How to search for a specific license pool usage and the hosts/sources that are providing data to that pool?

[edwardrose]

I was wondering, since I am new to Splunk, what kind of search would I use to search for a specific license pool usage and the hosts/sources that are providing data to that pool.

We currently have 5 different pools, but all the data is going to same 3 indexers. We have Enterprise Security which is the main license pool and we are trying to isolate the amount of data being ingested by that pool and the sources that feed that pool as well.

thanks
ed

[edwardrose]

Maybe this is better

index=_internal source="*license_usage.lo*" type=Usage pool=auto_generated_pool_enterprise | dedup h | rename h as Host | stats sum(b) as bytes by Host | eval mb=bytes/1048576 |addcoltotals|fillnull value="Total" mb

Please let me know what you think or how to make it look nicer

[edwardrose]

I think this is what I am looking for but I also want a total at the bottom

index=_internal source="*license_usage.lo*" type=Usage pool=auto_generated_pool_enterprise | dedup h | stats sum(b) as bytes by h | eval mb=bytes/1048576

any help with that?

thanks
ed