Hi @pmatakevich, one question: is your problem license consuption or storage occupation? if your problem is license consuption, the only way to intervene is to disable some input (in inputs.conf) , as e.g. perfmons, to reduce the volume od indexed logs. You could also reduce (in inputs.conf) the frequency of scripts' execution, but redution isn't so high. If instead your problem is storage, you can intervene as before limiting inputs or reducing retention (modifying the frozenTimePeriodInSecs parameter in indexes.conf.) or max index size (https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Configureindexstoragesize). Ciao. Giuseppe ... View more