you have prebuilt alert for it in splunk
settings -> Monitoring Console -> settings (dropdown) -> Alerts Setup
enable and modify thresholds to the following:
DMC Alert - Expired and Soon To Expire Licenses
DMC Alert - Total License Usage Near Daily Quota
or copy the searches, pay attention to macros (use the job inspector to see full search)
Hope it helps
p.s. license should probably run daily or every 4 hours or so.
most of the time i have seen users alert if at mid day, they are more than 50% daily license usage.
you can apply the same principal