Find searches that reference indexes that no longer exist

[dashe]

Hi,

I'm trying to clean up an old splunk cloud instance. one thought that occurred to me is find scheduled searches that reference indexes that don't exist anymore, they have long been cleaned up and deleted but scheduled searches may still exist against these deleted indexes.

I tried looking in internal indexes but don't see any sort of warning messages for index does not exist.

Does anyone know if such a warning message shows up that I can then use to deactivate these searches?

thanks in advance

Dave

[sainag_splunk]

I think there is no easy way because, as @richgalloway  mentioned, there is no warning when a search tries to use an index that doesn't exist. Even if you choose result_count=0, you will get a lot of false positives. The best way is to run a search against the saved searches and validate with your existing indexes.

The most reliable approach is the manual two-step method:

Step 1: Get scheduled searches and their referenced indexes

| rest /services/saved/searches | search disabled=0 is_scheduled=1 | rex field=search "index\s*=\s*(?<referenced_index>[^\s\|]+)" | stats values(title) as searches by referenced_index

Step 2: Get your current indexes

| rest /services/data/indexes | fields title 

If this Helps, Please Upvote.

[richgalloway]

@sainag_splunk's answer is correct, but be aware that not all searches specify an index name and those that do might do so using a wildcard.  This is a Hard Problem addressed in the .conf24 talk "Maximizing Splunk Core: Analyzing Splunk Searches Using Audittrail and Native Splunk Telemetry", which offers some ways to get the indexes used by a search.

[richgalloway]

There is no warning when a search tries to use an index that doesn't exist.