You can play around with this. We typically do earliest=@d so that we know the percent we have used today but you should be able to get what you want from this. index=_internal source=*license* type=Usage | stats sum(b) as BytesUsed max(poolsz) as PoolSize by pool | eval percent = BytesUsed/PoolSize | eval LicenseUsedInGB=round(BytesUsed/1024/1024/1024,2) | eval PoolSizeInGB=PoolSize/1024/1024/1024 | eval PercentUsed=round(percent*100,3) | fields PoolSizeInGB LicenseUsedInGB PercentUsed You can also look at the latest SoS. The licensing info is accurate and you can tweak the searches form that. ... View more