You could create a simple shell script that runs rpm -qa or dpkg --get-selections or any other preferred way of listing installed packages, and set the script up as a scripted input. Then you can run the | diff command on the data that is indexed to see changes. ... View more

You'll see the error until you restart splunk, presuming it is the blue error in the top of UI. The license violation will be recorded in your license statistics, and will stay there permanently, however, the product will not be affected until you go over 5 violations within a 30 day period. At that point, searching will be disabled. If you look at the link below under 'Set up a scheduled search to alert you if a license violation occurs'. http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume ... View more