The following search seem to work much faster, and the results are close enough - there may be some small rounding effects, but nothing significant. It's based on the searches used by the Deployment Monitor. It does not take the advanced licensing stacking, pooling etc into account. It will just give you a simple table of the amount indexed by indexer.
I did put a "where" statement in to filter out the search head itself, which also poplulates the summary index, but it's only a couple of kb, so it just clutters the report (the poster said he wanted an early warning system - not correctness down to the *n*th decimal).
index="summary_indexers" | bucket _time as day span=d | eval gb=kb/1048576 | eval Date = strftime(day, "%b %d, %Y - %A")| stats sum(gb) as GB by my_splunk_server, Date | eval GB=round(GB,2)| where GB > "0.01" |eventstats sum(GB) as SumDailyGB by Date
This has been tested on a 1 search head - 1 indexer setup, so your results may differ.
Not sure if this would really help you, but you could always play around with it a little. Below a simpler version just giving you the basics.
index="summary_indexers" | eval GB=kb/1048576 | eval GB=round(GB,2)| timechart span=1d sum(GB) by my_splunk_server | addtotals
Kristian
... View more