License Pools & Violations

License pools let you allocate portions of your total license volume to different groups of indexers. This helps manage data distribution across your environment.

A license violation occurs when you exceed your daily indexing volume. If violations occur on 5 of the last 30 rolling days, search functionality is blocked until the violation window clears.

You can monitor license usage in Splunk Web under Settings > Licensing, or by searching the _internal index.

index=_internal source=*license_usage.log type=Usage
| stats sum(b) as bytes by pool
| eval GB = round(bytes/1024/1024/1024, 2)