Hello,
We have a splunk instance where we have configured security related logs. There are hundreds of indexes created on the instance and now we are planning to disable indexes that are no longer active.
These security logs are now either going to Azure or they are no longer needed so they were stopped by the stakeholders. I am looking for a query that can give me the list of indexes with the most recent event timestamp in respective indexes.
with this details plan is to look for the indexes that have event older than 1 month and consider them as migrated/no longer needed.
Hi @koyachi,
you could run something like this:
| tstats count latest(_time) AS latest WHERE index=* BY index
| eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S")
Ciao.
Giuseppe
| metasearch index=*
| stats latest(_time) as _time by index
Hi @koyachi,
you could run something like this:
| tstats count latest(_time) AS latest WHERE index=* BY index
| eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S")
Ciao.
Giuseppe
Thanks @gcusello . This gives me the info what i need.
Hi @koyachi ,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated by all the contributors 😉