https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398795#M172019 <P>There is no way to know what data has been looked at and what has not. Splunk does not track that. Even if it did, data in Splunk cannot be removed. Also, just because data is not being used today does not mean it won't be needed tomorrow.</P> <P>That said, it may be good to review your data sources and verify with your users that each source is still needed.</P> Fri, 05 Apr 2019 14:00:25 GMT richgalloway 2019-04-05T14:00:25Z https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398792#M172016 <P>Hi,<BR /> Can I in someway create an list that shows unused data in a specific index? Is it possible?</P> Thu, 04 Apr 2019 13:37:34 GMT https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398792#M172016 amirarsalan 2019-04-04T13:37:34Z https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398793#M172017 <P>please elaborate, what do you mean by: "unused data"?</P> Thu, 04 Apr 2019 13:44:30 GMT https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398793#M172017 adonio 2019-04-04T13:44:30Z https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398794#M172018 <P>@adonio I mean like information that is not necessary in search that can be removed</P> Fri, 05 Apr 2019 11:59:35 GMT https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398794#M172018 amirarsalan 2019-04-05T11:59:35Z https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398795#M172019 <P>There is no way to know what data has been looked at and what has not. Splunk does not track that. Even if it did, data in Splunk cannot be removed. Also, just because data is not being used today does not mean it won't be needed tomorrow.</P> <P>That said, it may be good to review your data sources and verify with your users that each source is still needed.</P> Fri, 05 Apr 2019 14:00:25 GMT https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398795#M172019 richgalloway 2019-04-05T14:00:25Z https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398796#M172020 <P>Thanks, but is it any way then to see or review the data sources in a splunk search?</P> Thu, 11 Apr 2019 13:11:38 GMT https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398796#M172020 amirarsalan 2019-04-11T13:11:38Z https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398797#M172021 <P>I suppose you could analyze the search dispatch directories, but they are not ingested into Splunk so that would be an "offline" task.</P> Thu, 11 Apr 2019 14:48:47 GMT https://community.splunk.com/t5/Splunk-Search/Create-an-list-that-shows-unused-data-in-specific-index/m-p/398797#M172021 richgalloway 2019-04-11T14:48:47Z