https://community.splunk.com/t5/Splunk-Enterprise/Splunk-License-usage-over-Limit/m-p/633926#M15653 <P>Our Splunk license usage hit 100% we are not sure how this is happening. We check the DMC and it shows two of our servers and a few clients are sending excessive amounts of event. This&nbsp; was not happening before, turns out someone was messing with the config files on our Splunk server. Would anyone know which config files are causing the issue?&nbsp; All local input config files were in some way modified.&nbsp;</P> Thu, 09 Mar 2023 17:29:31 GMT Mescudi 2023-03-09T17:29:31Z https://community.splunk.com/t5/Splunk-Enterprise/Splunk-License-usage-over-Limit/m-p/633926#M15653 <P>Our Splunk license usage hit 100% we are not sure how this is happening. We check the DMC and it shows two of our servers and a few clients are sending excessive amounts of event. This&nbsp; was not happening before, turns out someone was messing with the config files on our Splunk server. Would anyone know which config files are causing the issue?&nbsp; All local input config files were in some way modified.&nbsp;</P> Thu, 09 Mar 2023 17:29:31 GMT https://community.splunk.com/t5/Splunk-Enterprise/Splunk-License-usage-over-Limit/m-p/633926#M15653 Mescudi 2023-03-09T17:29:31Z https://community.splunk.com/t5/Splunk-Enterprise/Splunk-License-usage-over-Limit/m-p/633935#M15654 <P>Excess data probably is the result of someone adding or enabling entries in inputs.conf files.&nbsp; There are other changes that could do it, but inputs.conf is the main one.</P><P>Detecting changes can be tricky.&nbsp; I know of at least one customer that has a monitor:// stanza for all of their .conf files so changes are in Splunk and can be alerted.&nbsp; There's also the _configtracker feature in Splunk 9 that may be of use.</P> Thu, 09 Mar 2023 19:24:57 GMT https://community.splunk.com/t5/Splunk-Enterprise/Splunk-License-usage-over-Limit/m-p/633935#M15654 richgalloway 2023-03-09T19:24:57Z