if you have been using default set of splunk configurations, soon you could also face your entire disk space being filled with splunk's database.....
you can keep a check over that by lowering down its upper-limit over database indices size from several 100s 0f 1000s MBs ((default maxTotalDataSizeMB per index is 500Gigabytes)) to the desired/affordable Size in MBs.
File: /var/ebs/splunk/etc/system/local/indexes.conf
managing index size in Splunk is better covered at
http://blogs.splunk.com/2011/01/03/managing-index-sizes-in-splunk/
File: /var/ebs/splunk/etc/system/local/indexes.conf
maxTotalDataSizeMB = 3000
managing index size in Splunk is better covered at
http://blogs.splunk.com/2011/01/03/managing-index-sizes-in-splunk/
