You can turn on all your inputs at once, and index all the historical logs, get a warning for the first day
(it can be more than 2 day or more if the volume is too important for the indexing speed, or if new inputs/forwarders are added over several days)
If you do not reach 5 days of warnings (3 for a free license) you are not in violation and the warning counter will reset after 30 days without new warning. This is usually a good method to index all your historical data at once. And If you reach a violation, you can always get a reset key from splunk support if you have a support contract.