I'm seeing the following banner in UI:
[splunkhost.domain.com] restricting search to internal indexes only (reason: [DISABLED_DUE_TO_VIOLATION,0])
What does it mean?
This error means that you have violated your license over the specified number of allowed daily violations. You will need to contact support and specifically request a "reset license".
View solution in original post