Sentinel Cost Workbook

1. Workspace Usage - workbook shows all tables
2. Or if you are happy doing an edit to the Workbook, replace this section of KQL in that grid with this change (I haven't done a copy & paste of the full syntax) :

let customTables = Usage
| where IsBillable == true
| where DataType contains "_CL"
| summarize size = sum(Quantity)/1000 by DataType
| project ['Log Type'] = DataType, ['Table Size'] = size, ['Estimated cost'] = size*{Price};
let knownTables = Usage
| where IsBillable == true
| join kind=leftouter Categories on $left.DataType == $right.Type
| summarize size =sumif(Quantity, isnotempty(Category))/1000, sizeOther= sumif(Quantity,(isempty(Category) and DataType !contains "_CL"))/1000 by Category, Type
| project ['Log Type'] = iif(isnotempty( Category),Category,strcat("Other: ",Type)), ['Table Size'] = iif(isnotempty( Category),size,sizeOther), ['Estimated cost'] = iif(isnotempty(Category),size*{Price},sizeOther*4);
union customTables, knownTables
| order by ['Table Size'] desc