we ended up doing a full system restore from backup to the days prior to the start of the warning messages in splunk.   so now search works without error and licensing shows normal,  and as expected, we lose data from the days after backup to the point of restore.  so for example, if I try to search for "yesterday" i get no results.  but that is the price paid for restoring from backup. I guess the question that remains is : how can we in the future "see" what syslog client (or clients) is causing a license warning to be triggered ?  perhaps some security appliance sent an extended (many hours or more) burst of syslogs above the normal rate...but is there an easy way to see that in the splunk web ui ? Regards, jason ... View more