Hello,
I need to chart a license usage that will also include the license cap as well (two lines)
index=_internal source="*license_usage.log" type=RolloverSummary | timechart span=1d sum(b) AS DailyVolume | eval DailyVolume=round(DailyVolume/1024/1024/1024,2) | eval License="5"
This should give you what you desire (use the appropriate span in timechart)
index=_internal sourcetype=splunkd source=*license_usage.log type=usage | timechart sum(b) as usage max(poolsz) as quota by pool | foreach usage* quota* [eval "<<FIELD>>"=round('<<FIELD>>'/(1024*1024*1024),3) ]