Thanks. So, just to confirm, if my data has already been indexed (and I have already exceeded my indexing quota), there is nothing that I can do to "un-index" that data? Wouldn't the nullQueue routing just avoid indexing future data? ... View more

This response doesn't provide an answer to the actual question of how to "correct before midnight". I understand that Splunk is warning me because I have exceeded by index quota, but I would like to understand if there is a way for me to remove some of the indexed data so that I can stay below my daily quota. I have already identified where the additional data came from and I have stopped the flow of additional data. How do I correct before midnight? ... View more