Is there some license breach event published in Splunk internal logs in order to create an alert over it?

[JuhiSaxena]

Is there some license breach event published in Splunk internal logs in order to be alerted.

[jkat54]

If you breach your license in any type of splunk deployment, admins will receive notification at the top of the UI under messages.

You will find there are warnings / errors that will occur in index=_internal

[JuhiSaxena]

To be specific, what type of warnings / errors will be there that will occur in index=_internal ? I wanted to know that, as i have to create alert over it.

[jkat54]

Use the search in the monitoring console

[jkat54]

See this previous answer:

https://answers.splunk.com/answers/578972/how-to-search-for-number-of-license-violations-ove.html