You can generally get there with SPL, e.g. here's a bit of a hack, which has a stab at it based on your data example | makeresults format=csv data="title,totalEventCount,frozenTimePeriodInSecs,count...
See more...
You can generally get there with SPL, e.g. here's a bit of a hack, which has a stab at it based on your data example | makeresults format=csv data="title,totalEventCount,frozenTimePeriodInSecs,count,usedData
_audit,771404957,188697600, ,
_configtracker,717,2592000, ,
_dsappevent,240,5184000, ,
_dsclient,232,5184000, ,
_dsphonehome,843820,604800, ,
_internal,7039169453,15552000, ,
_introspection,39100728,1209600, ,
_telemetry,55990,63072000, ,
_thefishbucket,0,2419200, ,
, , ,22309,_*
, , ,1039,_audit
, , ,2,_configtracker
, , ,1340,_dsappevent
, , ,1017,_dsclient
, , ,1,_dsclient]
, , ,709,_dsphonehome
, , ,2089,_internal
, , ,117,_introspection
, , ,2,_metrics
, , ,2,_metrics_rollup
, , ,2,_telemetry
, , ,2,_thefishbucket"
| eval title=coalesce(title, usedData)
| fields - usedData
| stats values(*) as * by title
| eventstats values(eval(if(match(title, "\*"), title."##".title."##".count, null()))) as wildcard_indexes
| eval wildcard_indexes=mvmap(wildcard_indexes, replace(wildcard_indexes, "\*(.*##)?", ".*\1"))
| eval count=count+sum(mvmap(wildcard_indexes, if(match(title, mvindex(split(wildcard_indexes, "##"), 0)) AND title!=mvindex(split(wildcard_indexes, "##"), 1), mvindex(split(wildcard_indexes, "##"), 2), 0)))
| fields - wildcard_indexes