This was cobbled together from multiple searches I found. This search feeds the license and storage dashboard posted here:
It relies on the Chargeback app for the customers.csv form.
index=_internal source=*license_usage.log type="Usage" earliest=-30d@d latest=@d | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d | stats values(poolsz) as poolsz sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=(b/1024/1024/1024) | eval pool=(poolsz/1024/1024/1024) | fields _time, indexname, sourcetypename, GB, pool | eval day=strftime(_time,"%a") | eval yesterday=tostring(strftime(relative_time(now(),"-d@d"),"%Y-%m-%d")) | eval time=tostring(strftime(_time,"%Y-%m-%d")) | eval isyesterday=if(yesterday==time,"true","is_average") | eval Yesterday=if(isyesterday="true",GB,0) | stats values(pool) as pool sum(Yesterday) as Yesterday avg(GB) as Average by indexname, sourcetypename | stats values(pool) as pool list(sourcetypename) sum(Yesterday) sum(Average) by indexname | join indexname [| inputlookup customers.csv | rename idx AS indexname | fields group indexname ] | join indexname [| rest /services/data/indexes search="totalEventCount!=0" | stats sum(currentDBSizeMB) AS currentDBSizeMB by title | rename title AS indexname | fields indexname currentDBSizeMB] | fields group indexname sum(Yesterday) sum(Average) currentDBSizeMB | sort - sum(Yesterday) | outputlookup size_license_group_usage.csv
Usage dashboard posted here: https://gosplunk.com/license-and-storage-usage-dashboard