See below screenshot. This screenshot is from Indexing--> License Usage section in DMC. Its shows that index named "default"
has taken up almost 50 GB of our license. However i could not find this index on our indexers. Also below command does not return and index with this name.
| eventcount summarize=false index=* | dedup index | fields index
Can anyone suggest what this could be?
This could be your
main index. Search
index=main to see if it has any data.
main index, by default, holds all your events. It also serves as the default index for any inputs or search commands that don't specify an index name. Meaning, if you do not specify index name either by inputs.conf or transforms.conf, then splunk will make use of default (main) index to store the events. I came across below setting in indexes.conf which explains why it displays as default instead of main.
defaultDatabase = <index name> * If no index is specified during search, Splunk searches the default index. * The specified index displays as the default in Splunk Manager settings. * Defaults to "main".
index=main | stats values(source) by host sourcetype search and note the list of the all the sources and hosts. Track the monitor stanzas which are configured for these sources and define desired index name to avoid landing of events into the