topic Re: Detect inactive index (Not Logging) in Getting Data In

Detect inactive index (Not Logging)

tigawi — Tue, 28 Sep 2021 14:23:12 GMT

Hi,

Is there a way to determine if an index has stopped logging/has gone inactive? I have tried looking through the docs, but am new to splunk and trying to figure this out. I know we can use metadata for hosts and sourcetypes, but doesn't seem to work for indexes.

Any recommendations?

Timo

Re: Detect inactive index (Not Logging)

ashvinpandey — Tue, 28 Sep 2021 14:29:26 GMT

@tigawi try using the below query:

index=<your_index_name> | stats earliest(_indextime) as etime latest(_indextime) as ltime by index | convert ctime(etime) ctime(ltime) | rename etime as "First Event Time" ltime as "Last Event Time"

This query will return the first event time when it was indexed and last event time of the event when it was indexed.
Also, If this reply helps you, an upvote would be appreciated.

Re: Detect inactive index (Not Logging)

tigawi — Tue, 28 Sep 2021 14:33:12 GMT

Hey @ashvinpandey ,

Thanks for the reply, will this query work with index=* ? Need to inactivity for exactly 3 months.

Timo

Re: Detect inactive index (Not Logging)

ashvinpandey — Tue, 28 Sep 2021 14:36:27 GMT

@tigawi Yup if you are adding index=* it will show the list of all index with their indexing time of first and last event.
Also, If this reply helps you, an upvote would be appreciated.

Re: Detect inactive index (Not Logging)

PickleRick — Tue, 28 Sep 2021 14:41:58 GMT

Oi!

No, especially with index=* it's a very heavy search. You're effectively listing all evebts.

For a quick assesment, tstats is a much lighter way to go.

Yes, I know it's prone to give wrong results if you want to list by _time and you have your clocks unsynchronised and are indexing events with badly skewed time but as a quick check - much better.

Re: Detect inactive index (Not Logging)

ashvinpandey — Tue, 28 Sep 2021 14:44:35 GMT

@PickleRick Yes tstats wont work in all the environments, yet if you need this can help:

| tstats latest(_indextime) WHERE index=* BY index

Also, If this reply helps you, an upvote would be appreciated.

Re: Detect inactive index (Not Logging)

PickleRick — Tue, 28 Sep 2021 14:54:02 GMT

Yup. Something like that. You can also either use strftime to format the latest time or fool splunk to use default formating for _time field 😉

| tstats latest(_indextime) as _time WHERE index=* BY index