Deployment Architecture

Default indexes in Splunk Enterprise

reallyliri
Explorer

My Splunk Enterprise is running for a few months.

I'm sending all my logs (HEC and UDP) to index "main".

However, I see some indexes defined, mainly I'm concerned about the top-consuming ones: _audit, _internal and _introspection.

indexes

What processes are sending data to them? What value is that for me? Is it consuming my license quota? And where can I configure/disable these?

Thanks

0 Karma

renjith_nair
Legend

@reallyliri,

_audit : Events from the file system change monitor, auditing, and all user search history.
- Details : Audit Splunk activity

_internal : This index includes Splunk Enterprise internal logs and metrics.
- Details are in What Splunk software logs about itself

_introspection : Instrumentation data about your Splunk instance and environment and writes that data to log files to aid in reporting on system resource utilization and troubleshooting problems with your Splunk Enterprise deployment .
- More details : About Splunk Enterprise platform instrumentation

About the licensing, it does not count against your license:

Use the "Indexing volume" status dashboard in the Search app to see details about index volume in your infrastructure. Note that the overview includes internal indexing, which does not count against your license.

License violations

Hope that helps!

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...