90 Day Billable Cost Per Day Formatted

// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Daily billable GB and cost for the past 90 days, formatted as human-readable strings
// ('$X.XX / Day' and 'X.XXGB / Day'). Best for tables and dashboards where readability
// matters more than plottability — the string formatting means these columns are not
// chart-friendly. For a numeric CostUSD variant, see 90-day-billable-cost-per-day.kql.
// Source: KQL Toolbox #1: Track & Price Your Microsoft Sentinel Ingest Costs (2025-12-14) — https://www.hanley.cloud/2025-12-14-KQL-Toolbox-1-Track-%26-Price-Your-Microsoft-Sentinel-Ingest-Costs/
// Platforms: Microsoft Sentinel
// Data: Usage

Usage                                                                                   // <--Query the Usage table
| where TimeGenerated > ago(90d)                                                        // <--Query the last 90 days
| where IsBillable == true                                                              // <--Only include 'billable' data
| summarize TotalVolumeGB = round(sum(Quantity) / 1024, 2) by bin(TimeGenerated, 1d)    // <--Chop it up into GB / Day
| extend  cost=strcat('$', round(TotalVolumeGB*4.30, 2), ' / Day')                      // <--Format daily cost as a readable string by prepending '$', rounding to 2 decimals, and adding '/ Day'
| extend TotalVolumeGB = strcat(TotalVolumeGB, 'GB / Day')                              // <--Convert GB value to a display string by appending 'GB / Day' for clearer, human-friendly output