Step 1: Create a lookup table file, say dept_index_lookup.csv with field department,index
department,index
...................................
dept1,acc_jboss
dept1,prod_jboss
dept1,test_jboss
dept2,prod_network
dept2,acc_network
dept2,test_network
Step 2 : Search License usage search like this
index=_internal source=*license_usage.log type=usage | stats sum(b) as usageGB by idx | eval usageGB=round(usage/1024/1024/1024,2) | rename idx as index | lookup dept_index_lookup.csv index OUTPUT department | table department index usageGB
... View more