I need some help with an existing license report. This report works fine:
index=summary sourcetype=license_info | eval b=b/1024/1024/1024 |eval b=round(b,2)| timechart span=1mon sum(b) AS GB by idx
It takes data from an existing summary index. Now, I've been asked to 1) limit the indexes being reported to a select few, 2) combine all windows* indexes into a generic "windows" total, and list everything besides certain ones as "Other". Number one is easy. Not sure how to do number 2 and 3, looking for assistance.
| eval idx=case(match(idx,"windows"),"windows", idx="index1" OR idx="index1" OR idx="index3"..list of indexes you want to limit the report to.., idx , true(), "other")
| timechart span=1mon sum(b) AS GB by idx
foreach * [| eval "<<FIELD>>"=round('<<FIELD>>'/1024/1024/1024,2)]