Our splunk system has never had usage above 6GB for a 10 GB license.  Two weeks ago, the usage jumped to 30GB and on weekends jumps to almost 100GB.  We are locked from searches of course.  Nothing in the system has changed as far as I am aware.  I can pull up a usage report for 30 days and it shows that all this usage is being recorded in the default / main index.  The histogram looks the same for each week, about 30GB per day and over twice that on weekends since this issue has started.  What could cause this?  How can I detect what is sending to default / main index when I can't do any searches? The deployment hasn't changed since 2019.  There are about 30 servers with forwarders. ... View more