Hi @minhquannguyen7, it's easy:you have two solutions to this issue: buying an additional license, reduce some data flows. In other words, analyze your data identifying the larger data flows and see if you can reduce some of them disabling the related inputs or filtering events, discarding non so interesting events, for more infos see at https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues). Ciao. Giuseppe ... View more

thanks you @santoshneelam !  i want extract in the different log with any field look like this , what shoud i do ???   ... View more