Installation

License violation on forwarders?

jgauthier
Contributor

All,

According to the splunk interface I have a warning:
"1 pool violation reported by 1 indexer"
Details:
"This pool contains 173 slave/s in violation"

Firstly, many of these are heavy forwarders, but some are light.
Also, I don't have any slave indexers (on purpose?) and I don't have 173 of anything.

Obviously, I am confused about something.

I have one splunk indexer, and maybe a dozen forwarders/heavy forwarders.

Tags (1)

piebob
Splunk Employee
Splunk Employee

is it at all possible that your indexer's licensing configuration allows it to accept connections from any indexers by default? by default, this is how the licenser is configured, from
http://www.splunk.com/base/Documentation/latest/Admin/Createalicensepool :

"When you install an Enterprise license onto a brand new Splunk server, Splunk automatically creates an Enterprise license stack called Splunk Enterprise Stack from it and defines a default license pool for it called auto_generated_pool_enterprise.

The default configuration for this default pool adds any license slave that connects to this license master to the pool. You can edit the pool to change this configuration, to add more indexers to it, or create a new license pool from this stack."

it seems like a long shot, but perhaps there are other indexers at your organization connecting as license slaves to your indexer?

another possibility is that you are using deployment server and that every time it restarts its deployment clients (the forwarders), they report into the indexer as a new license slave?

all very speculative, i'm afraid. i recommend submitting a case to Splunk Support.

jgauthier
Contributor

Thanks! Our organization only has the one indexer, and I'm not doing any form of deployment.

I will submit a case, if possible.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...