Common data flow issues: Forwarder cannot reach indexer (check `outputs.conf`, firewall rules, port 9997). Indexer receives data but events are malformed (check `props.conf` parsing).
License violations occur when daily indexed volume exceeds the license quota. Five violations in a 30-day rolling window creates a "license violation state" that blocks search.