Why does license usage all of a sudden jumps above allowance?

[dcmaritime-1]

Our splunk system has never had usage above 6GB for a 10 GB license.  Two weeks ago, the usage jumped to 30GB and on weekends jumps to almost 100GB.  We are locked from searches of course.  Nothing in the system has changed as far as I am aware.  I can pull up a usage report for 30 days and it shows that all this usage is being recorded in the default / main index.  The histogram looks the same for each week, about 30GB per day and over twice that on weekends since this issue has started.  What could cause this?  How can I detect what is sending to default / main index when I can't do any searches?

The deployment hasn't changed since 2019.  There are about 30 servers with forwarders.

[dcmaritime-1]

I am still researching the issue.  I'll post more shortly.

[dcmaritime-1]

Thank you.  I'll try and navigate within the 30 day usage report to get there.

[gcusello]

Hi @dcmaritime-1,

ok, let me know if you solved, in this case, please accept one answer for the other people of Community, otherwise tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @dcmaritime-1,

search in the main index which sourcetypes and sources generated these logs to understand from where they came.

Then, knowing sourcetypes and sources, you can analyze the inputs that use those sourcetypes and sources, to understand if something is changed or if there something new, or if it's correct.

You can also use the License Usage 30 days report to make this analysis

Ciao.

Giuseppe