https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-find-out-unused-indexes/m-p/304939#M91617 <P>How are you planning to decide on what the total storage allocated for an index? An index can go to maximum size as defined in <CODE>maxTotalDataSizeMB = * The maximum size of an index (in MB)</CODE> OR based on retention period as defined in <CODE>frozenTimePeriodInSecs= * Number of seconds after which indexed data rolls to frozen</CODE>.</P> Tue, 29 Aug 2017 18:08:14 GMT somesoni2 2017-08-29T18:08:14Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-find-out-unused-indexes/m-p/304937#M91615 <P>I am looking for indexes which are utilizing only 10%-20% of storage allocated to them. Can i please know is there any query to find out that.I know that we can look into DMC but i specifically need only the indexes that uses only 10%-20% of storage for last 30 days.</P> Tue, 19 Sep 2023 19:36:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-find-out-unused-indexes/m-p/304937#M91615 kteng2024 2023-09-19T19:36:54Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-find-out-unused-indexes/m-p/304938#M91616 <P>try this</P> <PRE><CODE> | rest /services/data/indexes-extended | table title currentDBSizeMB maxTotalDataSizeMB | eval percent_full = round(currentDBSizeMB/maxTotalDataSizeMB*100, 2) rename COMMENT as "now you can add your where or search clause" | where percent_full =&lt;20 </CODE></PRE> <P>hope it helps</P> Tue, 29 Aug 2017 18:05:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-find-out-unused-indexes/m-p/304938#M91616 adonio 2017-08-29T18:05:30Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-find-out-unused-indexes/m-p/304939#M91617 <P>How are you planning to decide on what the total storage allocated for an index? An index can go to maximum size as defined in <CODE>maxTotalDataSizeMB = * The maximum size of an index (in MB)</CODE> OR based on retention period as defined in <CODE>frozenTimePeriodInSecs= * Number of seconds after which indexed data rolls to frozen</CODE>.</P> Tue, 29 Aug 2017 18:08:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-find-out-unused-indexes/m-p/304939#M91617 somesoni2 2017-08-29T18:08:14Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-find-out-unused-indexes/m-p/657969#M227268 <P>Can you help with a query to find out which indexs are not used&nbsp;</P> Tue, 19 Sep 2023 09:49:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-find-out-unused-indexes/m-p/657969#M227268 Dey1 2023-09-19T09:49:13Z