Hello Splunkers, I'm looking for a Splunk search to list all indexes that were not used by users for last 30 days. I've tried the below query from audit logs, but it's not giving me the accurate results. This query is only giving me few indexes but not all the indexes that we used.  index=_audit sourcetype=audittrail action=search info=granted (NOT TERM(index=_*)) | where match(search, "index\s*(?:=|IN)") | rex max_match=0 field=search "'search index=(?<used_index>\w+)'" | stats count by used_index Appreciate if anyone could share some thoughts on this? ... View more