Getting Data In

Indexes appear in usage report but not in indexes.conf or on indexer

sidekix24
Path Finder

I just inherited a stand alone splunk instance and when I run the usage report by indexes, I see a couple of indexes that are ingesting data on a daily basis but I don't see those indexes in the indexes.conf or an folders for those indexes on the indexer.

Has anyone seen this before?

Tags (1)
0 Karma

adonio
Ultra Champion

If it is a stand alone splunk,
navigate to settings -> indexes and and check the apps under App column.
there is a good posibilty there are different apps that has different indexes.conf
the TA for Windows for example has 3 indexes shipped with it: windows wineventlogs and perfmon
Or use this to search the rest endpoint and discover via search bar:

| rest /services/data/indexes 
| table title eai:acl.app 

hope it helps and you find your indexes

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Chances are pretty good they are summary indexes and/or related to data model acceleration or report acceleration. The data will be stored in stash files, unless the collect command specifies a new sourcetype. Not sure whether license usage reports show the indexes that are using stash - it's not billable, but that doesn't necessarily mean it isn't on the report.

Check the section on this page about "Example of a summary index configuration" to see what to look for in savedsearches.conf ...

http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Configuresummaryindexes

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...