Below query i am using to get the list of all indexes
| eventcount summarize=false index=* | dedup index | fields index
`dm_mapped_indexes` This macros contain the list of indexes.
Now i want to filter all the indexes from these macros " `dm_mapped_indexes`" and get all the other indexes.
It depends on what your macro expands to, but try this
| search NOT `dm_mapped_indexes`
Otherwise, please provide more details, e.g. a cut-down, sanitised version of your macro.
