This is a challenge because how different users might define "unused" and because there is no tag to say if data is "used" or not. A good starting place, at least for Splunk Cloud users, is the "Underutilized source type(s)" alert in the CMC.
Other users will need to craft a search that scrubs logs for sourcetype references and another search that compares those references to a list of all sourcetypes on the system. It won't be perfect, either. See .conf24 session PLA1837B for more info and SPL to get you started.
---
If this reply helps you, Karma would be appreciated.
