Splunk Search

Create an list that shows unused data in specific index

amirarsalan
Explorer

Hi,
Can I in someway create an list that shows unused data in a specific index? Is it possible?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There is no way to know what data has been looked at and what has not. Splunk does not track that. Even if it did, data in Splunk cannot be removed. Also, just because data is not being used today does not mean it won't be needed tomorrow.

That said, it may be good to review your data sources and verify with your users that each source is still needed.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There is no way to know what data has been looked at and what has not. Splunk does not track that. Even if it did, data in Splunk cannot be removed. Also, just because data is not being used today does not mean it won't be needed tomorrow.

That said, it may be good to review your data sources and verify with your users that each source is still needed.

---
If this reply helps you, Karma would be appreciated.

amirarsalan
Explorer

Thanks, but is it any way then to see or review the data sources in a splunk search?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I suppose you could analyze the search dispatch directories, but they are not ingested into Splunk so that would be an "offline" task.

---
If this reply helps you, Karma would be appreciated.
0 Karma

adonio
Ultra Champion

please elaborate, what do you mean by: "unused data"?

0 Karma

amirarsalan
Explorer

@adonio I mean like information that is not necessary in search that can be removed

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...