Table Data
Query
//Produces results for Table Size, Number of Table Entries, Size per Entry, If the table is billable or not, Last record that was received, and Estimated Table Price
union withsource=TableName1 *
| where TimeGenerated > ago(31d)
| summarize
Entries = count(),
Size = sum(_BilledSize),
last_log = datetime_diff("second", now(), max(TimeGenerated)),
estimate = sumif(_BilledSize, _IsBillable == true)
by TableName1, _IsBillable
| project
['Table Name'] = TableName1,
['Table Size'] = Size,
['Table Entries'] = Entries,
['Size per Entry'] = 1.0 * Size / Entries,
['IsBillable'] = _IsBillable,
['Last Record Received'] = last_log,
['Estimated Table Price'] = (estimate / (1024 * 1024 * 1024)) * 4.0
| order by ['Table Size'] descExplanation
This query retrieves information about a table, including its size, number of entries, size per entry, whether it is billable or not, the last record received, and the estimated price of the table. It does this by combining data from multiple tables, filtering for data within the last 31 days, summarizing the data by table name and billable status, and then projecting the desired columns. The results are then ordered by table size in descending order.
Details
Rod Trent
Released: December 6, 2021
Tables
TableName1
Keywords
Table SizeNumber of Table EntriesSize per EntryIsBillableLast Record ReceivedEstimated Table Price
Operators
unionwithsourcewheresummarizecount()sum()datetime_diff()now()max()sumif()byprojectorder bydesc.