In addition to @richgalloway comment, that will give you a list of probable used indexes, but if you then want to compare that to indexes that have received data, you could add the following to his SPL | eval source="search" | append [ | tstats count where index=* by index | eval source="data" | rename index as used_index ] | stats values(source) as sources by used_index | where mvcount(sources)=1 AND sources="data" This will then show you those indexes that have data in the time period, but have not been seen as being searched. ... View more