How to compare data for specific days

[afolabia]

How can I find out what changed in my Splunk Windows environment or how can I compare daily ingested data between days. Up to 4 days ago, my Splunk daily license used was about 50%, now it's down to about 25% almost half of what it has been.
My domain environment is still the same, with the the exception of Kiwi Syslog upgrade with the same rules and configurations and logs are been generated and ingested, so unless

[gcusello]

Hi @afolabia,
you could start using the Splunk Monitoring Console and see what you're ingesting [Settings -- Monitoring Console -- Indexing -- Inputs].
In addition you could use the License Consuption Report (Last 30 days) divided by index or sourcetype so you can understand where's the larger growth and understand if it's aligned with your plan or not.
In addition you could also check if the number of sending hosts is always the same: you can use a simple search ( | metasearch index=* | timechart count BY host).

Ciao.
Giuseppe