Does the the following work?
| inputlookup asn
If so the following should work as well.
| inputlookup asn
| eval clientip="216.58.200.110"
| dedup clientip
| lookup asn ip AS clientip output asn autonomous_system ip
| rename ip AS ip_range
| iplocation clientip
| table clientip ip_range autonomous_system asn City Region Country lat lon
... View more
index=_internal source="*license_usage.log" type=usage type=Usage idx=* pool="Your Pool Name" earliest=-30d@d latest=@d
| eval GB = b
| timechart limit=50 partial=false span=1d sum(eval(GB/1024/1024/1024)) by idx
This works well for me.
... View more