Splunk Search

Is there a way to combine the sum(b) of the default index and main index in the license_usage.log file

coleman07
Path Finder

I want one total for the bytes sent to both the main and default index since they are both the same index. The license_usage.log file records them as different indexes because I believe we have forwarders not configured to send to a specific index.

02-17-2016 05:07:19.006 -0500 INFO  LicenseUsage - type=Usage s="WinEventLog:System" st="WinEventLog:System" h="WS-Piano" o="" idx="default" i="09F538B3-E658-4C42-A213-EE89679465E0" pool="auto_generated_pool_enterprise" b=5922 poolsz=204010946560

02-17-2016 05:07:20.488 -0500 INFO  LicenseUsage - type=Usage s="udp:514" st=syslog h="129.6.79.11" o="" idx="main" i="E3E369A5-DE83-47BC-804E-153BC246D021" pool="auto_generated_pool_enterprise" b=94889 poolsz=204010946560

Here is the search used by the Usage over 30 days for index use via the licensing selection under settings. I have removed the eval's that are not pertinent to the question.

| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st,idx

Is there a way to rename those idx called "default" to "main" before doing the sum and then be able to sum both default and main into one total for my report?

0 Karma

mendesjo
Path Finder

why does it show only top 10 indexes? how do you get so see more? In today world can we see this in GB's? Or even MB's?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How about this?

| eval idx=case(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx="default","main",1=1,idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st,idx
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...