Data used by searches?

[whitecat001]

I want a query that shows  the total volume of indexes used for splunk searches. Query on information that has to do with how much indexes are used based on splunk searches 

[splunkreal]

Hello @whitecat001 try this :

index=_audit action="search" search="*" NOT user="splunk-system-user" savedsearch_name="" NOT search="\'|history*" NOT search="\'typeahead*"

| rex "index=(?P<myIndex>\w+)\s+\w+="

| stats count by myIndex

[isoutamo]

Hi
That’s almost mission impossible with standard setup as you could do queries without defining any indexes into it. You could also use eventtypes etc. to hide real index names.
If you star to index all your search logs from sh side and look litesearch part then that could give to you more accurate index list?
r. Ismo