Splunk Enterprise collecting too much data and is maxing out License usage

[HugeAndre3000]

Hello Good people,

I am pretty new to the splunk community. I have inherited a splunk enterprise application. The Splunk server on weekdays is being forwarded around 45GB of data, daily, mon-fri. On the weekends it increases to 80GB per day, which seems to be odd since no one is on the network on the weekends.

Where would I begin to look at configuration files in order to decrease the amount of data being sent?

Also, our license limit is only 15GB.

[richgalloway]

Start with the Monitoring Console.  Go to Indexing->License Usage->Historic License Usage days and split the results by index, sourcetype, host, and source (one at a time).  Look for one value that is much bigger than the others.

The next step depends on what you found.

Disable the input (in inputs.conf) for huge sources or sourcetypes you don't need.  Common verbose sources include Windows events, DNS, DHCP, and firewalls.

If one or hosts stand out, check them to see what they are sending.  Turn off unnecessary inputs.

Keep an eye out for DEBUG events in your indexes.  Those rarely are needed for more than a day or so.

If you don't know about it already, check out this great resource for those who inherit a Splunk environment: https://docs.splunk.com/Documentation/Splunk/latest/InheritedDeployment/Introduction