Get list of active indexes that are ingesting logs

[koyachi]

Hello,

We have a splunk instance where we have configured security related logs. There are hundreds of indexes created on the instance and now we are planning to disable indexes that are no longer active.

These security logs are now either going to Azure or they are no longer needed so they were stopped by the stakeholders. I am looking for a query that can give me the list of indexes with the most recent event timestamp in respective indexes.

with this details plan is to look for the indexes that have event older than 1 month and consider them as migrated/no longer needed.

[ITWhisperer]

| metasearch index=*
| stats latest(_time) as _time by index

[gcusello · Accepted solution]

Hi @koyachi,

you could run something like this:

| tstats count latest(_time) AS latest WHERE index=* BY index
| eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S")

Ciao.

Giuseppe

[koyachi]

Thanks @gcusello . This gives me the info what i need.

[gcusello]

Hi @koyachi ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉