// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// day by day change in percentage
// Source: KQL Toolbox #4: What Changed? Finding Log Sources With The Biggest Delta In Volume & Cost (2026-01-18) — https://www.hanley.cloud/2026-01-18-KQL-Toolbox-4-What-Changed-Finding-Log-Sources-with-the-Biggest-Delta-in-Volume-%26-Cost/
// Platforms: Microsoft Sentinel
// Data: Usage
Usage
| where TimeGenerated > startofday(ago(31d))
| summarize IngestedGB = round(sum(Quantity)/1024,3) by bin(TimeGenerated, 1d)
| sort by TimeGenerated asc
| serialize previous_IngestedGB = prev(IngestedGB)
| extend PercentChange = round((IngestedGB - previous_IngestedGB) / previous_IngestedGB * 100, 0)
//| where PercentChange >= 100 or PercentChange <= -50
| render columnchart