Starting with version 6.5.0, Splunk Enterprise no longer disables searches when you exceed your licensed data ingestion quota. If you’re an existing customer, you will need to upgrade your licensed production deployment (or at least the Licensing Master) to 6.5.0 and request a “no-enforcement” license key from your Splunk Sales Rep or Splunk Authorized Partner. For all the details, refer to the Metered License Enforcement FAQ at www.splunk.com/en_us/resources/splunk-enterprise-metered-license-enforcement-faq.html
... View more