We have updated our licensing policy! For on-premises license stacks of less than 100GB on Splunk Enterprise 8.1.0 and above, Splunk will disable search when license limits are violated after 45 warnings within a 60-day rolling window. For more details, check out the Licensing Enforcement FAQ.