Getting Data In

Detect inactive index (Not Logging)

tigawi
Engager

Hi,

Is there a way to determine if an index has stopped logging/has gone inactive? I have tried looking through the docs, but am new to splunk and trying to figure this out. I know we can use metadata for hosts and sourcetypes, but doesn't seem to work for indexes.

Any recommendations?

Timo

Labels (1)
0 Karma
1 Solution

PickleRick
Ultra Champion

Yup.  Something like that. You can also either use strftime to format the latest time or fool splunk to use default formating for _time field 😉

| tstats latest(_indextime) as _time WHERE index=* BY index

View solution in original post

tigawi
Engager

Hey @ashvinpandey ,

Thanks for the reply, will this query work with index=* ? Need to  inactivity for exactly 3 months.

Timo

0 Karma

ashvinpandey
Contributor

@tigawi Yup if you are adding index=* it will show the list of all index with their indexing time of first and last event.
Also, If this reply helps you, an upvote would be appreciated.

ashvinpandey
Contributor

@tigawi try using the below query:

index=<your_index_name>
| stats earliest(_indextime) as etime latest(_indextime) as ltime by index
| convert ctime(etime) ctime(ltime)
| rename etime as "First Event Time" ltime as "Last Event Time"

This query will return the first event time when it was indexed and last event time of the event when it was indexed.
Also, If this reply helps you, an upvote would be appreciated.

PickleRick
Ultra Champion

Oi!

No, especially with index=* it's a very heavy search. You're effectively listing all evebts.

For a quick assesment, tstats is a much lighter way to go.

Yes, I know it's prone to give wrong results if you want to list by _time and you have your clocks unsynchronised and are indexing events with badly skewed time but as a quick check - much better.

0 Karma

ashvinpandey
Contributor

@PickleRick Yes tstats wont work in all the environments, yet if you need this can help:

| tstats latest(_indextime) WHERE index=* BY index

Also, If this reply helps you, an upvote would be appreciated.

PickleRick
Ultra Champion

Yup.  Something like that. You can also either use strftime to format the latest time or fool splunk to use default formating for _time field 😉

| tstats latest(_indextime) as _time WHERE index=* BY index
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...