How to write a search to charge license usage and the license cap?

[bluemarvel]

Hello,

I need to chart a license usage that will also include the license cap as well (two lines)

[ddrillic]

Alternatively, you can look at -

And -

[dbcase]

index=_internal source="*license_usage.log" type=RolloverSummary | timechart span=1d sum(b) AS DailyVolume | eval DailyVolume=round(DailyVolume/1024/1024/1024,2) | eval License="5"

[somesoni2]

This should give you what you desire (use the appropriate span in timechart)

index=_internal sourcetype=splunkd source=*license_usage.log type=usage | timechart sum(b) as usage max(poolsz) as quota by pool | foreach usage* quota* [eval "<<FIELD>>"=round('<<FIELD>>'/(1024*1024*1024),3) ]