Daily license usage value not matching total of values if I split usage by index

[abhinav_maxonic]

In daily license usage graph, say for 10th July, data indexed is 400GB. After that I split the daily license usage by Index. And the total of data indexed of all indexes was just 20GB .
Can anybody explain me this ?
And also , how can I calculate data indexed split by Index ?

[somesoni2]

Try this for daily license usage by index

index=_internal sourcetype=splunkd source=*license_usage.log type=usage | stats sum(b) as usage by idx | eval usage=round(usage/(1024*1024*1024),3)

[abhinav_maxonic]

Thanks ! That answers my 2nd question.

If you can help me with my 1st question as well, it would be great .