Hello @sumaitasiddiky please check the second answer by @ssievert_splunk : https://answers.splunk.com/answers/557131/index-hit-by-searches-in-last-30-days.html Unless your users explicitly specify index=xxx in their search, you cannot do this since there is no audit log of what indices were implicitly accessed based on a users' permissions. You can try to workaround this restriction by joining several searches: searches with indexes from audit log searches with sourcetype or source -> map to indexes other searches -> run them and get references index(es) Let me know if it helps ... View more

I believe this problem has wider ramifications. Please have a look at Splunk Ideas, for a proposal to integrate Splunk with Source Code Control: https://ideas.splunk.com/ideas/E-I-7 This would address this problem and many others. SCC would maintain all your modification dates and revision history. You can furthermore splunk a git repo as well as the git metadata, to report both the available facts and the current code. Because Splunk supports so many disparate ways to update your configuration--which is code when it comes right down to it--this has always been a problem. In the field there are many ingenious and occasionally really scary home-made solutions, which you have to have, or mature Splunk installations sooner or later become unmanageable. If you support the notion of source code control integration for Splunk, please vote for the idea so it gets more traction. Charles ... View more