Detect and alert on new Splunk indexes created

gistfile1.txt

index=_audit sourcetype=audittrail TERM(create) operation=create action=indexes_edit
| rex field=_raw "object=\"*(?<object>[^\"]+)"
| stats values(user) AS user, min(_time) AS _time by object
| eval reason="There is a new index in town! New index: ".object.". Please evaluate if that needs to be in scope for any existing search or use case (ex.: IOC Scan Framework)."