Splunk _internal logs consuming license?

[kalyanilandge]

Hi Team,

I have 5 GB enterprise license.We have created 8 indexes in splunk. From few days there were no data observed on created indexes,
but still license has been used and we met license violation.
I am not able to find any data on search head. Does that mean the _internal logs consuming license.?
Anyone faced this issue?
Please suggest a solutions?

Thnaks & Regards,
Kalyani

[richgalloway]

All internal indexes (internal and all other index names starting with '') do not count against your license. If you have a license violation then you must have ingested more than 5GB into your indexes. Use the Monitoring Console to run License Usage and Index Detail reports. They should help identify the source of the violation.