Index Vs Apps

[jiaqya]

Is there a way to determine where all an index is being used.

can we at least identify the app/dashboard using a particular index.

is it possible in splunk, or we have a write a custom code...

[richgalloway]

This is not a trivial task. You can go to Settings->Indexes to see which app owns each index, but that doesn't necessarily limit where the index is used.

You could search for "index=foo" in all of your dashboards, alerts, and reports, but that would miss those where the index name is specified in a macro or eventtype. Including those still misses searches that use default indexes.