Looking for a Splunk search to list all indexes that were not used by users for last 30 days

[sab007]

Hello Splunkers,

I'm looking for a Splunk search to list all indexes that were not used by users for last 30 days. I've tried the below query from audit logs, but it's not giving me the accurate results. This query is only giving me few indexes but not all the indexes that we used. 

index=_audit sourcetype=audittrail action=search info=granted (NOT TERM(index=_*))
| where match(search, "index\s*(?:=|IN)")
| rex max_match=0 field=search "'search index=(?<used_index>\w+)'"
| stats count by used_index

Appreciate if anyone could share some thoughts on this?

[bowesmana]

In addition to @richgalloway comment, that will give you a list of probable used indexes, but if you then want to compare that to indexes that have received data, you could add the following to his SPL

| eval source="search"
| append [
  | tstats count where index=* by index
  | eval source="data"
  | rename index as used_index
]
| stats values(source) as sources by used_index
| where mvcount(sources)=1 AND sources="data"

This will then show you those indexes that have data in the time period, but have not been seen as being searched.

[richgalloway]

I revised the regex a little to better extract index names.

index=_audit sourcetype=audittrail action=search info=granted (NOT TERM(index=_*))
| where match(search, "index\s*(?:=|IN)")
| rex max_match=0 field=search "\bindex\s*=\s*\\\"?(?<used_index>\w+)"
| stats count by used_index

Even with that, however, you won't see all index names.  That's because not all searches specify an index name.  Some may use a macro while others may rely on the role's default indexes.