We hit our current licensing max. Still working on setting all of our stuff up properly, so wondering if one of the data inputs grabbed more than it should have. Is there a way to see how much data (in MB) is coming in on a particular data input?
This previous answer will help you understand what is taking up the most data.
http://splunk-base.splunk.com/answers/39748/warning-and-violations-how-to-reduce-my-indexed-volume
