I had this happen again recently and I figured-out what was happening. The warning was issued sometime between when I went home and midnight. It was caused by another Splunk indexer on my campus to whom I am providing 200 MB of my license -- thus their system is a slave. They had something go nutso and went over their 200 MB, which generated the warning. When I saw it the next day, I went to take a look at the licensing and saw today's (the next day's) statistics, which of course were fine. To see what is going on the day before, go to your base URL for your indexer/master, and add /en-GB/manager/search/licenseusage#historyTab to it (i.e., https://splunk-url:splunkport/en-GB/manager/search/licenseusage#historyTab). Then click on the *Previous 30 days tab. There is a drop-down labled Pool and there find the slave pool in question and select it. You'll get two graphs. The top one is actual usage, in GB, and the bottom one is percentage used. Look for the bar that goes above 100% and that's the slave violation. ... View more