Create an list that shows unused data in specific index

[amirarsalan]

Hi,
Can I in someway create an list that shows unused data in a specific index? Is it possible?

[richgalloway · Accepted solution]

There is no way to know what data has been looked at and what has not. Splunk does not track that. Even if it did, data in Splunk cannot be removed. Also, just because data is not being used today does not mean it won't be needed tomorrow.

That said, it may be good to review your data sources and verify with your users that each source is still needed.

[amirarsalan]

Thanks, but is it any way then to see or review the data sources in a splunk search?

[richgalloway]

I suppose you could analyze the search dispatch directories, but they are not ingested into Splunk so that would be an "offline" task.

[adonio]

please elaborate, what do you mean by: "unused data"?

[amirarsalan]

@adonio I mean like information that is not necessary in search that can be removed