I am using this search:
| metadata index=* type=hosts | eval age = now()-lastTime | where age > (2*86400) | sort age d | convert ctime(lastTime) | fields age,host,lastTime
which works great in showing me systems that have not forwarded anything in two days. However, one of my co-workers is playing around with a temp_index into which he is importing data from another splunk instance from which he exported some old logs. This index has hosts in it which are no longer forwarders, and I thought that perhaps I could add after index=* NOT index=temp_index -- but, alas, this does not work. I could, I suppose list all of the indexes I want but then I'd have to change the saved search every time I add a new index, which I will be doing over the next few months. Seems like there should be a way to do this. Anyone know how?
