With the Data Utilization element, Admins can create a starting point for analyzing what data could potentially be deprecated, and how much impact that will have on their Splunk Environment. This is an important part of the Splunk lifecycle for reducing Splunk license cost. Navigating to the Data Utilization dashboard will show the Utilization by Index Sourcetype report, which is the best starting point.
Admins will want to pay attention to the Queries by MB feature on the far right. By sorting by ‘License Usage’ to see highest Index utilizing data, and then reviewing the ‘Queries by MB’ column, admins can get a jump start on finding any Index Sourcetypes that are wasting valuable space, but are being underutilized, if utilized at all.
Admins can further select an Index Sourcetype pair to see how that data is (or isn’t) being utilized.
Data Utilization does not track for Data Model Utilization, so it is recommend that a user investigate this Index Sourcetype further in their Data Management Atlas Element, or review applicable data models for incorporation.