how to fix licence violation

[lancealotx]

Not really trivial question, but I can't see a simple answer. I had a 4.3 just collect logs and didn't realize (since I just got the setup working), but regardless traffic grew and it tripped the 500MB 5 times and the person using it didn't need it until a few weeks alter.

With that, I cut the server logging in 1/2 and put things back so the daily is around 200M. I still get the same error while searching and wondering how to just say "hey things are fine now". The errors were mid Dec 2012 and this fix has been in place a week or two now. I also upgraded to version 5 thinking that may help but still nothing.

I have a few custom searches, dashboards, etc. what is the easiest way to get this back working.

Tnx

[gkanapathy]

You can either wait until you only have 5 violation in the last 30 days (the violation counter is 5 times in a rolling 30-day period, and it's no clear to me if it tripped 5 times and them stopped, or tripped 5 times and then kept on getting tripped every day for a few weeks after) or you can open an official Splunk Support case for a license reset key. Assuming it was a one-time mistake, they should be able to get you one pretty quickly. (Be sure to use the authorized user account to open the case. You can do it either online or via email, of if you don't have your authorized contact accounts set up, you can try on the phone.)