The problem was likely to be I had an older version of Splunk, and the license was expired, so I got 0 MB/day and hit pool warnings while uploading data.
I then converted to the perpetual free license but not sure if it would resolve the pool warning(not finalized yet) Issued prior to the conversion. If not, how should I get rid of it? Thanks!!
- 1 pool warning reported by 1 indexer
- [Message] This pool contains slave(s) with 1 warnings
- [Pool] autogeneratedpool_free
I like it! Too bad you commented instead of answering it, otherwise would accept your answer! Thanks for the help
I converted it to an answer - now you CAN accept it.
Found the answer from here - http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Aboutlicenseviolations
"The daily license quota will reset at midnight (at which point the soft warning will become a "hard warning"). You have until then to fix your situation and ensure that you won't go over quota tomorrow, too."
You don't. The warning will disappear in time.
Yeah - I think you are right. I was a bit nervous because I didn't realize the license problem yesterday and already got a permanent warning 😞
"Permanent" is only semi-permanent. It will expire eventually. With the Enterprise licence you are allowed 4 days over your licence, and with the free two days. A further day within a 30 day window sends the user interface "dark", allowing you to report only on Splunk stats and not a lot else until the first of those strikes then expires from the 30 day window (provided you have not had more since).
More complicated to explain than understand.
The banner warnings will expire at the same time, and the audit record (on the licence page) disappears eventually.