Can you help us with a grouping query?

[a212830]

I need some help with an existing license report. This report works fine:

index=summary sourcetype=license_info  | eval b=b/1024/1024/1024 |eval b=round(b,2)| timechart span=1mon sum(b) AS GB by idx

It takes data from an existing summary index. Now, I've been asked to 1) limit the indexes being reported to a select few, 2) combine all windows* indexes into a generic "windows" total, and list everything besides certain ones as "Other". Number one is easy. Not sure how to do number 2 and 3, looking for assistance.

[somesoni2]

Try like this

index=summary sourcetype=license_info  
| eval idx=case(match(idx,"windows"),"windows", idx="index1" OR idx="index1" OR idx="index3"..list of indexes you want to limit the report to.., idx , true(), "other")
| timechart span=1mon sum(b) AS GB by idx
foreach * [| eval "<<FIELD>>"=round('<<FIELD>>'/1024/1024/1024,2)]

[sloshburch]

Yea, and the filtering to a select few could be tossed in as part of the base search drawn from a dashboard form's tokens.