The vmware engine is very configurable and there are a lot of options for tuning down the collection. The first thing that we need to know is what's really blowing out your license, run the following from a splunk search:
index="_internal" group=per_sourcetype_thruput | stats sum(kb) as Data_In_KB by series | eval Data_In_MB=(Data_In_KB/1024) | sort - Data_In_MB
And post the results. This app is a splunk supported app, so support can work directly with you on your issue once a support ticket is open. I'll do what I can without seeing how you have it configured, but more then likely we may need to have you upload a diag from the FA and the splunk search head.
... View more