Skip to main content

KQL Query to track your higher cost Azure Sentinel Tables

Author by Joseph Dutton

I cannot take full credit for this query, however, it is a super useful KQL query and it is as simple as copy and pasting into your environment. You'll be able to see the exact table name, the table size, how many table entries, and what tables are billable vs. not. If you're looking to cut costs, this could be a great place to start your investigation.

The Query:

union withsource=TableName1 * 
| where TimeGenerated > ago(1d) 
| summarize Entries = count(), Size = sum(_BilledSize), last_log = datetime_diff("second",now(), max(TimeGenerated)), estimate = sumif(_BilledSize, _IsBillable==true) by TableName1, _IsBillable 
| project ['Table Name'] = TableName1, ['Table Entries'] = Entries, ['Table Size'] = Size, ['Size per Entry'] = 1.0 * Size / Entries, ['IsBillable'] = _IsBillable, ['Last Record Received'] = last_log , ['Estimated Table Price'] = (estimate/(1024*1024*1024)) * 0.0 
| order by ['Table Size'] desc


Your result should look something like this:


Joseph Dutton

Tags in this Article