How do I know if a TA is used by any user.
I have a TA laying around, and I doubt is is been used. But before removing wanted to make sure it is truly unused.
You could make a list of the sourcetypes used by each app and then see if any sourcetype is unused. That's a bit tricky since sourcetypes may not be referenced directly in searches - they could be in macros, eventtypes, tags, etc.. If no data with that sourcetype has been indexed in a long time then that's a pretty clue that the sourcetype and TA may not be needed.
There's no way to know because (generally) users don't use TAs since they're not visible. TAs help onboard data by invoking APIs, extracting fields, or enriching data. To know if a user is using a TA you would have to check every field the TA produces and see if any user is making use of that field. It's not a simple task.
Or you could disable the TA and wait for someone to complain. I don't recommend that because, if a user needs the TA, you risk data loss or poorly onboarded events.