How to find the start time of the same error being spammed

[kevinfehrenbach]

So I am having an issue where my Splunk logs from a particular source type pumps out trillions and trillions of logs that I am convinced that we don't need. But I am trying to find out when exactly the influx of logs came in.
What kind of search would I write to find that?
Splunk noob, I know.

[woodcock]

The easiest way is to go to your Monitoring Console and look at the License Usage dashboards.

[richgalloway]

Start with this query over a large enough time window to cover when the spamming started. DIsplay the results as a visualization and you should easily spot the day it started. If you need to be more specific, change the time window to that day and set span=1h.

| tstats count where index=foo sourcetype=bar by _time span=1d