Splunk Search

Find searches that reference indexes that no longer exist

dashe
Engager

Hi,

I'm trying to clean up an old splunk cloud instance. one thought that occurred to me is find scheduled searches that reference indexes that don't exist anymore, they have long been cleaned up and deleted but scheduled searches may still exist against these deleted indexes.

I tried looking in internal indexes but don't see any sort of warning messages for index does not exist.

Does anyone know if such a warning message shows up that I can then use to deactivate these searches?

thanks in advance

Dave

Labels (1)
0 Karma

sainag_splunk
Splunk Employee
Splunk Employee

 

I think there is no easy way because, as @richgalloway  mentioned, there is no warning when a search tries to use an index that doesn't exist. Even if you choose result_count=0, you will get a lot of false positives. The best way is to run a search against the saved searches and validate with your existing indexes.

The most reliable approach is the manual two-step method:

Step 1: Get scheduled searches and their referenced indexes

 
 
| rest /services/saved/searches | search disabled=0 is_scheduled=1 | rex field=search "index\s*=\s*(?<referenced_index>[^\s\|]+)" | stats values(title) as searches by referenced_index

Step 2: Get your current indexes

 
 
| rest /services/data/indexes | fields title 



If this Helps, Please Upvote.

If this helps, Upvote!!!!
Together we make the Splunk Community stronger 

richgalloway
SplunkTrust
SplunkTrust

@sainag_splunk's answer is correct, but be aware that not all searches specify an index name and those that do might do so using a wildcard.  This is a Hard Problem addressed in the .conf24 talk "Maximizing Splunk Core: Analyzing Splunk Searches Using Audittrail and Native Splunk Telemetry", which offers some ways to get the indexes used by a search.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

There is no warning when a search tries to use an index that doesn't exist.

---
If this reply helps you, Karma would be appreciated.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...