I'm receiving "Indexing quota exceeded" even my daily logs are about 300MB size

[vitaly_il]

I'm receiving daily alert about Splunk license even my daily logs volume is under 500MB - about 300MB.
Any ideas?

TIA, Vitaly

See alerts below:

Severity Time Message Indexer Pool Stack Category
Jan 8, 2013 12:00:00 AM
(3 hours ago) Indexing quota exceeded for this pool, poolsz=524288000 bytes splunk-server auto_generated_pool_download-trial download-trial license_window
Jan 7, 2013 12:00:00 AM
(1 day ago) Indexing quota exceeded for this pool, poolsz=524288000 bytes ssplunk-server auto_generated_pool_download-trial download-trial license_window

[stephane_cyrill]

Hi,
The alert message is clear.
Your license is simply make up of pools with individual quotas. So when one the pool exceed his quota or for any license violation in any pool, splunk must report it to you.
NOTE that that license violation only affect that pool and the other pools are still functioning.

The strategy of dividing you license is very interesting because in your deployment you can assign a team or a machine to a license pool, doing so if they if they exceed their quota they will be stop from consuming more.

[vitaly_il]

it's uncompressed Jboss logs.

[Ayn]

300MB compressed or uncompressed?