Monitoring Splunk

How to combine results from different pairs of indexes/sourcetypes in one search?

New Member

The following search executed over a seven day timeframe (referenced at

index=_internal source=*license_usage.log type="Usage" 
 | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
 | eval sourcetypename = st
 | bin _time span=1d 
 | stats sum(b) as b by _time, pool, indexname, sourcetypename
 | eval GB=round(b/1024/1024/1024, 3)
 | fields _time, indexname, sourcetypename, GB

...provides a breakdown of total license usage by index and sourcetype per day.

I'd like to have the output of the search provide a total license usage by index and sourcetype that reflects the search timeframe used. So, for my seven day timeframe example, I'd like each entry in the Statistics tab to reflect the seven day license usage total for a single index/sourcetype pairing. Can this be done...and, if so, how?

0 Karma


Depends on how you want the presentation, there are several ways.

This one will add the total for the week on to each relevant record as a column...

| eventstats sum(GB) as totGB by indexname sourcetypename

This one will add a new row record at the end for each combination...

| appendpipe [| stats sum(GB) as GB by indexname sourcetypename | eval _time = "total"]
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!