I need to know which index and app has been access how many time in last one month

[csharm21]

I need to know how many time all the indexes in my splunk has been accessed in last 30 days by app name(I tried so many posts but none of the post resolved my issue). can anyone help me to get this fixed.

[p_gurav]

This may help you:

index=_audit action=search search=* sourcetype=audittrail  | rex field=search "sourcetype\s*=\s*\"*(?<SourcetypeUsed>[^\s\"]+)"  | rex field=search "index\s*=\s*\"*(?<IndexUsed>[^\s\"]+)" | search IndexUsed=* OR SourcetypeUsed=* | fillnull value="NA" IndexUsed SourcetypeUsed| stats count by IndexUsed SourcetypeUsed

The count represents a number of searches execution that are using that index/sourcetype.

[efavreau]

Based on the comment thread, @p_gurav, you should convert your comment to an answer, so @csharm21 can accept it.
@csharm21 you should ask that as a separate question, in my humble opinion. Adding the APP to the query, most likely means you're querying _internal also, which would require a lot more work to add in.

[csharm21]

Thanks p_gurav, this is working. I also need to filter this by application name. would you be able to help on this.

[broberg]

What you mean by "accessed", do you mean how many time somone searched in an index?
That information can you see in _audit.

[csharm21]

@broberge yes i need to pull detail how many time some one searched the index. if that index has not been searched more then one month, we will do clean up. I tried multiple things using _Audit but still no luck.