4.2 License reports exceeded, but stats don't back it up

[twinspop]

The license master License Manager interface showed me this

Mar 31, 2011 12:25:57 PM
(just now)  This pool is over quota=3196059648 bytes, please correct before midnight
> auto_generated_pool_enterprise    enterprise  pool_over_quota

However, running the searches below shows total _raw size no where near my pool license limit.

yesterday's volume came to a little over 1 GB:

earliest=-1d@d latest=-0d@d| eval eventsize=len(_raw) | stats sum(eventsize)

today's volume so far came to a little under 2 GB:

earliest=-0d@d | eval eventsize=len(_raw) | stats sum(eventsize)

Why the alert?

[jtrucks]

It is possible you hit an index size limit and some data was already rotated out to frozen. If you do not have frozen set, it is entirely possible the data was simply deleted upon bucket rotate.

You can look at the details of what it counts toward your license with:

index=_internal source=*license_usage* type=RolloverSummary

If you want to manually calculate the data for yourself, use:

index=_internal source=*license_usage* type=RolloverSummary | eval _time=_time-3700  | convert timeformat="%m/%d/%Y" ctime(_time) as day | eval GB=b/1024/1024/1024 | stats sum(GB) by day

To narrow it to a specific source, use:

index=_internal source=*license_usage.log type=Usage | eval GB=b/1024/1024/1024 | bucket _time span=1d | stats sum(GB) by _time,s