Splunk License usage over Limit

[Mescudi]

Our Splunk license usage hit 100% we are not sure how this is happening. We check the DMC and it shows two of our servers and a few clients are sending excessive amounts of event. This  was not happening before, turns out someone was messing with the config files on our Splunk server. Would anyone know which config files are causing the issue?  All local input config files were in some way modified. 

[richgalloway]

Excess data probably is the result of someone adding or enabling entries in inputs.conf files.  There are other changes that could do it, but inputs.conf is the main one.

Detecting changes can be tricky.  I know of at least one customer that has a monitor:// stanza for all of their .conf files so changes are in Splunk and can be alerted.  There's also the _configtracker feature in Splunk 9 that may be of use.