If you want overall, then you can use this timechart version
index=_internal sourcetype=splunkd source=*license_usage.log type=Usage
| timechart span=1d sum(b) as usage_mb| eval usage_mb=round(usage_mb/1024/1024,3)
For per index, you can use this
index=_internal sourcetype=splunkd source=*license_usage.log type=Usage
| timechart span=1d sum(b) as usage by idx limit=0 | foreach * [ eval "<<FIELD>>"=round('<<FIELD>>'/1024/1024,3)]
OR
index=_internal sourcetype=splunkd source=*license_usage.log type=Usage
| bucket span=1d _time | stats sum(b) as bytes by _time idx | eval mb=round(bytes/1024/1024,3)
... View more