Reporting

1 pool violation reported by 1 indexer

sandrac10
Engager

Hello Splunk support,

I have a free splunk license with 500MB per day. The deployment is following:
1 indexer
2 forwarders ( 1 disabled, 1 active )

License is not expired. Search is not working. Volume used today 256MB.

The issues were from pools. Firstly auto_generated_pool_download_trail, and right now auto_generated_pool_free.The message is: This pool contains 1 slave/s in violation

I have 1 pool violation and warning. 13 pool quota overage warnings.

Any help would be appreciated.

Thank you in advance,

Tags (2)
0 Karma

adonio
Ultra Champion

this is not splunk support, this is answers,
not sure what help you are seeking but it sounds like you can not search since you violated your free license.
there are couple options:
1. wait until violations expire (i think it takes a month or so)
2. remove splunk completely, and install a new one
3. if the above doesnt work, create a VM (our launch a cloud instance) and install new splunk there

0 Karma

sandrac10
Engager

Exactly that's what I'm seeking, but I'm not sure why violation happened since custom index receiving data is restricted to 500MB.
Thank you for proposed options!
Best regards,

0 Karma

adonio
Ultra Champion

the size of your index doesnt matter, the only thing that matters is how much data was indexed.
you can index terabytes of data to a 2 gb index, and splunk will index and throw data as long as it comes
converting to an answer,

hope it helps and

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...