What if the license violation error appears more than 5 times in 30 days. After 30 days, will I get back the search ability of Splunk.
Can you please convert your comment to an answer so it doesn't show as unanswered? Thanks!
A good read here. Search capabilities return when you have fewer than 5 (Enterprise) or 3 (Free) warnings in the previous 30 days, so basically 30 days after your first violation.
http://docs.splunk.com/Documentation/Splunk/6.2.6/Admin/Aboutlicenseviolations
