Hi anil1575,
No, there is no such feature in Splunk. It will continue to index, but it will get you a license violation http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Aboutlicenseviolations
There could be a way to stop Splunk at all if it reaches near the 500Mb limit....create a script that pulls the license info over REST and stop the service/process....but then Splunk is stopped completely and you would not be able to search any more.
Like the docs states http://docs.splunk.com/Documentation/Splunk/6.2.0/Admin/Aboutlicenseviolations#How_to_avoid_license_violations , if you're reaching your license limit try reducing the volume sent or get yourself a bigger license.
cheers, MuS
... View more