Hi,
This functionality is built in to the License Usage report accessible from either the License settings page and choose from the Split By droplist, or the Monitoring conosle > Indexing > License Usage.
You can easily open any of the prebuilt panels in search and modify the query to suit your needs.
index=_internal [`set_local_host`] source=*license_usage.log* type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, s, st, h, idx
| timechart span=1d sum(b) AS volumeB by st fixedrange=false
| fields - _timediff
| foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024, 2)]
Take note of the stats line. It has the optional parameters you want. Modify the timechart line below that with the specific split you're looking for. s=source, st=sourcetype, h=host, idx=index
... View more