Just sharing a query I found useful lately when licensing dashboards are being silly. Mileage may vary.

index="_introspection" component="licensing.stack"
| bucket _time span=1d 
| stats latest("data.consumption") as dataConsumption latest("data.pools{}.quota") as poolQuota by _time
| eval pctUsed=(dataConsumption/poolQuota * 100)
| timechart span=1d max(pctUsed)