As you can see, there are 28 instances of the cache program. We would like to roll all of that up into something like this:
For the top sourcetype, the VIRT sourcetype counts RAM in kilobytes. If VIRT's integer value is greater than 1024, we want the integer multiplied by 1024 and suffixed with the letter "M" for megabytes; and if the integer is greater than 1048576, we want that integer multiplied by 1048576 and suffixed with the letter "G" for gigabytes. Here is what we've come up with so far, but it's nowhere near what we need:
index=xxxx sourcetype=top host=xxxx COMMAND!="<n/a>"
| rename COMMAND as Program, pctCPU as "% CPU", USER as User
| regex "% CPU"="(\d+)"
| convert rmunit(VIRT)
| eval inMB=if(VIRT>=1024,1,0), VIRT=floor(if(inMB=1,VIRT/1024,VIRT*1))
| chart sum(VIRT) by Program