- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have installed Splunk 6.2 version and it shows a license violation under category 'license_window'. Is there any way we can find out how many violations have occurred in last 30 days in version 6.2?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The best way to do this is to monitor the 30 day License Usage Report View (LURV) in Settings > LIcensing > Usage Report > Previous 30 Days
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The best way to do this is to monitor the 30 day License Usage Report View (LURV) in Settings > LIcensing > Usage Report > Previous 30 Days
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

@niklucky02 You could use a search like this to see each time a warning occurs for the pool. You have 5 or more warnings in a rolling 30-day period before a violation for the pool occurs.
index=_internal sourcetype=splunkd component=LMStackMgr "A warning has been recorded for all members"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Phadnett! The query worked but it was showing 5 violations whereas my search didn;t lock out. Anyways, I will keep this query as the message is exactly what I was looking for.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@phadnett: I see some variations in the number of violations messages that I see under LURV and the reason I posed this question. My question is there a pattern inside splunk logs on the license master server that would help me to see that I have violated 3 times in last 30 days or an alternate splunk query?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Violation alerts under licensing tab are not consistent and it seems to retrieve those messages using REST API. Re-framing my earlier question, is there a way to track the number of violations from the splunk logs?
