Check out this answers post. You would need some sort of lookup file that listed all of the event types. You would search the lookup as your base search with a subsearch of the events, where the common field (eventtype) is NOT in the search of the events.
here is an alternative to the lookup approach
this search capture all eventtypes in your splunk using rest:
| rest /services/saved/eventtypes | table title
you can add couple fields to the search
eai:acl.app search and
outputlookup and used the approach shown above by @kmorris
set your time picker
and run the following to find which eventtypes are not being "used" in that particular time frame:
| set diff [ | search index = * | stats count by eventtype | fields - count ] [| rest /services/saved/eventtypes | table title | rename title as eventtype ]
hope it helps
Thanks to all for the responses.
I've used the following search
| rest /services/saved/eventtypes | table title | rename title as eventtype | join type=left eventtype [search index="myindex" | stats count by eventtype] | eval count = if(isnull(count), 0, count) | sort -count
and got a list of all event types paired with an amount of corresponding events.
kindly accept your answer so others will know its a valid solution for you