the last message was around July 1, 2010. For somereason the messages havent cleared yet. Does it persist for a 30 day period for multiple license violations ( < 5)
The license should clear 30 days after the latest violation. Last one was july 1st, so it should clear july 31st.
If it has not cleared yet it might be because of the time on which it happened? (ie, check back and notify support if it has not cleared by Aug 1st)
I see install manual. "Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) violations in the previous 30 days or when you apply a new license with a larger volume limit. "
If last one was july 1st, so it will clear when the violation count is 4 in previous 30 days. It may be before july 31st. What do you think? I am not sure which is correct.
Splunk license violation messages DONT clear, eventhough you may be safe from the violation period. It is just to show you the number of violations taken place in the past for **reference