topic What search can list the Empty indexes which are not sending data to splunk enterprise? in Getting Data In

What search can list the Empty indexes which are not sending data to splunk enterprise?

deepthi5 — Thu, 22 Sep 2022 15:50:45 GMT

Hi team,

I am from admin team i wanted to how many of indexes are empty and are not having data anymore in it so that i can remove those indexes and clean up my indexes.conf

Can we have a query or a way to find this

Re: List the Empty indexes which are not sending data to splunk enterprise

gcusello — Thu, 22 Sep 2022 14:31:19 GMT

Hi @deepthi5,

you have to put a list of your indexes in a lookup, called e.g. indexes.csv containing at least one column called index

then you have to run a search like the following:

Ciao.

Giuseppe

Re: What search can list the Empty indexes which are not sending data to splunk enterprise?

deepthi5 — Mon, 26 Sep 2022 16:31:23 GMT

This is taking tooo long when i run for All Time

Re: What search can list the Empty indexes which are not sending data to splunk enterprise?

johnhuang — Tue, 27 Sep 2022 00:11:29 GMT

Here's a way to see the current size and event count of your indexes:

| rest /services/data/indexes | table title currentDBSizeMB totalEventCount | rename title AS index_name | stats sum(currentDBSizeMB) AS index_size_mb sum(totalEventCount) AS event_ct BY index_name