The per_*_thruput metrics only account for a sample of the sources/hosts/sourcetypes. For more details on these metrics, please see Josh Rodman's blog:
NOTE: the per_x_thruput categories are not complete. By default they
show the ten busiest of each type, for each sampling window. If you
have 2000 active forwarders, you cannot expect to see the majority of
them in this data. The sampling quantity can be adjusted, but it will
increase the chattiness of metrics.log, and the resulting indexing
load and _internal index size. ...
The more complete source of license volume is license_audit.log . The daily indexing volume is recorded once a day just after midnight for the previous 24 hours.
... View more