License usage is based on your raw data volumes, not counting any data in the
_internal index or any summary index. Based on your question, I assume you're looking in the bucket directory structure at these files. The rawdata files themselves don't necessarily correlate to license usage because they are compressed.
Where do I check what is eating up at my license. been receiving the following message for the past few days:
Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK.