Index in Dashboards

[mcohen13]

is there a way to check for a specific index on which dashboards this index is used?

[nareshinsvu]

Give a try? - Replace "your index name" accordingly in your search

| union 
     [| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" 
     | search "eai:data"="*index=<your index name>*" 
     | eval Type="Dashboards" 
     | table Type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write] 
     [| rest splunk_server="local" "/servicesNS/-/-/saved/eventtypes" 
     | search search="*index=<your index name>*"
     | eval Type="Eventtypes"
     | table Type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write]
     [| rest splunk_server="local" "/servicesNS/-/-/data/ui/panels"
     | search "eai:data"="*index=<your index name>*"
     | eval Type="Pre Built Panels"
     | table Type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write]
     [| rest splunk_server="local" "/servicesNS/-/-/admin/macros"
     | search definition="*index=<your index name>*"
     | eval Type="Macros"
     | table Type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write]
     [| rest splunk_server="local" "/servicesNS/-/-/data/models"
     | search "eai:data"="*index=<your index name>*"
     | eval Type="Data Models"
     | table Type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write]
     [| rest splunk_server="local" "/servicesNS/-/-/saved/searches"
     | search search="*index=<your index name>*"
     | eval Type="Saved Searches/Alerts/Reports"
     | table Type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write]

[nareshinsvu]

But I would not go with this approach. It didn't work for few indexes for me though. You have to verify each dashboard if your index is referenced.

[mcohen13]

didn't work