I was looking at Manager -> Licensing this morning and I have this warning:
1 pool warning reported by 1 indexer correct by midnight to avoid violation
If I drill into that I see this:
Severity Time Message Indexer Pool Stack Category Correct by midnight to avoid violation Learn more This pool contains slave(s) with 1 warnings mylicensemasterhost-splunk UCI_OIT_Security enterprise pool_warning_count
Yet the pool for my indexer shows only 1.167 MB (11.625%) and my only slave pool (200 MB) is showing zero.
I have two 5,120 MB licenses (10GB).
Why is the warning there?
I had this happen again recently and I figured-out what was happening. The warning was issued sometime between when I went home and midnight. It was caused by another Splunk indexer on my campus to whom I am providing 200 MB of my license -- thus their system is a slave. They had something go nutso and went over their 200 MB, which generated the warning. When I saw it the next day, I went to take a look at the licensing and saw today's (the next day's) statistics, which of course were fine.
To see what is going on the day before, go to your base URL for your indexer/master, and add
/en-GB/manager/search/licenseusage#historyTab to it (i.e., https://splunk-url:splunkport/en-GB/manager/search/licenseusage#historyTab). Then click on the *Previous 30 days tab. There is a drop-down labled Pool and there find the slave pool in question and select it.
You'll get two graphs. The top one is actual usage, in GB, and the bottom one is percentage used. Look for the bar that goes above 100% and that's the slave violation.