Distributed license management for a data limited application

A computer-implemented method, the method comprising:

• indexing, by a first computing device operating as a first indexer, a first type of first event data as first indexed data for searching;
• transmitting, by the first indexer to a manager device, first monitored information generated by the first indexer and based on the first type of the first event data;
• processing, by the manager device, the first monitored information to determine a first size of the first type of the first event data;
• processing, by the manager device, second monitored information to determine, a second size of the first type of the first event data that has been indexed by a second computing device operating a second indexer;
• combining, by the manager device, the first size and at least the second size to determine a combined size of indexed data that has been indexed by a plurality of indexers including the first indexer and the second indexer;
• determining, by the manager device:
• an indexing quota associated with a threshold size of the first type of the first event data that can be indexed by the plurality of indexers;
• and
• one or more corrective actions to be performed upon determining that the indexing quota has been exceeded;
• determining, by the manager device, that the combined size of indexed data exceeds the indexing quota;
• identifying, by the manager device, in response to determining that the combined size of the indexed data exceeds the indexing quota, a first corrective action from the one or more corrective actions;
• outputting, by the manager device to the first indexer, one or more commands based on the first corrective action;
• and
• responding, by at least the first indexer to the one or more commands, by modifying further indexing operations on the first type of the first event data to ensure compliance with the indexing quota or obtaining an additional license to increase the indexing quota.

A computing device, comprising:

• a computer-readable memory that stores instructions, and
• a processor that is coupled to the computer-readable memory and, when executing the instructions, is configured to:
• index, by a first indexer, a first type of first event data as first indexed data for searching;
• transmit, by the first indexer to a manager device, first monitored information generated by the first indexer and based on the first type of the first event data;
• process, by the manager device, the first monitored information to determine a first size of the first event data;
• process, by the manager device, second monitored information to determine, a second size of the first type of the first event data that has been indexed by a second indexer;
• combine the first size and the second size to determine a combined size of indexed data that has been indexed by a plurality of indexers including the first indexer and the second indexer;
• determine, by the manager device:
• an indexing quota associated with a threshold size of the first type of the first event data that can be indexed by the plurality of indexers, and
• one or more corrective actions to be performed upon determining that the indexing quota has been exceeded;
• determine that the combined size of indexed data exceeds the indexing quota;
• identify, in response to determining that the combined size of indexed data exceeds the indexing quota, a first corrective action from the one or more corrective actions;
• output, by the manager device to the first indexer, one or more commands based on the first corrective action;
• and
• respond, by at least the first indexer the one or more commands, by modifying further indexing operations on the first type of the first event data to ensure compliance with the indexing quota or obtaining an additional license to increase the indexing quota.