after converting trial to free we get error "Daily indexing volume limit exceeded."

[tmichiels]

Error : Daily indexing volume limit exceeded. See License Manager for details.xLicense warning issued within past 24 hours (Fri Jan 13 00:00:00 2012 Romance Standard Time). See License Manager for details

Last 24h index status:

series sum(MB)

_internal 29.7315712415
main 8.6885786455
_audit 0.196688716

And we never hit more than 50 MB/day, so I don't get this?

Now can't do anything anymore?

What went wrong and how to solve?

[marquiselee]

I did a 'splunk clean all' that seems to have worked for me. it will wipe all indexed data tho.

best

[marquiselee]

Hi, I'm running into the same warnings. Did you ever find a resolution to this?

Best

[FRoth]

I dont remember.
What I wasn't aware of is that 5 license warnings within a period of 30 days cause splunk search to deny its service.
When the earliest warning leaves this time period, splunk search will be up again.

[FRoth]

I got 4 license warnings in the past (all time) and tried to keep the volume as low as possible. It seems that the expired Enterprise Trial License caused another warning that led to the deactivation of the search app.
If I had known this before, I would have switched the license myself to avoid the complete deactivation.

Jan 30, 2012 12:00:00 AM
(11 hours ago) Indexing quota exceeded for this pool, poolsz=0 bytes SV010842 auto_generated_pool_download-trial download-trial license_window

Jan 25, 2012 12:00:00 AM
(5 days ago) Indexing quota exceeded for this pool, poolsz=524288000 bytes SV010842 auto_generated_pool_download-trial download-trial license_window

Jan 10, 2012 12:00:00 AM
(2 weeks ago) Indexing quota exceeded for this pool, quota=524288000 bytes SV010842 auto_generated_pool_download-trial download-trial license_window

Jan 9, 2012 12:00:00 AM
(3 weeks ago) Indexing quota exceeded for this pool, quota=524288000 bytes SV010842 auto_generated_pool_download-trial download-trial license_window

Jan 8, 2012 12:00:00 AM
(3 weeks ago) Indexing quota exceeded for this pool, quota=524288000 bytes SV010842 auto_generated_pool_download-trial download-trial license_window

[tmichiels]

Dear Splunk,

Please give us a solution for this ?

thx

[FRoth]

Same problem here.
We had 400 MB per day in the Enterprise Trial License Period and switched this weekend.

Splunk throws this error although we did not hit the 500 MB limit.

Murphy's Law because we planned a presentation for the management last week which was postponed and now there is nothing to present. :,( Bad luck, eh

[FRoth]

Message is: Jan 30, 2012 12:00:00 AM
(11 hours ago) Indexing quota exceeded for this pool, poolsz=0 bytes FRASV010842 auto_generated_pool_download-trial download-trial license_window