Splunk Search

Create an list that shows unused data in specific index

amirarsalan
Explorer

Hi,
Can I in someway create an list that shows unused data in a specific index? Is it possible?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There is no way to know what data has been looked at and what has not. Splunk does not track that. Even if it did, data in Splunk cannot be removed. Also, just because data is not being used today does not mean it won't be needed tomorrow.

That said, it may be good to review your data sources and verify with your users that each source is still needed.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There is no way to know what data has been looked at and what has not. Splunk does not track that. Even if it did, data in Splunk cannot be removed. Also, just because data is not being used today does not mean it won't be needed tomorrow.

That said, it may be good to review your data sources and verify with your users that each source is still needed.

---
If this reply helps you, Karma would be appreciated.

amirarsalan
Explorer

Thanks, but is it any way then to see or review the data sources in a splunk search?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I suppose you could analyze the search dispatch directories, but they are not ingested into Splunk so that would be an "offline" task.

---
If this reply helps you, Karma would be appreciated.
0 Karma

adonio
Ultra Champion

please elaborate, what do you mean by: "unused data"?

0 Karma

amirarsalan
Explorer

@adonio I mean like information that is not necessary in search that can be removed

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...