Convert search to display the results in GB instead of bytes?

[sunnyparmar]

Hi,

Currently i am running below query and it is showing me data in bytes. How do I convert in into GB's?

index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | sort -total_usage

Thanks in Advance

[javiergn · Accepted solution]

Try this:

index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | eval total_usage = round((total_usage/1024/1024/1024), 2) |  sort -total_usage

[ddrillic]

It can be nice to define a new field for this purpose via -
Fields >> Calculated fields >> Add new

[somesoni2]

It will depend upon the usage. LIke here, in-search calculation will be faster as it's done after the aggregation command (chart), and would be in-efficient (relatively) if it was a calculated field.

[somesoni2]

One performance improvement suggestion on @javiergn's answer, to do the lookup after the chart command.