Splunk Enterprise

indexes which are not in used in any use case

Path Finder

i want to see which all feeds are there which are not getting used in any use case or in any report/alert or anything.

kindly suggest me the way to check those indexes


Thanks in advance.

Labels (1)
0 Karma

Path Finder

Hi @vinitpathri 

  1. List all the names of indexes



| eventcount summarize=false index=* index=_* | dedup index | fields index​

2. List all the saved searches alerts 




| rest /servicesNS/-/-/saved/searches 
| search is_scheduled=1 
| table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search​



3. Compare the search field with the index field by joining these two outputs and running a search command.


Did I get your requirement correct? if yes then I can think of creating a join to give  you desired result 🤔

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...