Cost & Ingest
Cost By Eventid
eventid-by-billedsize.kql
Ingest volume in GB per Event ID from the `SecurityEvent` table.
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
//Return the ingest volume in GB for a given EventID from the SecurityEvent table
SecurityEvent //<-- Query the SecurityEvent table
| where TimeGenerated > ago(1h) //<-- Query the last hour
| where EventID == 8002 //<-- Query for EventID 8002
| summarize GB=sum(_BilledSize)/1000/1000/1000 //<-- Summarize billable volume in GB
//You can change the last line in the above query to the following if you’re a stickler for Gibibytes versus Gigabytes:
| summarize GB=sum(_BilledSize)/1024/1024/1024