I got it with a variation on your solution. Below is the final search for an alert that looks for empty indexes (count=0) from a given list of known indexes ("index1", "index2", "index3", "index4", "...
See more...
I got it with a variation on your solution. Below is the final search for an alert that looks for empty indexes (count=0) from a given list of known indexes ("index1", "index2", "index3", "index4", "index5", "index6", ...etc.). | rest splunk_server=local /services/data/indexes
| where title IN ("index1", "index2", "index3", "index4", "index5", "index6")
| table title
| rename title AS index
| join type=left index
[| tstats count where index IN ("index1", "index2", "index3", "index4", "index5", "index6") BY index]
| fillnull
| where count=0 That first line with rest command was the key. Thank you!