How to combine results from different pairs of indexes/sourcetypes in one search?

[bcaunt]

The following search executed over a seven day timeframe (referenced at https://answers.splunk.com/answers/344834/how-to-get-a-license-report-with-sourcetypes-and-i.html)...

index=_internal source=*license_usage.log type="Usage" 
 | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
 | eval sourcetypename = st
 | bin _time span=1d 
 | stats sum(b) as b by _time, pool, indexname, sourcetypename
 | eval GB=round(b/1024/1024/1024, 3)
 | fields _time, indexname, sourcetypename, GB

...provides a breakdown of total license usage by index and sourcetype per day.

I'd like to have the output of the search provide a total license usage by index and sourcetype that reflects the search timeframe used. So, for my seven day timeframe example, I'd like each entry in the Statistics tab to reflect the seven day license usage total for a single index/sourcetype pairing. Can this be done...and, if so, how?

[DalJeanis]

Depends on how you want the presentation, there are several ways.

This one will add the total for the week on to each relevant record as a column...

| eventstats sum(GB) as totGB by indexname sourcetypename

This one will add a new row record at the end for each combination...

| appendpipe [| stats sum(GB) as GB by indexname sourcetypename | eval _time = "total"]