We are getting a pool_over_quota license alert that is growing every day. Our reporting hasn't changed but the reported "Volume used" is increasing everyday by about the amount that we should be using in a day (e.g. instead of showing 10G used each day, on Monday it showed 10G, on Tuesday is show 20G, Wednesday 30G, etc). It seems the usage counter is not resetting or rolling over at midnight. I ran the following search (derived from another splunk answers post) index=_internal source=*license_usage* type=RolloverSummary and it shows no events since the 14th. How can we fix this and will we need a reset license (as mentioned in http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Aboutlicenseviolations#What_are_license_violations_and_warnings.3F) to do so? Thanks for any help ... View more