Why am I receiving this Licensing Issue?

[cpm003]

Hi there,

I´m getting following advice on licensing page:

"This deployment is subject to license enforcement. Search is disabled after 45 warnings over a 60-day window"

I don't know what it´s are referring to.

[Stefanie]

It's saying you're ingesting more data than your license allows you to. 

From Splunk:

If you exceed license capacity 45 or more times in a rolling 60-day period and have a license stack volume less than 100 GB on Splunk Enterprise version 8.1.0 and above, the software will disable your search functionality. In cases where license pools have strict quota enabled, search is disabled for the offending license pool member(s) after 45 warnings over a rolling 60-day window for the license pool.

[cpm003]

I don´t know what´s happening

[Stefanie]

On the page you took that screenshot there should be a "Usage Report" button. This will take you to a set of dashboards that will let you look at how much you've ingested over time. On one or more days within the last 30-60 days you ingested more than 1024 MB of data. 

You have a "No enforcement" License meaning after 30 days your searches will not be disabled but if you are constantly having this error message it might be time to look at increasing your license. 

[cpm003]

i recently migrated indexes from a pre-production enviroment, this might be related to