license utilization for big increase in paloalto index - solution and root cause

[vijaykuma]

• index=_internal host="ip" source=*license_usage.log* type="Usage" 
      [| inputlookup all_cs_indexes.csv 
      | rename index as idx 
      | table idx] AND NOT (idx=paloalto h=10.168.128.251 st="pan:traffic" ) AND NOT (idx=paloalto st="pan:system") AND NOT (idx=paloalto st="pan:con*") AND NOT (idx=paloalto st="pan:lo*") AND NOT (idx=wineventlog st="WinEventLog:Application") AND NOT (idx=wineventlog st="WinEventLog:System") AND NOT (idx=wineventlog st="win:os:details") AND NOT (idx=wineventlog st="WinHostMon") 
  | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
  | eval sourcetypename = st 
  | bin _time span=1d 
  | stats sum(b) as b by _time indexname, sourcetypename 
  | stats avg(b) as avgGB by indexname sourcetypename 
  | eval avgGB=round(avgGB/1024/1024/1024, 6)

  Please come up with your analysis.

[richgalloway]

Analysis not possible.  Insufficient data.  Please describe the problem you are having.

What is the intended purpose of the given search query?  What are the results?  What are the expected results?  What are we expected to analyze?