We've been working on managing our Splunk license, but it's been a really manual effort and it seems like Splunk could/should have a way to see index metrics by host and source on a daily basis. I can't find this info anywhere, so maybe someone out there can help with a clue (or save me the trouble of looking for something that doesn't exist).
Also look at index=_internal component=LicenseUsage. You can aggregate on s (source), st (sourcetype), h (host) and i (indexer). The field b is bytes.
This must be done from the License Manager or where ever those logs are made available.