crcSalt was not enabled for the input. It ended up being a bug in an older version (6.0.1). Upgrading splunk and the universal forwarders to 6.0.6 fixed this issue. ... View more

thanks bmacias84, the query shows that it was indeed the new IIS logs that were breaking the license. sourcetype=iis | eval raw=_raw | convert ctime(_indextime) AS idxtime | stats count AS event_count dc(idxtime) as idxtimes_count, values(source), values(idxtime) by raw | where event_count > 1 is showing that every event is being indexed multiple times. I am still working with support to solve the problem, but I will post any resolution here in case it helps anyone else. ... View more

same here! splunk reporting 22GB of IIS logs for a day, when only 22Mb of IIS logs were found on the server ... View more