Add / Remove desired indexes in / from the search

[mrzmsmglsnk]

I'm using this search =>

index=_internal source="*license_usage.log" type=usage idx="f*"
 | eval MB = round(b/1048576,2)
 | eval idx = idx
 | timechart span=1d sum(MB) by idx limit=0
 | rename _time as Datum
 | convert timeformat=%d.%m.%Y. ctime(Datum)
 | addtotals

to find the usage of all indexes which names start with the letter f, (I have about 30 indexes started with f of approximately 750 indexes in total).

a) How can I remove index firewall from the results? I know it starts with f but I don't want it in the results of the search.
b) How can I add index test.f.something in the results? I know it doesn't start with f but I want it in the results of the search.
c) This is not mandatory but can I replace dots with commas in the results?

[gfreitas · Accepted solution]

Hi,

a) to remove the index append in the end of first line: NOT idx=firewall
b) After idx="f*" append, OR idx="test.f.something"
c) To replace, try the replace command: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Replace, you can also use rex mode=sed and replace the commas

[mrzmsmglsnk]

a) I was writing, in the end of the first line, NOT index=firewall not NOT idx=firewall 😞
Uf, I'm obviously tired. I must sleep.
b) The same as a).
c) I'll check the URL.

gfreitas, THANK YOU!