Strange license pool warning

[wrangler2x]

I was looking at Manager -> Licensing this morning and I have this warning:

1 pool warning reported by 1 indexer    correct by midnight to avoid violation

If I drill into that I see this:

Severity    Time    Message Indexer Pool    Stack   Category
Correct by midnight to avoid violation Learn more    This pool contains slave(s) with 1 warnings    mylicensemasterhost-splunk  UCI_OIT_Security    enterprise  pool_warning_count

Yet the pool for my indexer shows only 1.167 MB (11.625%) and my only slave pool (200 MB) is showing zero.

I have two 5,120 MB licenses (10GB).

Why is the warning there?

[wrangler2x]

I had this happen again recently and I figured-out what was happening. The warning was issued sometime between when I went home and midnight. It was caused by another Splunk indexer on my campus to whom I am providing 200 MB of my license -- thus their system is a slave. They had something go nutso and went over their 200 MB, which generated the warning. When I saw it the next day, I went to take a look at the licensing and saw today's (the next day's) statistics, which of course were fine.

To see what is going on the day before, go to your base URL for your indexer/master, and add /en-GB/manager/search/licenseusage#historyTab to it (i.e., https://splunk-url:splunkport/en-GB/manager/search/licenseusage#historyTab). Then click on the *Previous 30 days tab. There is a drop-down labled Pool and there find the slave pool in question and select it.

You'll get two graphs. The top one is actual usage, in GB, and the bottom one is percentage used. Look for the bar that goes above 100% and that's the slave violation.

[derek7128]

Did you ever find out? I am getting a similar error message.