why a new warning about daily indexing volume exceeded?

[wsw70]

I got yesterday a warning about daily indexing volume exceeded. The warning was correct, I made a mistake with one of the data source. This was corrected yesterday.

This morning I see two warnings: a permanent one (the one from yesterday) and a current one (the same I saw yesterday). How come it is re-issued since I do not see anything suspicious in the view suggested by the docs?

The view for yesterday was:

series  sum(MB)
vsec2dsy    1920.6647500677
ips_cisco   132.3562946397
_internal   61.512698216
trendmicro  18.6259823111
_audit  4.6508560657
main    0.9820251170
iwsva   0.8498468754
nessus2 0.174271584
officescancompliance    0.132205010

I have a license for 1GB, exceeded by the vsec2dsy index.

The view for today:

series  sum(MB)
ips_cisco   64.9516515819
_internal   23.472163197
trendmicro  5.9117831667
_audit  1.2491817557
vsec2dsy    0.379042632
main    0.234364522
iwsva   0.120780947

So everything is fine.

Why the warning then?

[wsw70 · Accepted solution]

Well, since the warning disappeared, it looks like there is a running 24h window for its presence (in the sense that if the issue appears at 16:00 on a given day it will stay until 16:00 the next day, even though the indexing counters are reset at midnight).

This is a guess but since there are no other inputs I will close the question as it.