This is the search: index=_internal source=*license_usage.log* type="Usage" earliest=-30d@d latest=@d idx=apcne | fields _time, pool, idx, b | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=24h | stats sum(b) as b by _time, pool, idx | stats sum(b) AS volume by idx, _time | stats avg(volume) AS avgVolume max(volume) AS maxVolume by idx | eval avgVolumeGB=round(avgVolume/1024/1024/1024,2) | eval maxVolumeGB=round(maxVolume/1024/1024/1024,2) | fields idx, avgVolumeGB, maxVolumeGB | rename avgVolumeGB AS "average" maxVolumeGB AS "peak" idx AS "Index"
... View more