Deployment Architecture

Default indexes in Splunk Enterprise


My Splunk Enterprise is running for a few months.

I'm sending all my logs (HEC and UDP) to index "main".

However, I see some indexes defined, mainly I'm concerned about the top-consuming ones: _audit, _internal and _introspection.


What processes are sending data to them? What value is that for me? Is it consuming my license quota? And where can I configure/disable these?


0 Karma



_audit : Events from the file system change monitor, auditing, and all user search history.
- Details : Audit Splunk activity

_internal : This index includes Splunk Enterprise internal logs and metrics.
- Details are in What Splunk software logs about itself

_introspection : Instrumentation data about your Splunk instance and environment and writes that data to log files to aid in reporting on system resource utilization and troubleshooting problems with your Splunk Enterprise deployment .
- More details : About Splunk Enterprise platform instrumentation

About the licensing, it does not count against your license:

Use the "Indexing volume" status dashboard in the Search app to see details about index volume in your infrastructure. Note that the overview includes internal indexing, which does not count against your license.

License violations

Hope that helps!

Happy Splunking!
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...