How to find which indexes are used?

[Siddharthnegi]

I have a simple question how can I check that in which of the apps a particular index has been used.

[SinghK]

there is no easy way of doing it but check the macros an app uses and then in that macro normally there is  a search which points to an index. settings-->advanced search-->search macros and there you can find the index being used by app.

[ITWhisperer]

Simply look at the source of all your dashboards, reports, alerts, macros, etc. to see if the index is used.

[isoutamo]

Hi

unfortunately there haven't (at least i didn't know) any way to get this list for 100%. There are so many way how used index can be defined for queries. @ITWhisperer already list some of those, but if there is used index=xy* or index=* or if the index is not mentioned on SPL query or macro or event types then splunk will use what has defined for user's role (or combined roles) as default search index.

Basically you could get some list for used indexes, but don't trust that it contains all, unless it contains all indexes what you have defined on your system 😉

r. Ismo

[PickleRick · Accepted solution]

There is no 100% reliable way. There are some common cases which can be covered but you can only detect some typical cases where the indexes are specified explicitly. I can think of so many ways of specifying indexes dynamically (even generating index names randomly) that you can't find it automaticaly.

But the question is why do you even need that.