Is there a way to combine the sum(b) of the default index and main index in the license_usage.log file

[coleman07]

I want one total for the bytes sent to both the main and default index since they are both the same index. The license_usage.log file records them as different indexes because I believe we have forwarders not configured to send to a specific index.

02-17-2016 05:07:19.006 -0500 INFO  LicenseUsage - type=Usage s="WinEventLog:System" st="WinEventLog:System" h="WS-Piano" o="" idx="default" i="09F538B3-E658-4C42-A213-EE89679465E0" pool="auto_generated_pool_enterprise" b=5922 poolsz=204010946560

02-17-2016 05:07:20.488 -0500 INFO  LicenseUsage - type=Usage s="udp:514" st=syslog h="129.6.79.11" o="" idx="main" i="E3E369A5-DE83-47BC-804E-153BC246D021" pool="auto_generated_pool_enterprise" b=94889 poolsz=204010946560

Here is the search used by the Usage over 30 days for index use via the licensing selection under settings. I have removed the eval's that are not pertinent to the question.

| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st,idx

Is there a way to rename those idx called "default" to "main" before doing the sum and then be able to sum both default and main into one total for my report?

[mendesjo]

why does it show only top 10 indexes? how do you get so see more? In today world can we see this in GB's? Or even MB's?

[richgalloway]

How about this?

| eval idx=case(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx="default","main",1=1,idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st,idx