How Loud Is A Table

Row-count-per-day graph for a given table (defaults to `Syslog`) — a quick 'is this table getting louder?' check.

KQL Library  /  Cost & Ingest

 Cost & Ingest Cost By Table how-loud-is-a-table.kql

Row-count-per-day graph for a given table (defaults to `Syslog`) — a quick "is this table getting louder?" check.

Platforms Microsoft Sentinel
Data Usage
Deep Dive  Deep Dive
 Deep Dive  Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// This example queries the last 30 days of the syslog table, aggregates the number of hits per day, and the graphs results
// Source: Anatomy Of A KQL Query Part 1 (2023-04-06) — https://www.hanley.cloud/2023-04-06-Anatomy-of-a-KQL-Query-Part-1/
// Platforms: Microsoft Sentinel
// Data: Usage

Syslog                                          // <--Define the table to query
| where TimeGenerated > ago(30d)                // <--Query the last 30 days into the table
| summarize count() by bin(TimeGenerated,1d)    // <--Return count per day
| render columnchart                            // <--Graph a column chart