right, change the index, for license: index=summary | stats sum(b) as totalBytes by host, index, source, sourcetype | eval host=lower(host) | eval MB=totalBytes/1024/1024 | eval GB=round(MB/1024,2) | sort - GB | head 100 | table host index source sourcetype GB Best, Giulia ... View more

try like this (select time range from the search): index=_internal source=*license_usage.log type="Usage" | stats sum(b) as totalBytes by host, index, source, sourcetype | eval host=lower(host) | eval MB=totalBytes/1024/1024 | eval GB=round(MB/1024,2) | sort - GB | head 100 | table host index source sourcetype GB Let me know 🙂  Best, Giulia ... View more

You can achieve this by leveraging internal indexes and configuring a report. Here's how: Search Query below This search query retrieves license usage data by host for a specific time range: index=_internal source=*license_usage.log type="Usage" | eval host=lower(host) # Standardize hostname (optional) | eval MB=b/1024/1024 # Convert bytes to Megabytes | eval GB=round(MB/1024,2) # Convert Megabytes to Gigabytes (round to 2 decimals) | search earliest=-1mo@d latest=now@d # Adjust timeframe as needed (e.g., -3mo@d for past 3 months) | sort - GB # Sort by license usage in descending order | head 100 # Limit results to top 100 hosts | table host GB source sourcetype ... View more

Try to do this: Open the Dashboard in Edit Mode: Navigate to the dashboard you want to edit. Click on the "Edit" button to enter the edit mode. Access the Source Code: In the top right corner of the dashboard editor, click on the "Source" button to open the JSON source code of the dashboard. Add Custom CSS: Insert a custom CSS block within the JSON to target and hide the export and full-screen icons. To add custom CSS, you need to define a css block within the options field of your dashboard's JSON configuration. Here's a sample of how you can add the custom CSS:   json Copia codice { "type": "dashboard", "title": "Your Dashboard Title", "options": { "css": ".dashboard-panel .dashboard-panel-action { display: none !important; }" }, "visualizations": [ { "type": "icon", "options": { "title": "Your Icon Title", "drilldown": { "type": "link", "dashboard": "linked_dashboard_name" } } } // Add other visualizations here ] } Save and Verify: Save the changes to the dashboard. Verify that the export and full-screen icons no longer appear when hovering over the icon. you can see if this works ... View more

Hi, have you tried to see if it depends on the:  | timechart sum command? bye G. ... View more