Reporting

How to clean up old indexes, reports, alerts, etc ?

Glasses
Builder

I have inherited a splunk distributed deployment which is a bit of a train wreck.

Does anyone know of a way to identify indexes that no one has searched for a long time?

Or how to identify reports that no one has run for a long time or that are not scheduled?

Thank you,
Gunnar

Tags (3)
0 Karma

DavidHourani
Super Champion

Hi @Glasses,

Someone already developed a dashboard and posted it here for that purpose :
https://answers.splunk.com/answers/316312/ever-wonder-which-dashboards-are-being-used-and-wh.html

You can also use app such as search activity to see what's being used the most and reverse the search to get what's being used the least :
https://splunkbase.splunk.com/app/2632/

Another useful link to see dashboard usage here :
https://answers.splunk.com/answers/617051/how-can-i-create-a-query-to-find-dashboard-usage-a.html

Lots of resources about this. You can even leverage the MC to get more insight one what's happening.

Let me know if there's a specific query you're looking to build in addition to all that.

Cheers,
David

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...