This may help...   | rest /services/data/indexes | rename title AS index | dedup index | eval count=0 | table index count | join type=outer index [| tstats count where (index=* OR index=_*) by index ] |search NOT index IN("_telemetry","_thefishbucket") | stats sum(count) AS count by index | eval status = case(count=0, "missing", count>0, "active") | fields - count | where status="missing" ... View more