Getting Data In

Detect inactive index (Not Logging)

tigawi
Engager

Hi,

Is there a way to determine if an index has stopped logging/has gone inactive? I have tried looking through the docs, but am new to splunk and trying to figure this out. I know we can use metadata for hosts and sourcetypes, but doesn't seem to work for indexes.

Any recommendations?

Timo

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Yup.  Something like that. You can also either use strftime to format the latest time or fool splunk to use default formating for _time field 😉

| tstats latest(_indextime) as _time WHERE index=* BY index

View solution in original post

tigawi
Engager

Hey @ashvinpandey ,

Thanks for the reply, will this query work with index=* ? Need to  inactivity for exactly 3 months.

Timo

0 Karma

ashvinpandey
Contributor

@tigawi Yup if you are adding index=* it will show the list of all index with their indexing time of first and last event.
Also, If this reply helps you, an upvote would be appreciated.

ashvinpandey
Contributor

@tigawi try using the below query:

index=<your_index_name>
| stats earliest(_indextime) as etime latest(_indextime) as ltime by index
| convert ctime(etime) ctime(ltime)
| rename etime as "First Event Time" ltime as "Last Event Time"

This query will return the first event time when it was indexed and last event time of the event when it was indexed.
Also, If this reply helps you, an upvote would be appreciated.

PickleRick
SplunkTrust
SplunkTrust

Oi!

No, especially with index=* it's a very heavy search. You're effectively listing all evebts.

For a quick assesment, tstats is a much lighter way to go.

Yes, I know it's prone to give wrong results if you want to list by _time and you have your clocks unsynchronised and are indexing events with badly skewed time but as a quick check - much better.

0 Karma

ashvinpandey
Contributor

@PickleRick Yes tstats wont work in all the environments, yet if you need this can help:

| tstats latest(_indextime) WHERE index=* BY index

Also, If this reply helps you, an upvote would be appreciated.

PickleRick
SplunkTrust
SplunkTrust

Yup.  Something like that. You can also either use strftime to format the latest time or fool splunk to use default formating for _time field 😉

| tstats latest(_indextime) as _time WHERE index=* BY index
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...