Okay once this error is received - Search does not function anymore. Is there any way to search the index for finding the host which is responsible for sending the data which has increased my daily limit? OR once I receive the reset license from sales, how do I go about finding the cause of the issue?
Thanks
Logger
Martin_mueller is correct.
Check out this wiki for searches you can run to investigate your issue:
https://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume
You should still be able to search the _internal
index to look at metrics.