Getting Data In

Add / Remove desired indexes in / from the search

mrzmsmglsnk
Explorer

I'm using this search =>

index=_internal source="*license_usage.log" type=usage idx="f*"
 | eval MB = round(b/1048576,2)
 | eval idx = idx
 | timechart span=1d sum(MB) by idx limit=0
 | rename _time as Datum
 | convert timeformat=%d.%m.%Y. ctime(Datum)
 | addtotals

to find the usage of all indexes which names start with the letter f, (I have about 30 indexes started with f of approximately 750 indexes in total).

a) How can I remove index firewall from the results? I know it starts with f but I don't want it in the results of the search.
b) How can I add index test.f.something in the results? I know it doesn't start with f but I want it in the results of the search.
c) This is not mandatory but can I replace dots with commas in the results?

0 Karma
1 Solution

gfreitas
Builder

Hi,

a) to remove the index append in the end of first line: NOT idx=firewall
b) After idx="f*" append, OR idx="test.f.something"
c) To replace, try the replace command: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Replace, you can also use rex mode=sed and replace the commas

View solution in original post

gfreitas
Builder

Hi,

a) to remove the index append in the end of first line: NOT idx=firewall
b) After idx="f*" append, OR idx="test.f.something"
c) To replace, try the replace command: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Replace, you can also use rex mode=sed and replace the commas

mrzmsmglsnk
Explorer

a) I was writing, in the end of the first line, NOT index=firewall not NOT idx=firewall 😞
Uf, I'm obviously tired. I must sleep.
b) The same as a).
c) I'll check the URL.

gfreitas, THANK YOU!

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...