Splunk Enterprise

indexes which are not in used in any use case

vinitpathri
Path Finder

i want to see which all feeds are there which are not getting used in any use case or in any report/alert or anything.

kindly suggest me the way to check those indexes

 

Thanks in advance.

Labels (1)
0 Karma

ayush1906
Path Finder

Hi @vinitpathri 

  1. List all the names of indexes

 

 

| eventcount summarize=false index=* index=_* | dedup index | fields index​

2. List all the saved searches alerts 

 

 

 

| rest /servicesNS/-/-/saved/searches 
| search is_scheduled=1 
| table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search​

 

 

3. Compare the search field with the index field by joining these two outputs and running a search command.

 

Did I get your requirement correct? if yes then I can think of creating a join to give  you desired result 🤔

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...