I use a small saved search for reporting when I have a license violation problem:
index=_internal source=*license_usage.log | eval GB=b/1024/1024 | stats sum(GB) by pool,
date_mday, date_month | eval used='sum(GB)' | search used>1000 | sort date_month, date_mday
| table date_month, date_mday, used
Since I upgraded to 4.3.2 this has been reporting wildly inaccurate results, including today (1073 megabytes, when we have only used under 250). Is there anything I need to do to update this query for use with the new version?