Detect inactive index (Not Logging)

[tigawi]

Hi,

Is there a way to determine if an index has stopped logging/has gone inactive? I have tried looking through the docs, but am new to splunk and trying to figure this out. I know we can use metadata for hosts and sourcetypes, but doesn't seem to work for indexes.

Any recommendations?

Timo

[tigawi]

Hey @ashvinpandey ,

Thanks for the reply, will this query work with index=* ? Need to  inactivity for exactly 3 months.

Timo

[ashvinpandey]

@tigawi Yup if you are adding index=* it will show the list of all index with their indexing time of first and last event.
Also, If this reply helps you, an upvote would be appreciated.

[ashvinpandey]

@tigawi try using the below query:

index=<your_index_name>
| stats earliest(_indextime) as etime latest(_indextime) as ltime by index
| convert ctime(etime) ctime(ltime)
| rename etime as "First Event Time" ltime as "Last Event Time"

This query will return the first event time when it was indexed and last event time of the event when it was indexed.
Also, If this reply helps you, an upvote would be appreciated.

[PickleRick]

Oi!

No, especially with index=* it's a very heavy search. You're effectively listing all evebts.

For a quick assesment, tstats is a much lighter way to go.

Yes, I know it's prone to give wrong results if you want to list by _time and you have your clocks unsynchronised and are indexing events with badly skewed time but as a quick check - much better.

[ashvinpandey]

@PickleRick Yes tstats wont work in all the environments, yet if you need this can help:

| tstats latest(_indextime) WHERE index=* BY index

Also, If this reply helps you, an upvote would be appreciated.

[PickleRick · Accepted solution]

Yup.  Something like that. You can also either use strftime to format the latest time or fool splunk to use default formating for _time field 😉

| tstats latest(_indextime) as _time WHERE index=* BY index