https://community.splunk.com/t5/Alerting/Alerts-Assistance-in-showing-servers-logging-the-most-when/m-p/432886#M11214 <P>Try like this</P> <PRE><CODE>index=_internal source="license_usage.lo" type=Usage pool="Linux Pool" earliest=@d | stats sum(b) as usageGB by h | eval usageGB =usageGB/1024/1024/1024 | eventstats sum(usageGB) as TotalUsage | sort 10 UsageGB|where TotalUsage&gt;=22 </CODE></PRE> Tue, 28 Aug 2018 15:48:14 GMT somesoni2 2018-08-28T15:48:14Z https://community.splunk.com/t5/Alerting/Alerts-Assistance-in-showing-servers-logging-the-most-when/m-p/432885#M11213 <P>I am looking for help to see how i can have my current alert, which emails me that our quota is 75% full, to also present in my email the top 10 offenders of logging.</P> <P>Is that possible?</P> <P>Currently my search i'm using to show a 30G quota being 75% full is:</P> <P>index=_internal source="<EM>license_usage.lo</EM>" type=Usage pool="Linux Pool" earliest=@d| stats sum(b) as bytes | eval gb=bytes/1024/1024/1024|where gb&gt;=22</P> <P>Is there a way on the search to also have it show the top offenders, such as</P> <P>index = * | tp limit=10 host</P> <P>Thank you!</P> Tue, 29 Sep 2020 21:04:39 GMT https://community.splunk.com/t5/Alerting/Alerts-Assistance-in-showing-servers-logging-the-most-when/m-p/432885#M11213 agentguerry 2020-09-29T21:04:39Z https://community.splunk.com/t5/Alerting/Alerts-Assistance-in-showing-servers-logging-the-most-when/m-p/432886#M11214 <P>Try like this</P> <PRE><CODE>index=_internal source="license_usage.lo" type=Usage pool="Linux Pool" earliest=@d | stats sum(b) as usageGB by h | eval usageGB =usageGB/1024/1024/1024 | eventstats sum(usageGB) as TotalUsage | sort 10 UsageGB|where TotalUsage&gt;=22 </CODE></PRE> Tue, 28 Aug 2018 15:48:14 GMT https://community.splunk.com/t5/Alerting/Alerts-Assistance-in-showing-servers-logging-the-most-when/m-p/432886#M11214 somesoni2 2018-08-28T15:48:14Z