Hi,
I looked for an answer on SplunkBase but I didn't find anything clear. Here is my problem :
Yesterday, I installed an universal forwarder on a remote server to get some data in my Splunk indexer. But I got an alert because I indexed a too high volume of data (I am on a Free License : 500MB/day allowed). Today, when I go on Manager > Licensing, I can see the warning for yesterday in the "Permanent" Alert section : "1 license window warning reported by 1 indexer 13 hours ago".
The problem is that there is an other line in the "Current" Alert section :
"1 pool warning reported by 1 indexer Correct by midnight to avoid violation"
. When I click on it, I can see :
"This pool contains slave(s) with 1 warnings" - indexer name - "auto_generated_pool_free" - "free" - "pool_warning_count"
Here is my deployment setup : 1 indexer, 2 forwarders on 2 different remote servers.
What does this "current alert" line mean ? Am I going to get another warning ? Or is it a confirmation of the previous warning ? How can I solve it ?
Hope it's clear, Sorry in case of bad grammar.
Thanks in advance.
Maxime
... View more