Installation

License violation alert giving false positives

cdowin
New Member

Howdy. I set up Splunk to alert me of license violations for the amount of daily data my license allows. I set up an alert using the search supplied here:

http://answers.splunk.com/questions/207/how-do-i-alert-on-license-violations

I set this alert up about a month ago and have received 2 emails from the alert warning of license violations. I can login to Splunk web and look in Manager > License and see that I have not had any license violations.

I would like to get rid of these false positive alerts if possible. Has anybody else had this problem?

Thanks, Erik Paulsson

0 Karma
1 Solution

zliu
Splunk Employee
Splunk Employee

zliu
Splunk Employee
Splunk Employee

The search query has been modified. Please check that link again.

http://answers.splunk.com/questions/207/how-do-i-alert-on-license-violations

Masa
Splunk Employee
Splunk Employee
0 Karma

jrodman
Splunk Employee
Splunk Employee

It's hard to understand how that search could be wrong. My guess is you're getting alerts for license violations on hosts you don't care about, like forwarders. Try running the search manually to see what comes up, say over the past several weeks?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...