I want one total for the bytes sent to both the main and default index since they are both the same index. The license_usage.log file records them as different indexes because I believe we have forwarders not configured to send to a specific index.
02-17-2016 05:07:19.006 -0500 INFO LicenseUsage - type=Usage s="WinEventLog:System" st="WinEventLog:System" h="WS-Piano" o="" idx="default" i="09F538B3-E658-4C42-A213-EE89679465E0" pool="auto_generated_pool_enterprise" b=5922 poolsz=204010946560
02-17-2016 05:07:20.488 -0500 INFO LicenseUsage - type=Usage s="udp:514" st=syslog h="129.6.79.11" o="" idx="main" i="E3E369A5-DE83-47BC-804E-153BC246D021" pool="auto_generated_pool_enterprise" b=94889 poolsz=204010946560
Here is the search used by the Usage over 30 days for index use via the licensing selection under settings. I have removed the eval's that are not pertinent to the question.
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st,idx
Is there a way to rename those idx called "default" to "main" before doing the sum and then be able to sum both default and main into one total for my report?
... View more