Installation

Splunk 4.2 License warnings.

praburam
New Member

I am constantly getting the below under Manager->Licensing

Jun 8, 2011 8:59:15 AM
(just now) This pool contains slave(s) with 4 warnings INFDC220 auto_generated_pool_enterprise enterprise pool_warning_count

I am constantly getting these License warnings and need to know why this is occuring. I am using a Master License server with Enterprise license group license.

What are slave(s) referred to here? how to fix this issue. I am able to find nothing in splunk base about these warnings.

Any help on this is much appreciated.

Tags (1)
0 Karma

praburam
New Member

We checked with Splink support and they have asked for Metrics.log from the Indexer and from the Heavy forwarder which is getting the license warnings, under the category "pool_warning_count"

0 Karma

Takajian
Builder

The concept of slave is indexer and heavy forwarder. Becuase heavy forwarder need enterprise license, Light weight forwarder need just forwarder license. So, you will need to check heavy forwarder status.

0 Karma

praburam
New Member

I have one Indexer and 4 other Heavy forwarders with more than 200 Light weight forwarders. All the Indexer and 4 forwarders have Master license with daily volume of 100,000 MB.

So, there is no possibility of slave concept here. I checked the indexer volume status and it shows only 225 MB per day. so, where would be the issue?

0 Karma

Takajian
Builder

How many splunk instances you have? If your splunk slave server lose connection with splunk master license server, your master will get warning message. You can see more detail about license alert in following site.

http://www.splunk.com/base/Documentation/4.2.1/Admin/Aboutlicenseviolations

Here are some of the conditions that will generate a licensing alert:

* When a slave becomes an orphan, there will be an alert (transient and fixable before midnight)
* When a pool has maxed out, there will be an alert (transient and fixable before midnight)
* When a stack has maxed out, there will be an alert (transient and fixable before midnight)
* When a warning is given to one or more slaves, there will be an alert (will stay as long as the warning is still valid within that last 30-day period) 
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...