topic Get list of active indexes that are ingesting logs in Getting Data In

Get list of active indexes that are ingesting logs

koyachi — Mon, 06 Nov 2023 12:08:24 GMT

Hello,

We have a splunk instance where we have configured security related logs. There are hundreds of indexes created on the instance and now we are planning to disable indexes that are no longer active.

These security logs are now either going to Azure or they are no longer needed so they were stopped by the stakeholders. I am looking for a query that can give me the list of indexes with the most recent event timestamp in respective indexes.

with this details plan is to look for the indexes that have event older than 1 month and consider them as migrated/no longer needed.

Re: Get list of active indexes that are ingesting logs

gcusello — Mon, 06 Nov 2023 12:23:02 GMT

Hi @koyachi,

you could run something like this:

| tstats count latest(_time) AS latest WHERE index=* BY index | eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S")

Ciao.

Giuseppe

Re: Get list of active indexes that are ingesting logs

ITWhisperer — Mon, 06 Nov 2023 12:26:17 GMT

| metasearch index=* | stats latest(_time) as _time by index

Re: Get list of active indexes that are ingesting logs

koyachi — Mon, 06 Nov 2023 12:31:58 GMT

Thanks @gcusello . This gives me the info what i need.

Re: Get list of active indexes that are ingesting logs

gcusello — Mon, 06 Nov 2023 12:37:29 GMT

Hi @koyachi ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉