Hi jimcroft you could use something like this: index=_internal metrics kb series!=_* group="per_index_thruput" earliest=-1@d | eval indexed_GB = (kb / 1024 / 1024) | timechart eval(round((sum(indexed_GB)),2)) as TotalGB fixedrange=t span=1d which would give you todays amount of data being indexed in GB so far. Or use the deployment monitor App or the S.O.S. App or the Licence usage App. to get the license quota use: | REST /services/licenser/licenses/ the field quota is what you are looking for. cheers, MuS ... View more

Hi JensT given your lookup table is like this: cs_host, cs_description foohost, this is used for logging get the entries from the lookup table first, filter it based on which host you are seeing in the system logs. Let's say your lookup table is called "cs_lookup.csv" , the relevant logs have sourcetype "cs_systemlogs" and that the field "cs_host" exists in those log events. In that case, this search should get you going: | inputlookup cs_lookup.csv | search NOT [search sourcetype="cs_systemlogs" | dedup cs_host | fields cs_host] hope this helps or gets you starting to find the result you're looking for cheers, MuS ... View more