[monitor::/opt/log/crashlog/Jan27crash.txt]. This stanza means that Splunk is monitoring a single local file named Jan27crash.txt in the /opt/log/crashlog/ directory1. The monitor input type is used to monitor files and directories for changes and index any new data that is added2.

https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Aboutlicenseviolations
"An Enterprise license stack with a license volume of 100 GB of data per day or more does not currently violate."

In Splunk Enterprise, license warnings occur when the daily indexing volume exceeds the licensed quota.
These warnings are tracked from midnight to midnight based on the system clock of the license manager. If the number of warnings surpasses the allowed threshold within a specified period, a license violation ensues, potentially restricting search capabilities.
To prevent a license warning from escalating to a violation, administrators have until midnight to address the issue. The recommended action is toadd a new licenseto the license manager before midnight. This increases the daily indexing volume quota, ensuring that the current day's data ingestion falls within the permissible limits.
It's important to note that deleting data from indexers or the license manager does not retroactively reduce the recorded license usage for the day. Once data is indexed, it contributes to the day's license volume, and its removal does not negate that contribution.
Reference:
About license violations - Splunk Documentation

https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Howindexingworks