topic Re: Checking TA usage-How do I know if a TA is used by any user? in Splunk Search

Checking TA usage-How do I know if a TA is used by any user?

zacksoft_wf — Thu, 18 Aug 2022 14:08:37 GMT

How do I know if a TA is used by any user.
I have a TA laying around, and I doubt is is been used. But before removing wanted to make sure it is truly unused.

Re: Checking TA usage

richgalloway — Thu, 18 Aug 2022 13:52:17 GMT

There's no way to know because (generally) users don't use TAs since they're not visible. TAs help onboard data by invoking APIs, extracting fields, or enriching data. To know if a user is using a TA you would have to check every field the TA produces and see if any user is making use of that field. It's not a simple task.

Or you could disable the TA and wait for someone to complain. I don't recommend that because, if a user needs the TA, you risk data loss or poorly onboarded events.

Re: Checking TA usage-How do I know if a TA is used by any user?

CALEX — Fri, 23 Sep 2022 16:11:48 GMT

Did you happen to find a way besides scream testing? I have a lot of old apps I need to review and I'm not really sure how I should proceed.

Re: Checking TA usage-How do I know if a TA is used by any user?

richgalloway — Fri, 23 Sep 2022 17:51:12 GMT

You could make a list of the sourcetypes used by each app and then see if any sourcetype is unused. That's a bit tricky since sourcetypes may not be referenced directly in searches - they could be in macros, eventtypes, tags, etc.. If no data with that sourcetype has been indexed in a long time then that's a pretty clue that the sourcetype and TA may not be needed.

Re: Checking TA usage

zacksoft_wf — Tue, 27 Sep 2022 07:13:20 GMT

This helps. Thanks @richgalloway.