query help

[Praz_123]

query is -

index="_internal" source="*license_usage.log" type=Usage h="abc" earliest=-3d@d latest=@d | stats sum(b) as usage by _time | eval usage_in_GB = usage / 1024 / 1024 / 1024 | timechart span=1d sum(usage_in_GB) as usage_GB

with the query I can see for specific host but I need a query to see top 10 host which are using daily more than 2gb usage


while using the below am not getting the results :-

index="_internal" source="*license_usage.log" type=Usage earliest=-3d@d latest=@d
| stats sum(b) as usage by _time, h
| eval usage_in_GB = usage / 1024 / 1024 / 1024
| where usage_in_GB > 2
| stats sum(usage_in_GB) as total_usage_GB by h
| sort - total_usage_GB
| head 10

[PrewinThomas]

@Praz_123 
For each day if you want to check try below,

index=_internal source="*license_usage.log" type=Usage earliest=-3d@d latest=@d
| eval usage_in_GB = b/1024/1024/1024
| bin _time span=1d
| stats sum(usage_in_GB) as daily_usage_GB by _time h
| where daily_usage_GB > 2
| sort - daily_usage_GB
| head 10

[livehybrid]

Hi @Praz_123 

Try using the bin command before your first stats, something like this should work:

index="_internal" source="*license_usage.log" type=Usage earliest=-3d@d latest=@d
| bin span=1d _time
| stats sum(b) as usage by _time, h
| eval usage_in_GB = usage / 1024 / 1024 / 1024
| where usage_in_GB > 2
| stats sum(usage_in_GB) as total_usage_GB by h
| sort - total_usage_GB
| head 10

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing