Fortytwo - Answer to the Ultimate Question of Life, the Universe, and Everything

| tstats count WHERE index=* OR index=_* by index

| eventcount summarize=false index=* | dedup index | fields index

| tstats count as EVENTS_PER_HOST where index=* by index,sourcetype,host | table * | sort by index

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage 
| stats sum(b) as bytes by idx | eval mb=round(bytes/1024/1024,3)

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage 
     | timechart span=1d sum(b) as usage by idx limit=0 | foreach * [ eval "<<FIELD>>"=round('<<FIELD>>'/1024/1024,3)]

| inputlookup my_lookup.csv

| rest /servicesNS/-/-/admin/macros count=0