License usage date error when upgrading from 6.1.3 to 6.2.3.

[ltrand]

On Monday I upgraded from 6.1.3 to 6.2.3 and yesterday something weird happened with my license usage report.

So I am graphing my license usage through API call and it usually resets to 0 at midnight UTC. However last night it didn't reset to 0, so now I'm almost at my daily limit, so I'm concerned about pegging my license & losing functionality.

Does anyone know what may have caused this and what the solution might be?

[skoelpin]

Depending on your Splunk licenses plan (Enterprise or free) you have 3-5 overages respectfully before you are unable to search anymore. Are you sure that you just didn't start indexing more data rather than it being a Splunk error?

Go to Settings/Licensing/Usage Report then click on Previous 30 days.. Split by Index, source type, host etc.. Hit the search button and choose your timeframe as Today and verify that you're not indexing more data then you thought you were. Once you do this and verify your not indexing more data then you can open a ticket with support