There is no 100% reliable way. There are some common cases which can be covered but you can only detect some typical cases where the indexes are specified explicitly. I can think of so many ways of specifying indexes dynamically (even generating index names randomly) that you can't find it automaticaly. But the question is why do you even need that.

1.  Please don't call out specific people with your question. I don't want to sound rude but people are giving their own spare time providing help here, it's not a Splunk support service. Doing so can even lower the chance of you getting help from people you mention. 2. There is no such thing as "all hot storage". You may not have separate storage units for hot/warm and cold storages but that doesn't mean that your buckets are not in those states. Honsetly, this whole project seems a bit complicated and will require some decent planing. There are several different approaches you could take with this - adding another site, replicating data, then resizing indexers and removing old ones. Or spinning up a new environment and copying over the data (that can be tricky to identify all buckets). It is definitely a project you should get either PS involved or your friendly local Splunk partner with experienced team because there are several things that can go wrong (and if you don't prepare properly, most probably will).