https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/693208#M235887 <P>I have similar issue. The data we had coming into one of our indexes, has now switched to a different format and slightly different field/value pairs. Now I am tasked with finding, where this index/data is being used in lookups, reports, alerts, etc.... So we can change the SPL To match the new data.&nbsp;</P> Fri, 12 Jul 2024 18:03:04 GMT bwheelerice 2024-07-12T18:03:04Z https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/676946#M231494 <P>It there any best way to find if an index used in any of the saved searches, alerts, reports and dashboard</P> Thu, 08 Feb 2024 08:22:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/676946#M231494 susinkumar 2024-02-08T08:22:41Z https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/676949#M231496 <P>There is no simple answer to this. You can use the ReST interface to find all the views (dashboards) and look through the code to find the searches, but even then, indexes may be obfuscated through the use of macros, etc. Having found dashboards with definitions that reference indexes, you might want to check whether anyone actually uses the dashboards. Same gores for reports, alerts, etc.</P><P>Perhaps you need to narrow down your question. Are you interested in whether a particular index is used? What is your ultimate aim?</P> Thu, 08 Feb 2024 09:03:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/676949#M231496 ITWhisperer 2024-02-08T09:03:33Z https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/677002#M231505 Hi<BR />An old answer <A href="https://community.splunk.com/t5/Splunk-Search/How-to-find-which-indexes-are-used/m-p/674463" target="_blank">https://community.splunk.com/t5/Splunk-Search/How-to-find-which-indexes-are-used/m-p/674463</A> which answer to your questions too.<BR />r. Ismo Thu, 08 Feb 2024 19:51:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/677002#M231505 isoutamo 2024-02-08T19:51:24Z https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/677787#M231763 <P>Yes, I need to check if a<SPAN>&nbsp;particular index is used in any TA.</SPAN></P><P>&nbsp;</P> Fri, 16 Feb 2024 11:50:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/677787#M231763 susinkumar 2024-02-16T11:50:50Z https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/677814#M231772 As it has said earlier you couldn't get 100% sure answer for this. You should look those old answers to see what you could try to get some answers. Fri, 16 Feb 2024 15:20:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/677814#M231772 isoutamo 2024-02-16T15:20:02Z https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/693208#M235887 <P>I have similar issue. The data we had coming into one of our indexes, has now switched to a different format and slightly different field/value pairs. Now I am tasked with finding, where this index/data is being used in lookups, reports, alerts, etc.... So we can change the SPL To match the new data.&nbsp;</P> Fri, 12 Jul 2024 18:03:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-a-index-are-used-in-reports-alerts-and-dashboards/m-p/693208#M235887 bwheelerice 2024-07-12T18:03:04Z