this search works great to provide me a list of hosts showing how much license usage over a 1 day period, but when I put it in a bar graph it does not work well because the stats command provides an OVERALL total as well as a total for each host, how to I remove the overall total and only show the total for the top 5 hosts.
index="_internal" source="*license_usage.log" | rename h as host b as bytes | eval my_splunk_server = splunk_server | fields source mysourcetype host bytes pool originator my_splunk_server | eval mbytes=((bytes/1024)/1024) | stats sum(mbytes) as mbytes by host