Dear all,
I am a user of the Splunk Developer License aka Enterprise license, time limited to 6 months.
Recently it happened that my license expires unnoticed and when I connected to the search head again a couple of days later, Splunk told me, that it had expired and I have this and that many violations because of this.
Even after applying my prolonged new dev license, I was not able to search again, because of the "5 violations in 30 days" restrictions and had to ask for a reset license, so I could use Splunk again immediately.
I now want to create a search/alert that warns me ahead of time that my license is due to expire so I can prolong it in time. However, I cannot seem to find the proper sourcetype / index, where I can find that information? I'm pretty sure that Splunk splunks these messages, that the license is about to expire in n days, doesn't it?
BR
Markus
