Trust the license usage (not the metrics) form the license-master.
Example for the size for yesterday
earliest=-1d@d latest=@d index=_internal source=*license_usage.log* type=Usage
| stats sum(b) AS Bytes by st
| sort -Bytes
see more here : http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume
... View more