Start with the Monitoring Console. Go to Indexing->License Usage->Historic License Usage days and split the results by index, sourcetype, host, and source (one at a time). Look for one value that is much bigger than the others. The next step depends on what you found. Disable the input (in inputs.conf) for huge sources or sourcetypes you don't need. Common verbose sources include Windows events, DNS, DHCP, and firewalls. If one or hosts stand out, check them to see what they are sending. Turn off unnecessary inputs. Keep an eye out for DEBUG events in your indexes. Those rarely are needed for more than a day or so. If you don't know about it already, check out this great resource for those who inherit a Splunk environment: https://docs.splunk.com/Documentation/Splunk/latest/InheritedDeployment/Introduction
... View more