License usage by OS type

[kpavan]

Hi,

I want get the license usage by host and specifically for windows OS, I got host usage by below query, but if I add the tag=windows* its not given any output. Please suggest me

index=_internal source=*license_usage.log type=Usage
| stats sum(b) as bytes by h
| eval MB = round(bytes/1024/1024,1)
| fields h MB
| rename h as host

Thanks

[somesoni2]

Use following query to get Host -OS mapping

index=_internal (source=*metrics.log) |dedup os,hostname | rename hostname as host| table os,host

Save this a lookup table file (say host_os.csv), then use it to get the license usage by OS

index=_internal source=*license_usage.log type=Usage | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | fields h MB | lookup host_os.csv host as h | stats sum(bytes) as bytes by os