KQL Query to track your higher cost Azure Sentinel Tables

I cannot take full credit for this query, however, it is a super useful KQL query and it is as simple as copy and pasting into your environment. You’ll be able to see the exact table name, the table size, how many table entries, and what tables are billable vs. not. If you’re looking to cut costs, this could be a great place to start your investigation.

union withsource=TableName1 *

| where TimeGenerated > ago(1d)

| summarize Entries = count(), Size = sum(_BilledSize), last_log = datetime_diff(“second”,now(), max(TimeGenerated)), estimate = sumif(_BilledSize, _IsBillable==true) by TableName1, _IsBillable

| project [‘Table Name’] = TableName1, [‘Table Entries’] = Entries, [‘Table Size’] = Size, [‘Size per Entry’] = 1.0 * Size / Entries, [‘IsBillable’] = _IsBillable, [‘Last Record Received’] = last_log , [‘Estimated Table Price’] = (estimate/(1024*1024*1024)) * 0.0

| order by [‘Table Size’] desc

Your result should look something like this: