The search above got me started in the right direction. I find this outputs the data in a more elegant format:
index=_internal source=*license_usage.log
earliest=-24h
| eval GB=round(b/1024/1024/1024, 2)
| stats sum(GB) count by st
| sort - sum(GB)
... View more