Splunk Ingestion Metrics

[scout29]

I am trying to get the ingestion per day in Terabytes for each index. I am using the below search which works, however the ingestion numbers are not formatted great. For example, using the below search,  for an index i get a usage value of 4587.16 which would be 4.59 terabytes per day. I am looking for this number to be rounded in the search results to show like 4.59

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=*
| stats sum(b) as usage by idx | rename idx as index | eval usage=round(usage/1024/1024/1024,2)

[richgalloway]

That query works for me.  What results do you get and how do they not match what you want?

[scout29]

Yes, the query works - however i want the values to be formatted differently within the search results. I would like the values to show in terabytes.  For example, using the query i get a value of 4587.43 (in GB) for an index ingestion value. I would like this to round and show in Terabytes as 4.59

[richgalloway]

The eval command is converting bytes into gigabytes.  Add another `/1024` to convert to terabytes.

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage idx=*
| stats sum(b) as usage by idx 
| rename idx as index 
| eval usage=round(usage/1024/1024/1024/1024,2)