1 pool warning reported by 1 indexer - cannot find issue

[eblackburn]

Hello,

I installed Splunk Free a while back on a test laptop and at some point, ran into some licensing violations because of the indexing rate. At some point, I was unable to run searches.

I reinstalled Splunk Free recently, switched from Trial to Free, and when checking the Licensing page, saw this message:

1 pool warning reported by 1 indexer (Correct by midnight to avoid warning)

The problem is, according to "Volume used today", my indexing rate in the Monitoring Console, and the actual size of my indexes, I'm not anywhere remotely close to hitting 500 MB/day.

I was able to obtain a Splunk Dev license, and the issue persists after installing that. 

Now, I have pool: auto_generated_pool_enterprise, and volume used today (for example):   2 MB / 51,200 MB.

I'm seeing the same message on a Linux VM I set up on the same laptop and installed Splunk Free on.

Is this going to be something I need to worry about, or since my indexing rate is not anywhere close to 500 MB/day, I should be fine? If I need to address it, what is the best course of action? To me, it's difficult because there's not an index or data source I can narrow down and take action on. Perhaps it's because of the past issue with licensing violations.

Thanks!

[eblackburn]

Thanks very much! I'll plan on letting the violation(s) age out. Assuming that I don't incur any new violations, hopefully things return to normal afterward. 

[richgalloway]

It's definitely because of the past license violations.  There are two fixes: 1) wait for the violation to time out in 30 days; or 2) ask Splunk for a Reset license.  Note that installing a new license will not reset a violation unless the new license is specifically a "reset" license.