topic Re: What is the purpose of Report "Audit - Index Readiness" under SA-Utils apps ? in Knowledge Management

What is the purpose of Report "Audit - Index Readiness" under SA-Utils apps ?

ekcsoc — Mon, 30 Sep 2019 05:25:17 GMT

This Report "Audit - Index Readiness" under SA-Utils apps is running for every 30 minutes for last 24 hours time range and getting skipped in Search head. Just wanted to know what is the purpose of this report and can it be disabled ?

Re: What is the purpose of Report "Audit - Index Readiness" under SA-Utils apps ?

harsmarvania57 — Mon, 30 Sep 2019 07:49:47 GMT

What is the Splunk ES version ? I can't see that report in ES 5.2

Re: What is the purpose of Report "Audit - Index Readiness" under SA-Utils apps ?

BainM — Mon, 30 Sep 2019 11:38:10 GMT

It is exactly what it states. It searches all Splunk indexers and evaluates whether an indexer is sending throughput to the metrics.log group. If it detects throughput, cool, assign a 1 to it. If it doesn't it gets a 0. It then writes this to a lookup file and a report. I would assume that this rolls up into a general Splunk health report for the security audits. Security needs continuity and responsiveness. If it doesn't get this from the Splunk env, then it has a problem.

Hope this helps,
Mike

Re: What is the purpose of Report "Audit - Index Readiness" under SA-Utils apps ?

ekcsoc — Tue, 01 Oct 2019 09:45:33 GMT

ES version - 5.3.1

Re: What is the purpose of Report "Audit - Index Readiness" under SA-Utils apps ?

ekcsoc — Thu, 03 Oct 2019 07:50:40 GMT

Thanks for the info. I wanted to know exactly in which Dashboard this is being used, since its not schedule to send an email or throw an alert

Re: What is the purpose of Report "Audit - Index Readiness" under SA-Utils apps ?

ssmiesko — Sun, 26 Apr 2020 01:29:20 GMT

The saved search Audit - Index Readiness, along with a few other searches in SA-Utils and the lookups the write out to, are the basis for the data returned by the contentinfo REST endpoint. These are then queried by various dashboards (like ESS Content Library) in order to show whether or not data is available for use-cases.

Re: What is the purpose of Report "Audit - Index Readiness" under SA-Utils apps ?

ashishamalviya1 — Tue, 04 Jan 2022 17:51:04 GMT

As this search is heavy on search head, as running every 30 min and search for last 24 hour for all the index, can we customize this search to be lighter on CPU,
i.e. edit search query, increase schedule interval and reduce search time frame. etc..
Thanking,

Ashish M

Re: What is the purpose of Report "Audit - Index Readiness" under SA-Utils apps ?

lesly_trinidad — Fri, 28 Oct 2022 04:04:57 GMT

i'm wondering this same thing, can the schedule be modified since it's pretty resource intensive. Haven't seen a response on this thread in while.