Archive
Highlighted

List of indexes not referenced in the last 30 days

New Member

I am in need of a query that will list indexes not searched in the last 30 days.

Tags (1)
0 Karma
Highlighted

Re: List of indexes not referenced in the last 30 days

Motivator

Hello @sumaitasiddiky

please check the second answer by @ssievert_splunk : https://answers.splunk.com/answers/557131/index-hit-by-searches-in-last-30-days.html

Unless your users explicitly specify index=xxx in their search, you cannot do this since there is no audit log of what indices were implicitly accessed based on a users' permissions.

You can try to workaround this restriction by joining several searches:

  • searches with indexes from audit log
  • searches with sourcetype or source -> map to indexes
  • other searches -> run them and get references index(es)

Let me know if it helps

0 Karma