index=_internal source=*license_usage.log type=Usage h=192.168.0.0/16 | stats sum(b) as bytes by h | eval usagePercent=bytes/( 50 *1024*1024*1024)*100 | where usagePercent>5 This search would output the hosts in the 192.168.0.0/16 range using more than 5 % of the 50 GB license for the selected time range. You'd have to customize this search (ie. change 50 to the actual licensed volume and set the threshold). Also, this search assumes the host values in splunk to be IP addresses. You'd have to add reverse DNS resolution if this isn't the case. index=_internal source=*license_usage.log type=Usage | lookup dnslookup clienthost as h OUTPUT clientip as ip | eval h=coalesce(ip,h) | search h=192.168.0.0/16 | stats sum(b) as bytes by h | eval usagePercent=bytes/( 50 *1024*1024*1024)*100 | where usagePercent>5 ... View more

There are 2 alternatives to show the current (today's) license usage: | rest /services/licenser/pools | stats sum(used_bytes) as used | eval used=round(used/1024/1024) or index=_internal source=*license_usage.log type=Usage earliest=@d | stats sum(b) as bytes | eval mb=round(bytes/1024/1024) | fields mb ... View more

Try this, I got joshbronko's working with the addition of a couple asterisks: index=internal source=*metrics.log group=per_index_thruput series!=* | eval totalMB = round(kb/1024,2) | chart sum(totalMB) as total ... View more

I tried that, and this is what I got: http://i42.tinypic.com/3480l6o.png The blacked out sections are hosts ... View more