License pools let you allocate portions of your total license volume to different groups of indexers. This helps manage data distribution across your environment.
A license violation occurs when you exceed your daily indexing volume. If violations occur on 5 of the last 30 rolling days, search functionality is blocked until the violation window clears.
You can monitor license usage in Splunk Web under Settings > Licensing, or by searching the _internal index.
index=_internal source=*license_usage.log type=Usage
| stats sum(b) as bytes by pool
| eval GB = round(bytes/1024/1024/1024, 2)