index="_internal" source="*license_usage.log" type=RolloverSummary earliest=-30d@d latest=now | eval _time = _time - 43200 | bin _time span=1d | stats latest(b) AS b by slave,pool,_time | eval DailyGB=round(bytes/1024/1024/1024,2) | timechart sum(DailyGB) as "volume (GB)" span=1d @FrankVl The above gives me aggregated values across all the clusters.  How do I find out the usage per  indexers cluster? I have around 7-8 clusters. Any leads would be appreciated. Thanks ... View more