Index/Sourcetype inventory

[cbiraris]

Hi Team,

I am trying to create a search which show me the list of all sourcetype and index which are not in use or let's say zero/less events from last few days.

Can you please advise.

Thanks   

[ITWhisperer]

Try something like this

| tstats latest(_time) as _time BY index sourcetype

However, Splunk is not good at find things which aren't there, so if your sourcetype has had no events within your time period, it will not show up.

[isoutamo · Accepted solution]

Hi

if those have any events then you could try also this

| metadata type=sourcetypes index=*

Then use field lastTime which told when last event has sent to this sourcetype unfortunately this don't say from which index that event has sent, but you probably could add some other SPL after that.

There are also several apps for helping you with this issue.

See also these links:

There are a lot of options for finding hosts or sources that stop submitting events:
Meta Woot! https://splunkbase.splunk.com/app/2949/
TrackMe https://splunkbase.splunk.com/app/4621/
Broken Hosts App for Splunk https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts) https://splunkbase.splunk.com/app/3796/
Monitoring Console https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...Some helpful posts:
https://lantern.splunk.com/hc/en-us/articles/360048503294-Hosts-logging-data-in-a-certain-timeframe
https://www.duanewaddle.com/proving-a-negative/

r. Ismo