Firstly, the License violation warning basically means Splunk has indexed more data than our purchased quota.  Generally, in this case, to handle a License Violation warning we have to identify which index or which source type has received more data than the usual daily data volume and once we identified a data source that is using a lot of licensed volume, we have to find out source machine which is sending a huge number of logs and root cause for the same.   Based on the below scenario, troubleshooting can be done accordingly. i.e.  Check if this was a one-time data ingestion issue.  Check if this is a new average license usage based upon changes in the infrastructure.  Check if you can filter and drop some of the incoming data.