Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times

[uayub]

Okay once this error is received - Search does not function anymore. Is there any way to search the index for finding the host which is responsible for sending the data which has increased my daily limit? OR once I receive the reset license from sales, how do I go about finding the cause of the issue?

Thanks

Logger

[lukejadamec]

Martin_mueller is correct.
Check out this wiki for searches you can run to investigate your issue:

https://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

[martin_mueller]

You should still be able to search the _internal index to look at metrics.