index=_internal source=*license_usage.log type=Usage earliest=-20d | eval MB = b/1024/1024 | rename s AS source | timechart span=1d sum(b) AS "Total MB used" by source