That works! Thanks a lot. I wonder if I should submit a bug report, because I shouldn't really have to do this, and it still doesn't work with the convert command, but at least I have my desired results.
... View more
disclaimer: the above is slow with many indexes (no surprise), and splunk5's eventcount appears to only list those indexes permitted by the current role, so map is unnecessary.
... View more