Can you help me compare how much data was ingested in GB from an index today and yesterday?

[snallam123]

I tried this,

| dbinspect index=test  | eval GB=sizeOnDiskMB/1024| addinfo span=-2d | stats sum(GB) as today 
| append
 [| dbinspect index=test  | eval GB=sizeOnDiskMB/1024 | addinfo span=-1d | stats sum(GB) as yesterday ]

I am not getting accurate results from above. Can any one suggest a query with accurate results?

Thanks.

[somesoni2]

Use the license usage query (run this on your license server OR search head, if you forward license server logs to indexers searchable by search head). Use appropriate time range (e.g. earliest=-1d@d latest=now)

index=_internal sourcetype=splunkd component=LicenseUsage idx=test 
| timechart span=1d sum(b) as usage
| eval usageGB=round(usage/1024/1024/1024,2)

[snallam123]

@somesoni2 thanks, The query you mentioned gives license usage of index, I am looking to figure out how much data i am getting from all servers to that particular index(ex:test) and compare today's data to yesterday's data.

And can you please explain difference between

index=_internal sourcetype=splunkd component=LicenseUsage idx=test
| timechart span=1d sum(b) as usage
| eval usageGB=round(usage/1024/1024/1024,2)

And
| dbinspect index=test | eval GB=sizeOnDiskMB/1024 | stats sum(GB)

Thanks.