Splunk 4.2 License warnings.

[praburam]

I am constantly getting the below under Manager->Licensing

Jun 8, 2011 8:59:15 AM
(just now) This pool contains slave(s) with 4 warnings INFDC220 auto_generated_pool_enterprise enterprise pool_warning_count

I am constantly getting these License warnings and need to know why this is occuring. I am using a Master License server with Enterprise license group license.

What are slave(s) referred to here? how to fix this issue. I am able to find nothing in splunk base about these warnings.

Any help on this is much appreciated.

[praburam]

We checked with Splink support and they have asked for Metrics.log from the Indexer and from the Heavy forwarder which is getting the license warnings, under the category "pool_warning_count"

[Takajian]

The concept of slave is indexer and heavy forwarder. Becuase heavy forwarder need enterprise license, Light weight forwarder need just forwarder license. So, you will need to check heavy forwarder status.

[praburam]

I have one Indexer and 4 other Heavy forwarders with more than 200 Light weight forwarders. All the Indexer and 4 forwarders have Master license with daily volume of 100,000 MB.

So, there is no possibility of slave concept here. I checked the indexer volume status and it shows only 225 MB per day. so, where would be the issue?

[Takajian]

How many splunk instances you have? If your splunk slave server lose connection with splunk master license server, your master will get warning message. You can see more detail about license alert in following site.

http://www.splunk.com/base/Documentation/4.2.1/Admin/Aboutlicenseviolations

Here are some of the conditions that will generate a licensing alert:

* When a slave becomes an orphan, there will be an alert (transient and fixable before midnight)
* When a pool has maxed out, there will be an alert (transient and fixable before midnight)
* When a stack has maxed out, there will be an alert (transient and fixable before midnight)
* When a warning is given to one or more slaves, there will be an alert (will stay as long as the warning is still valid within that last 30-day period)