Splunk search for License usage by sourcetype
Copy
index=_internal source="*license_usage.log*" type=Usage | stats sum(b) as bytes by st | eval MB=tostring(round(bytes/1024/1024,2),"commas")| rename st as Sourcetype | fields - bytes | sort - Megabytes
This search will provide a table of license usage per sourcetype. This search will output license usage in terms of Megabytes.