topic Re: Spunk indexes in Knowledge Management

Spunk indexes

ZombieT — Thu, 02 Nov 2023 04:49:10 GMT

Hello, I am fairly familiar to spunk, but I do need to improve on indexes. I am currently working on a new client environment and they have a large amount of indexes within splunk, however some of them are inactive.

A couple of question:

>How can I determine if an index is active/connected properly

>is there an easier way to show the above; for example if there's 100 indexes how can I find out which are still active in a graph or a more visual view.

Hope it makes sense. Thank you in advance for any advice.

Re: Spunk indexes

gcusello — Thu, 02 Nov 2023 07:26:53 GMT

Hi @ZombieT,

if you have to advice your customer about indexes, remember always that an index is a silos that contains all kind of events with the same retention time and the same access grants: an index isn't a database table; you define data characteristics using sourcetype, not index.

Anyway, you can know if an index is used, and if not, when it was used for the last time running a search like this:

| eventcount summarize=false index=* | dedup index

or better

Ciao.

Giuseppe

Re: Spunk indexes

ZombieT — Thu, 02 Nov 2023 08:07:51 GMT

Great response, mille grazie Giuseppe;

On the back of that if say the client asks to show them a simpler way for example a gui way, how do I go about checking that; thank you in advance.

Re: Spunk indexes

gcusello — Thu, 02 Nov 2023 08:16:00 GMT

@ZombieT ,

the best way is the Monitoring Console in which you have all the information about all Indexes, but if they are hundreds it will not be so easy to read!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉