Forum Discussion
Sentinel Billable data
| where TimeGenerated between ( startofday(ago(1d)) .. endofday(ago(1d)) )
Clive_Watson thanks for your helps.
this query you proposed returns now 550 GB
Usage | where TimeGenerated > ago(1d) | where IsBillable == true | summarize BillableDataGB = sum(Quantity) / 1000.
the second query returns now 840 GB
Usage | where TimeGenerated > startofday(ago(1d)) | where IsBillable == true | summarize BillableDataGB = sum(Quantity) / 1000.
the query mikhailf proposed
| where StartTime >= startofday(ago(1d)) and EndTime < startofday(now())
returns 485 GB
My initial query returns now 550 GB
Usage
| where TimeGenerated > ago(1d)
| where IsBillable == true
| summarize BillableDataGB = sum(Quantity) / 1000. by bin(TimeGenerated, 31d), Solution
| summarize TotalDataGB = sum(BillableDataGB)
Hello T150732D ,
Please, try the following queries:
Usage | where TimeGenerated >= startofday(ago(1d)) and EndTime < startofday(now()) | where IsBillable == true | summarize BillableDataGB = sum(Quantity) / 1000. by bin(TimeGenerated, 1d), Solution | summarize TotalDataGB = sum(BillableDataGB)Usage | where TimeGenerated >= startofday(ago(30d)) and EndTime < startofday(now()) | where IsBillable == true | summarize BillableDataGB=sum(Quantity) / 1000. by bin(TimeGenerated, 1d), Solution | render columnchartIt will return similar results.
mikhailf can you please help me with some query to show monthly sentinel ingestion log cost?
I would like to provide management total Gb but also cost in dollars.
thank you
Example for previous 3 months (excludes current month) but you can tweak that, alter line 4 from "-1" to "-0"
let price_ = 4.0; // enter you price per GB for LogAnalytics + Sentinel Usage // get logs for previous 3 months | where TimeGenerated between(startofmonth(now(),-3) ..endofmonth(endofmonth(now(),-1)) ) | summarize GBytesTotal=sum(Quantity) / 1000, Price=sum(Quantity) / 1000 * price_ by month=bin(datepart("Month", TimeGenerated), 1) // format month so we can sort it | extend month = case(month==1,strcat(month,'. Jan'),month==2,strcat(month,'. Feb'),month==3, strcat(month,'. Mar'),month==4,strcat(month,'. Apr'),month==5,strcat(month,'. May'),month==6,strcat(month,'. Jun'),month==7, strcat(month,'. Jul'),month==8,strcat(month,'. Aug'),month==9,strcat(month,'. Sep'),month==10,strcat(month,'. Oct'),month==11,strcat(month,'. Nov'),month==12,strcat(month,'. Dec'),"error") | order by month ascYou'll see this in the next version of the "Workspace Usage Report" workbook, in a week or so I hope.
