topic How to find out unused indexes in DMC? in Splunk Search

How to find out unused indexes in DMC?

AbilashSe — Mon, 04 Sep 2017 04:34:56 GMT

Could anyone please help to find out unused indexes in Splunk DMC

Re: How to find out unused indexes in DMC?

inventsekar — Mon, 04 Sep 2017 06:02:17 GMT

unused indexes meaning, indexes that didnt receive data for how long? or never received any data at all?!?! (empty index)

Re: How to find out unused indexes in DMC?

AbilashSe — Mon, 04 Sep 2017 06:04:38 GMT

Indexes which didn't receive data for long time.

Re: How to find out unused indexes in DMC?

gcusello — Mon, 04 Sep 2017 11:19:15 GMT

Hi AbilashSe,
if you want to see unused indexes you could go in [Indexing -- Indexes and Volumes -- Index Detail: Deployment], and see for each Index if it doesn't receive logs for a long time.
If you want a report of last and first event of each index use something like this

| rest splunk_server_group=dmc_group_indexer splunk_server_group="*" /services/data/indexes | table title maxTime minTime

Bye.
Giuseppe

Re: How to find out unused indexes in DMC?

AbilashSe — Mon, 04 Sep 2017 11:23:58 GMT

Hi Giuseppe,

Thanks for the update..
I would like to get the count of unused indexes.

could you please help me.?

Regards,
Abilash

Re: How to find out unused indexes in DMC?

gcusello — Mon, 04 Sep 2017 11:44:03 GMT

Hi AbilashSe,
when you say "unused indexes", do you mean:

indexes without events,
indexes with events older than a date (e.g. "2017-09-04 8:00:00")?

in first case

| rest splunk_server_group=dmc_group_indexer splunk_server_group="*" /services/data/indexes
| eval indexSizeGB = if(currentDBSizeMB >= 1 AND totalEventCount >=1, currentDBSizeMB/1024, null())
| stats  sum(indexSizeGB) AS totalSize BY title 
| where totalSize=0
| table title

In the second case run something like this

| rest splunk_server_group=dmc_group_indexer splunk_server_group="*" /services/data/indexes 
| eval 
     time_limit=strptime("2017-09-04 8:00:00","%Y-%m-%d %H:%M:%S"),
     maxTime=strptime(time_limit,"%Y-%m-%dT%H:%M:%S")
| where maxTime<time_limit
| table title maxTime minTime

Bye.
Giuseppe

Re: How to find out unused indexes in DMC?

faisal_mansour — Thu, 08 Dec 2022 07:49:02 GMT

Thanks for the query, i developed it to be something usable....

| rest splunk_server_group=dmc_group_indexer splunk_server_group="*" /services/data/indexes | stats max(maxTime) AS latestEvent BY title | eval elapsedTime = now() - strptime(latestEvent,"%Y-%m-%dT%H:%M:%S%z"), daysSince = ceiling(elapsedTime / 86400) | eval daysSinceLastEvent = case(daysSince<0, -1, daysSince=0, 0, daysSince>0,daysSince) | eval indexStatus = case(daysSinceLastEvent>730, "Nothing Since 2 years", daysSinceLastEvent<730 AND daysSinceLastEvent>365, "Nothing Since last year", daysSinceLastEvent<365 AND daysSinceLastEvent>0, "used in last year", daysSinceLastEvent=0, "Till today", daysSinceLastEvent<0, "bad future timestamp") | fields title latestEvent daysSinceLastEvent indexStatus