Getting Data In

Indexes appear in usage report but not in indexes.conf or on indexer

Path Finder

I just inherited a stand alone splunk instance and when I run the usage report by indexes, I see a couple of indexes that are ingesting data on a daily basis but I don't see those indexes in the indexes.conf or an folders for those indexes on the indexer.

Has anyone seen this before?

Tags (1)
0 Karma

Ultra Champion

If it is a stand alone splunk,
navigate to settings -> indexes and and check the apps under App column.
there is a good posibilty there are different apps that has different indexes.conf
the TA for Windows for example has 3 indexes shipped with it: windows wineventlogs and perfmon
Or use this to search the rest endpoint and discover via search bar:

| rest /services/data/indexes 
| table title 

hope it helps and you find your indexes

0 Karma


Chances are pretty good they are summary indexes and/or related to data model acceleration or report acceleration. The data will be stored in stash files, unless the collect command specifies a new sourcetype. Not sure whether license usage reports show the indexes that are using stash - it's not billable, but that doesn't necessarily mean it isn't on the report.

Check the section on this page about "Example of a summary index configuration" to see what to look for in savedsearches.conf ...

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...