How to find if a particular index is being used?

[anil15694]

Hi,

In order to remove an index, how can we be sure that the index is not getting used?

What should we check before removing any index?

[rabbidroid]

There are several ways you can see if there is data in a specific index.

You can try " | dbinspect index=<your_index> ", or "|tstats count where index=<your_index> by _time span=1d"

[FrankVl]

Couple of things that come to mind (possibly not an exhaustive list):

• check if any data is still coming in
• check if any searches are ran against it (search for the index name in _audit index)
• check if any configuration exists that refers to the index (e.g. macros, saved searches, dashboards, inputs)
  • several ways to do this (btool, | rest, simply searching through the files on the server(s)...)