I guess you're trying to make a custom license dashboard?
By default, there should be a search called License Usage Data Cube in your search app. If not, it's this search:
index=_internal source=*license_usage.log* type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx
Accelerate that search using report acceleration and an appropriate time range, e.g. 30 days. Once the acceleration has completed, add the saved search to your dashboard as a base search and display your data with a postprocessing search something like this:
| search st=$st$ | timechart span=1d sum(b) by h
That's assuming st is a token from a dropdown selecting the sourcetype to filter by.
... View more