Event Total Volume Collect

%3CLINGO-SUB%20id%3D%22lingo-sub-1179217%22%20slang%3D%22en-US%22%3EEvent%20Total%20Volume%20Collect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1179217%22%20slang%3D%22en-US%22%3E%3CP%3EHello%3C%2FP%3E%3CP%3EI%20would%20like%20to%20add%20up%20the%20total%20amount%20of%20GB%20for%20events.%20However%2C%20I%20don't%20think%20my%20query%20works%20the%20way%20I%20want%20it%20to%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3Elet%20daystoSearch%20%3D%20%3C%2FSPAN%3E%3CSPAN%3E31%3C%2FSPAN%3E%3CSPAN%3Ed%3B%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3Eunion%3C%2FSPAN%3E%3CSPAN%3E%20withsource%20%3D%20tt%20*%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20TimeGenerated%20%26gt%3B%3D%20ago(daystoSearch)%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20_IsBillable%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3Etrue%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eextend%3C%2FSPAN%3E%3CSPAN%3E%20computerName%20%3D%20tolower(tostring(split(Computer%2C%20%3C%2FSPAN%3E%3CSPAN%3E'.'%3C%2FSPAN%3E%3CSPAN%3E)%5B%3C%2FSPAN%3E%3CSPAN%3E0%3C%2FSPAN%3E%3CSPAN%3E%5D))%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20computerName%20!%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22%22%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20Type%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22Event%22%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20TotalVolumeBytes%3Dsum(round(_BilledSize%2F%3C%2FSPAN%3E%3CSPAN%3E1024%3C%2FSPAN%3E%3CSPAN%3E%2F%3C%2FSPAN%3E%3CSPAN%3E1024%3C%2FSPAN%3E%3CSPAN%3E%2F%3C%2FSPAN%3E%3CSPAN%3E1024%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E6%3C%2FSPAN%3E%3CSPAN%3E))%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20computerName%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eproject%3C%2FSPAN%3E%3CSPAN%3E%20computerName%2CTotalVolumeGB%3DTotalVolumeBytes%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esort%3C%2FSPAN%3E%20%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20TotalVolumeGB%20desc%3C%2FSPAN%3E%20%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3Eit%20is%20important%20to%20know%20this%20totally%20to%20determine%20the%20price%20of%20the%20GB%3CBR%20%2F%3EThanks%20for%20your%20help%3CBR%20%2F%3ERog%3C%2FFONT%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1209590%22%20slang%3D%22en-US%22%3ERe%3A%20Event%20Total%20Volume%20Collect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1209590%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F561801%22%20target%3D%22_blank%22%3E%40MrRog%3C%2FA%3E%26nbsp%3Bthe%20query%20seems%20right.%3C%2FP%3E%0A%3CP%3EAdding%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F218223%22%20target%3D%22_blank%22%3E%40Dale%20Koetke%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1211269%22%20slang%3D%22en-US%22%3ERe%3A%20Event%20Total%20Volume%20Collect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1211269%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F561801%22%20target%3D%22_blank%22%3E%40MrRog%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EUnless%20you%20need%20this%20segmented%20by%20computer%2C%20just%20use%20the%20Usage%20data%20type%2C%20e.g.%20as%20documented%20at%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fmanage-cost-storage%23data-volume-by-solution%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fmanage-cost-storage%23data-volume-by-solution%3C%2FA%3E.%26nbsp%3B%20You're%20query%20for%20the%20total%20billable%20data%20from%20the%20last%2031%20days%20would%20be%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EUsage%20%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20startofday(ago(31d))%3CBR%20%2F%3E%7C%20where%20IsBillable%20%3D%3D%20true%3CBR%20%2F%3E%7C%20summarize%20BillableDataGB%20%3D%20sum(Quantity)%20%2F%201000.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

Hello

I would like to add up the total amount of GB for events. However, I don't think my query works the way I want it to

let daystoSearch = 31d;
union withsource = tt *
| where TimeGenerated >= ago(daystoSearch)
| where _IsBillable == true
| extend computerName = tolower(tostring(split(Computer, '.')[0]))
| where computerName != ""
| where Type == "Event"
| summarize TotalVolumeBytes=sum(round(_BilledSize/1024/1024/1024, 6)) by computerName
| project computerName,TotalVolumeGB=TotalVolumeBytes
| sort by TotalVolumeGB desc
 
it is important to know this totally to determine the price of the GB
Thanks for your help
Rog
2 Replies

@MrRog the query seems right.

Adding @Dale Koetke 

@MrRog 

Unless you need this segmented by computer, just use the Usage data type, e.g. as documented at https://docs.microsoft.com/en-us/azure/azure-monitor/platform/manage-cost-storage#data-volume-by-sol....  You're query for the total billable data from the last 31 days would be:

 

Usage
| where TimeGenerated > startofday(ago(31d))
| where IsBillable == true
| summarize BillableDataGB = sum(Quantity) / 1000.