index=_internal source=*license_usage.log type="Usage"
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB
...provides a breakdown of total license usage by index and sourcetype per day.
I'd like to have the output of the search provide a total license usage by index and sourcetype that reflects the search timeframe used. So, for my seven day timeframe example, I'd like each entry in the Statistics tab to reflect the seven day license usage total for a single index/sourcetype pairing. Can this be done...and, if so, how?