Deployment Architecture

Default indexes in Splunk Enterprise

reallyliri
Explorer

My Splunk Enterprise is running for a few months.

I'm sending all my logs (HEC and UDP) to index "main".

However, I see some indexes defined, mainly I'm concerned about the top-consuming ones: _audit, _internal and _introspection.

indexes

What processes are sending data to them? What value is that for me? Is it consuming my license quota? And where can I configure/disable these?

Thanks

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@reallyliri,

_audit : Events from the file system change monitor, auditing, and all user search history.
- Details : Audit Splunk activity

_internal : This index includes Splunk Enterprise internal logs and metrics.
- Details are in What Splunk software logs about itself

_introspection : Instrumentation data about your Splunk instance and environment and writes that data to log files to aid in reporting on system resource utilization and troubleshooting problems with your Splunk Enterprise deployment .
- More details : About Splunk Enterprise platform instrumentation

About the licensing, it does not count against your license:

Use the "Indexing volume" status dashboard in the Search app to see details about index volume in your infrastructure. Note that the overview includes internal indexing, which does not count against your license.

License violations

Hope that helps!

Happy Splunking!
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...