I have just installed splunk (4.2.2) yesterday and the license is violate once a time, but I find splunk stop to index any log after it show up license exceeded. I would like anyone have same situation and is it a bug?
just a brainwave, if you set an alert on the lic violation and fire of a script that set indexes.conf, restart splunk action?
Splunk does not stop indexing because of license violations, no matter how many. It is possible that other things caused this, such as hitting the minimum free disk space limit.
If it actaully stops indexing, then it's definitely a bug, assuming there isn't caused by something else. They have always said that only searching would be affected. What is being logged in $SPLUNK_HOME/var/log/splunk/splunkd.log?