Is there a way to determine what sources and/or sourcetypes AREN'T being searched? If data is coming into Splunk and nobody is really looking at that data then I don't need to keep bringing it in. I just want to find a way to determine this.
↧
Is there a way to determine what sources and/or sourcetypes AREN'T being searched? If data is coming into Splunk and nobody is really looking at that data then I don't need to keep bringing it in. I just want to find a way to determine this.