Deployment Architecture

Default indexes in Splunk Enterprise

reallyliri
Explorer

My Splunk Enterprise is running for a few months.

I'm sending all my logs (HEC and UDP) to index "main".

However, I see some indexes defined, mainly I'm concerned about the top-consuming ones: _audit, _internal and _introspection.

indexes

What processes are sending data to them? What value is that for me? Is it consuming my license quota? And where can I configure/disable these?

Thanks

0 Karma

renjith_nair
Legend

@reallyliri,

_audit : Events from the file system change monitor, auditing, and all user search history.
- Details : Audit Splunk activity

_internal : This index includes Splunk Enterprise internal logs and metrics.
- Details are in What Splunk software logs about itself

_introspection : Instrumentation data about your Splunk instance and environment and writes that data to log files to aid in reporting on system resource utilization and troubleshooting problems with your Splunk Enterprise deployment .
- More details : About Splunk Enterprise platform instrumentation

About the licensing, it does not count against your license:

Use the "Indexing volume" status dashboard in the Search app to see details about index volume in your infrastructure. Note that the overview includes internal indexing, which does not count against your license.

License violations

Hope that helps!

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...