https://community.splunk.com/t5/Splunk-Search/How-to-find-if-a-particular-index-is-being-used/m-p/514435#M144380 <P>Hi,</P><P>In order to remove an index, how can we be sure that the index is not getting used?</P><P>What should we check before removing any index?</P> Mon, 17 Aug 2020 11:45:36 GMT anil15694 2020-08-17T11:45:36Z https://community.splunk.com/t5/Splunk-Search/How-to-find-if-a-particular-index-is-being-used/m-p/514435#M144380 <P>Hi,</P><P>In order to remove an index, how can we be sure that the index is not getting used?</P><P>What should we check before removing any index?</P> Mon, 17 Aug 2020 11:45:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-if-a-particular-index-is-being-used/m-p/514435#M144380 anil15694 2020-08-17T11:45:36Z https://community.splunk.com/t5/Splunk-Search/How-to-find-if-a-particular-index-is-being-used/m-p/514437#M144382 <P>Couple of things that come to mind (possibly not an exhaustive list):</P><UL><LI>check if any data is still coming in</LI><LI>check if any searches are ran against it (search for the index name in _audit index)</LI><LI>check if any configuration exists that refers to the index (e.g. macros, saved searches, dashboards, inputs)<UL><LI>several ways to do this (btool, | rest, simply searching through the files on the server(s)...)</LI></UL></LI></UL> Mon, 17 Aug 2020 11:55:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-if-a-particular-index-is-being-used/m-p/514437#M144382 FrankVl 2020-08-17T11:55:28Z https://community.splunk.com/t5/Splunk-Search/How-to-find-if-a-particular-index-is-being-used/m-p/514493#M144400 <P>There are several ways you can see if there is data in a specific index.</P><P>You can try " | dbinspect index=&lt;your_index&gt; ", or "|tstats count where index=&lt;your_index&gt; by _time span=1d"</P> Mon, 17 Aug 2020 16:42:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-if-a-particular-index-is-being-used/m-p/514493#M144400 rabbidroid 2020-08-17T16:42:17Z