Can you help us with a grouping query?


I need some help with an existing license report. This report works fine:

index=summary sourcetype=license_info  | eval b=b/1024/1024/1024 |eval b=round(b,2)| timechart span=1mon sum(b) AS GB by idx

It takes data from an existing summary index. Now, I've been asked to 1) limit the indexes being reported to a select few, 2) combine all windows* indexes into a generic "windows" total, and list everything besides certain ones as "Other". Number one is easy. Not sure how to do number 2 and 3, looking for assistance.

0 Karma

Revered Legend

Try like this

index=summary sourcetype=license_info  
| eval idx=case(match(idx,"windows"),"windows", idx="index1" OR idx="index1" OR idx="index3"..list of indexes you want to limit the report to.., idx , true(), "other")
| timechart span=1mon sum(b) AS GB by idx
foreach * [| eval "<<FIELD>>"=round('<<FIELD>>'/1024/1024/1024,2)]
0 Karma

Ultra Champion

Yea, and the filtering to a select few could be tossed in as part of the base search drawn from a dashboard form's tokens.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!