I hope this search query proves useful to you. index=federated:infosec_apg_share source=InternalLicenseUsage type=Usage idx=*_p* idx!=zscaler* st IN ([ search index=<your_index> | stats count by sourcetype | fields sourcetype ]) | stats sum(b) by st | eval GB = round('sum(b)'/1073741824,2) | fields st, GB   ------ If you find this solution helpful, please consider accepting it and awarding karma points !! ... View more

Hi @sverdhan , Go in [Settings > Licensing > License Usage > Previous 60 days > Split by Sourcetype] and you'll have your search that will be: index=_internal [`set_local_host`] source=*license_usage.log* type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx | timechart span=1d sum(b) AS volumeB by st fixedrange=false | fields - _timediff | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] Ciao. Giuseppe ... View more

Actually, that's a problem which does not have a precise solution. Short of re-running the search and checking what kind of sourcetypes are returned (and even then it's not 100% sure because you can have some random aspects of the search) there's no way of knowing what sourcetypes were searched in general case. So everything you infer from your searches will only be some kind of heuristics - it will give you some probable overview of your searches results but short of recording access to each single event (which obviously Splunk does not do) there's no way of knowing which particular events/metric points were accessed and subsequently what were their metadata values. ... View more

index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3) | fields _time, indexname, sourcetypename, GB ... View more