- List all the names of indexes
| eventcount summarize=false index=* index=_* | dedup index | fields index
2. List all the saved searches alerts
| rest /servicesNS/-/-/saved/searches
| search is_scheduled=1
| table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search
3. Compare the search field with the index field by joining these two outputs and running a search command.
Did I get your requirement correct? if yes then I can think of creating a join to give you desired result 🤔