Splunk Search

Index/Sourcetype inventory

cbiraris
Path Finder

Hi Team,

I am trying to create a search which show me the list of all sourcetype and index which are not in use or let's say zero/less events from last few days.

Can you please advise.

Thanks   

Labels (2)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

if those have any events then you could try also this

 

| metadata type=sourcetypes index=*

 

Then use field lastTime which told when last event has sent to this sourcetype unfortunately this don't say from which index that event has sent, but you probably could add some other SPL after that.

There are also several apps for helping you with this issue.

See also these links:

There are a lot of options for finding hosts or sources that stop submitting events:
Meta Woot! https://splunkbase.splunk.com/app/2949/
TrackMe https://splunkbase.splunk.com/app/4621/
Broken Hosts App for Splunk https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts) https://splunkbase.splunk.com/app/3796/
Monitoring Console https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...Some helpful posts:
https://lantern.splunk.com/hc/en-us/articles/360048503294-Hosts-logging-data-in-a-certain-timeframe
https://www.duanewaddle.com/proving-a-negative/

r. Ismo

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| tstats latest(_time) as _time BY index sourcetype

However, Splunk is not good at find things which aren't there, so if your sourcetype has had no events within your time period, it will not show up.

isoutamo
SplunkTrust
SplunkTrust

Hi

if those have any events then you could try also this

 

| metadata type=sourcetypes index=*

 

Then use field lastTime which told when last event has sent to this sourcetype unfortunately this don't say from which index that event has sent, but you probably could add some other SPL after that.

There are also several apps for helping you with this issue.

See also these links:

There are a lot of options for finding hosts or sources that stop submitting events:
Meta Woot! https://splunkbase.splunk.com/app/2949/
TrackMe https://splunkbase.splunk.com/app/4621/
Broken Hosts App for Splunk https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts) https://splunkbase.splunk.com/app/3796/
Monitoring Console https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...Some helpful posts:
https://lantern.splunk.com/hc/en-us/articles/360048503294-Hosts-logging-data-in-a-certain-timeframe
https://www.duanewaddle.com/proving-a-negative/

r. Ismo

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...