Forum Discussion

MrRog's avatar
MrRog
Copper Contributor
Feb 18, 2020

Event Total Volume Collect

Hello

I would like to add up the total amount of GB for events. However, I don't think my query works the way I want it to

let daystoSearch = 31d;
union withsource = tt *
| where TimeGenerated >= ago(daystoSearch)
| where _IsBillable == true
| extend computerName = tolower(tostring(split(Computer, '.')[0]))
| where computerName != ""
| where Type == "Event"
| summarize TotalVolumeBytes=sum(round(_BilledSize/1024/1024/1024, 6)) by computerName
| project computerName,TotalVolumeGB=TotalVolumeBytes
| sort by TotalVolumeGB desc
 
it is important to know this totally to determine the price of the GB
Thanks for your help
Rog

Resources