This was cobbled together from multiple searches I found. This search feeds the license and storage dashboard posted here:

It relies on the Chargeback app for the customers.csv form.

index=_internal source=*license_usage.log type="Usage" earliest=-30d@d latest=@d 
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| eval sourcetypename = st 
| bin _time span=1d 
| stats values(poolsz) as poolsz sum(b) as b by _time, pool, indexname, sourcetypename 
| eval GB=(b/1024/1024/1024) 
| eval pool=(poolsz/1024/1024/1024) 
| fields _time, indexname, sourcetypename, GB, pool 
| eval day=strftime(_time,"%a") 
| eval yesterday=tostring(strftime(relative_time(now(),"-d@d"),"%Y-%m-%d")) 
| eval time=tostring(strftime(_time,"%Y-%m-%d")) 
| eval isyesterday=if(yesterday==time,"true","is_average") 
| eval Yesterday=if(isyesterday="true",GB,0) 
| stats values(pool) as pool sum(Yesterday) as Yesterday avg(GB) as Average by indexname, sourcetypename 
| stats values(pool) as pool list(sourcetypename) sum(Yesterday) sum(Average) by indexname 
| join indexname 
[| inputlookup customers.csv 
| rename idx AS indexname 
| fields group indexname
] 
| join indexname 
[| rest /services/data/indexes search="totalEventCount!=0" 
| stats sum(currentDBSizeMB) AS currentDBSizeMB by title 
| rename title AS indexname 
| fields indexname currentDBSizeMB] 
| fields group indexname sum(Yesterday) sum(Average) currentDBSizeMB 
| sort - sum(Yesterday) | outputlookup size_license_group_usage.csv