GB Per Table

Ingest volume in GB for a single table (defaults to `SecurityEvent`, swap as needed).

KQL Library  /  Cost & Ingest

 Cost & Ingest Billable Volume gb-per-table.kql

Ingest volume in GB for a single table (defaults to `SecurityEvent`, swap as needed).

 Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// This query returns the ingest volume in GB for a table

SecurityEvent                                   //<-- Query the SecurityEvent table
| where TimeGenerated > ago(1d)                 //<-- Query the last day
| summarize GB=sum(_BilledSize)/1000/1000/1000  //<-- Organize results by GB

//You can change the last line in the above query to the following if you’re a stickler for Gibibytes versus Gigabytes: 

| summarize GB=sum(_BilledSize)/1024/1024/1024