The following Splunk query will return results for license usage by sourcetype:
index=_internal source="*license_usage.lo*" type=Usage | stats sum(b) as bytes by st | eval Megabytes=bytes/1048576 |eval Megabytes=round(Megabytes,2) | fieldformat Megabytes=tostring(Megabytes,"commas")| rename st as sourcetype | fields - bytes | sort - Megabytes
Do you happen to have a way to modify this search string to add totals and then show each sourcetype with its percentage of the whole?
index=_internal source=”*license_usage.lo*” type=Usage
| stats sum(b) as bytes by st
| eval Megabytes=bytes/1048576
| eval Megabytes=round(Megabytes,2)
| rename st as sourcetype
| fields – bytes
| sort – Megabytes
| eventstats sum(Megabytes) as totalMB
| eval percent=100*(Megabytes/totalMB)
You rock friend! Thanks a bunch!