How to find the azure vm ingested log size to sentinel

[zaylinhtun]

Hi all, I need some help.

I want to find the total ingested log size (daily or weekly) from azure VM which is used for syslog-forwarder. I can find the only Usage table which is billable or not.

Thanks all.

[#2]

@zaylinhtun

Usage no longer holds Computer info, so you can check the Syslog Table instead.  This shows each day for the last 7days (adjust to suit).

Syslog
| where TimeGenerated > ago(7d)
| where _IsBillable = true
| where Computer == ' name of your Syslog server '
| summarize sum(_BilledSize) by bin(TimeGenerated, 1d)

Syslog
| where TimeGenerated > ago(7d)
| where _IsBillable = true
//| where Computer == ' .. '
| summarize GBytes=sum(_BilledSize)/(1024*1024*1024) by bin(TimeGenerated, 1d), Computer
| render barchart 

Syslog
| where TimeGenerated > ago(7d)
| where _IsBillable = true
| summarize bytes=sum(_BilledSize) by bin(TimeGenerated, 1d), Computer
| render barchart 

or for all Syslog Servers