If you are running Splunk Enterprise 6.0 or higher, you will find that we ship a built-in License Usage Report view which, when consulted from your license master, allows to report on daily license usage per index out of the box.
Note that most of the searches behind the "Last 30 days" tab of this view are powered by a "datacube" search that can be accelerated on demand to ensure that the panels grouping daily license usage by index, source, sourcetype and host load fast.
Finally, as @somesoni2 mentions if you are still running Splunk Enterprise 5.x, you will find a copy of the same view in S.o.S titled "License Usage - Last 30 Days".
You are probably going to want to do a Summary Index search so that your searches are quicker if you have lots of data. I do a summary search every day at about 5AM for the previous day using the following search:
index=_internal source=*license_usage.log type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | stats sum(b) as b by idx | eval GB=(b/1024/1024/1024) | sort -GB | fields - b
I use an additional value in the summary table of
report_type=daily_usage so that it will be unique.
Then the query to do a roll-up of a month of data, you can use something like:
index=summary report_type=daily_usage | stats sum(GB) as total by idx | eventstats sum(total) as GrandTotal | eval percent=round(total/GrandTotal*100,1) | sort -total
This should get you a report of the total of each index by month. We do this because we have separate indexes for different departments and are doing a show-back (instead of a charge-back) of their Splunk usage.