Hi
We are using a search which we got from Answers to calculate license usage:
index=_internal source=*license_usage.log* type=Usage | timechart span=1d sum(b) as bytes | eval GB = round(bytes/1024/1024/1024,5) | fields _time GB
There is field called idx which gives the list of indexes in Splunk.
How do I create a pie chart for indexes which start with "np_" which are the non prod indexes eg : np_Webserver and another pie chart for all the prod indexes?
So you just want to create two pie charts - one for prod indexes and one for non-prod? And the slices would be actual indexes based on how much was indexed?
If so maybe something like these:
Non-prod
index=_internal source=*license_usage.log* type=Usage idx=np_* | stats sum(b) as bytes by idx | eval GB = round(bytes/1024/1024/1024,5) | fields idx GB
Prod
index=_internal source=*license_usage.log* type=Usage idx!=np_* | stats sum(b) as bytes by idx | eval GB = round(bytes/1024/1024/1024,5) | fields idx GB