Hi,
How to determine which logs are being utilized for specific dashboards, use-cases, or other metrics in your Splunk Cloud ES?
There isn't a one-click answer to this question. Each dashboard or use-case will have to be researched separately.
Simply put, run the base search (everything before the first pipe) and append | stats count by source. That will produce a list of sources used by that search/use-case.
If the search contains subsearches (via join or append commands then combine the base searches of each subsearch with the base search of the main search using append.
<<base search>>
| append [ <<text before first pipe of subsearch1>>]
| append [ <<text before first pipe of subsearch2>>]
| stats count by source
This method doesn't apply to searches that start with a generating command (tstats, dbxquery, inputlookup, etc.).
Be aware that some sources change names every day.