I've tried using timewrap, but I don't think I'm using it crrectly?
index=_internal source=*license_usage.log type="Usage" earliest=-1w@d | eval Date=strftime(_time, "%Y/%m/%d") | eventstats sum(b) as volume by idx, Date | eval GB=round(volume/1024/1024/1024,5) | timechart first(GB) AS volume by idx | timewrap 1w
Have you looked at the licensing reports? These will indicate the daily licence usage (volume indexed) for each index (or sourcetype).
Try this as a starting point:
(index=_internal source=*license_usage.log* type="Usage") | eval idx=if(((len(idx) == 0) OR isnull(idx)),"(UNKNOWN)",idx) | search idx=YOURINDEXNAME | bin span=1d _time | stats sum(b) as bytes by _time,idx | delta bytes as change | eval perc=round((change/bytes)*100,2)
If you are using indexer discovery, this becomes very easy to solve.
On the cluster master UI, go to Settings > Monitoring Console (black bar) > Indexing (grey bar) > Index Detail: Deployment.
That interface will provide all the information you are seeking, and then some.