90 Day Billable Volume By Solution

Billable GB per day for the past 90 days, sliced by Solution, rendered as a column chart.

KQL Library  /  Cost & Ingest

 Cost & Ingest Billable Volume 90-day-billable-volume-by-solution.kql

Billable GB per day for the past 90 days, sliced by Solution, rendered as a column chart.

Platforms Microsoft Sentinel
Data Usage
Deep Dive  Deep Dive
 Deep Dive  Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Billable GB per day for the past 90 days, broken out by Solution and rendered as a column chart.
// Great for spotting which solution is driving your ingest curve over the quarter.
// Source: KQL Toolbox #1: Track & Price Your Microsoft Sentinel Ingest Costs (2025-12-14) — https://www.hanley.cloud/2025-12-14-KQL-Toolbox-1-Track-%26-Price-Your-Microsoft-Sentinel-Ingest-Costs/
// Platforms: Microsoft Sentinel
// Data: Usage

Usage                                                                                   // <--Query the Usage table
| where TimeGenerated > ago(90d)                                                        // <--Query the last 90 days
| where IsBillable == true                                                              // <--Only include 'billable' data
| summarize TotalVolumeGB = sum(Quantity) / 1000 by bin(TimeGenerated, 1d), Solution    // <--Chop it up into GB / Day
| render columnchart                                                                    // <--Graph the results