Below is the query i have . this can be used with a fixed threshold. I need to know if an host data spikes over a certain percentage and trying to get an alert if such a spike occurs. May be have to compare last one or two hours data .
index=_internal sourcetype=splunkd component=LicenseUsage type=Usage
| bucket span=1h _time
| stats sum(b) as usage by _time h | rename h as host
| eval usageGB=round(usage/1024/1024/1024,3)
| table _time host usageGB
| where usageGB >= 20