The license master License Manager interface showed me this
Mar 31, 2011 12:25:57 PM
(just now) This pool is over quota=3196059648 bytes, please correct before midnight
> auto_generated_pool_enterprise enterprise pool_over_quota
However, running the searches below shows total _raw size no where near my pool license limit.
yesterday's volume came to a little over 1 GB:
earliest=-1d@d latest=-0d@d| eval eventsize=len(_raw) | stats sum(eventsize)
today's volume so far came to a little under 2 GB:
earliest=-0d@d | eval eventsize=len(_raw) | stats sum(eventsize)
Why the alert?