Checking TA usage-How do I know if a TA is used by any user?

[zacksoft_wf]

How do I know if a TA is used by any user.
I have a TA laying around, and I doubt is is been used. But before removing wanted to make sure it is truly unused.  

[CALEX]

Did you happen to find a way besides scream testing? I have a lot of old apps I need to review and I'm not really sure how I should proceed.

[richgalloway]

You could make a list of the sourcetypes used by each app and then see if any sourcetype is unused.  That's a bit tricky since sourcetypes may not be referenced directly in searches - they could be in macros, eventtypes, tags, etc..  If no data with that sourcetype has been indexed in a long time then that's a pretty clue that the sourcetype and TA may not be needed.

[richgalloway]

There's no way to know because (generally) users don't use TAs since they're not visible.  TAs help onboard data by invoking APIs, extracting fields, or enriching data.  To know if a user is using a TA you would have to check every field the TA produces and see if any user is making use of that field.  It's not a simple task. 

Or you could disable the TA and wait for someone to complain.  I don't recommend that because, if a user needs the TA, you risk data loss or poorly onboarded events.

[zacksoft_wf]

This helps. Thanks @richgalloway.