Should I use an empty index as a placeholder for the data models without any data

[Iris_Pi]

Hello Everyone,

I'm trying to add index filtering for the datamodels in my setup. I found for some datamodels such as Vulnerabilities, there's no matching data at all.  In this case, should I create an empty index for these datamodels? so that splunk won't do useless search for them.

Please also know me if there are better solution for this case.

Thanks & Regards,
Iris

[isoutamo]

If you are taking about CIM DMs, then there are tags which it’s using to select events into specific DM. You could restrict the base search by separate white list of indexes. This makes updating the DM more efficient as it’s not need to look all indexes to find needed events.
Usually there is no need / sense to create empty / dummy index fort that, you should just add your current indexes where that data is, into this field.

[Iris_Pi]

Thank you for your reply.

I am doing what you mentioned: "You can restrict basic searches by whitelisting individual indices. This makes updating DM more efficient as there is no need to look through all indices to find the desired events".

I've added index whitelists for some of the data models. However, for some of them, I have no data ingested, so I thought maybe I should use dummy index for those data models that I don't have data for, so that splunkd doesn't need to search all indexes with certain tags and return nothing.

[isoutamo · Accepted solution]

I'm quite sure that then it helps to update empty DM quicker than looking through all indexes. Also can also update times for looking updates into it and one optimization could be to update update frequency, but as you haven't data and just add individual empty index there those are not needed to get DM updated enough quickly.
You should also check from MC that you haven't any skipped searches due to this DM update.
MC -> Search -> Scheduler (or something similar, couldn't remember those exact names)