Usage

← All KQL categories

Data Source

Usage

15 queries tagged with this data source.

• Cost & Ingest / Billable Volume 90 Day Billable Cost Per Day Formatted

  Daily billable GB and cost over 90 days, formatted as human-readable strings (`$X.XX / Day`, `XGB / Day`). Table-friendly, not chart-friendly.

• Cost & Ingest / Billable Volume 90 Day Billable Cost Per Day

  Daily billable GB and cost over 90 days with numeric `CostUSD`. The default cost-over-time view — plottable and aggregatable.

• Cost & Ingest / Billable Volume 90 Day Billable Volume By Solution

  Billable GB per day for the past 90 days, sliced by Solution, rendered as a column chart.

• Cost & Ingest / Billable Volume Efficiency Exercise

  Teaching walkthrough of the "average daily ingest" question written four ways, from a slow `search *` to an efficient `Usage`-scoped version with cost. Read this before writing your own daily-average query.

• Cost & Ingest / Cost By Table Cost Of A Table

  Estimated dollar cost of a single table over a chosen window, given your effective per-GB rate.

• Cost & Ingest / Cost By Table How Loud Is A Table

  Row-count-per-day graph for a given table (defaults to `Syslog`) — a quick "is this table getting louder?" check.

• Cost & Ingest / Cost By Table Top 10 Billable MDE Tables

  Top 10 most expensive Microsoft Defender for Endpoint tables over the last 90 days.

• Cost & Ingest / Cost By Table Top 10 Log Sources With Cost Enhanced

  Top log sources by `DataType` (30d) with an emoji cost-tier and formatted `$X.XX` string — table/dashboard friendly.

• Cost & Ingest / Cost By Table Top 10 Log Sources With Cost

  Top log sources by `DataType` (30d) with numeric `CostUSD`. The chart-friendly default.

• Cost & Ingest / Cost By Table Top 10 Tables Exclude MDE

  Top 10 most expensive log sources over 90 days, excluding MDE, via the fast `Usage` table.

• Cost & Ingest / Ingest Trends 30 60 90 Day Ingest Trends

  Same three-window comparison against the `Usage` table for a workspace-wide view.

• Cost & Ingest / Ingest Trends Day By Day Change

  Percent change in daily ingest volume vs the previous day over the last 31 days.

• Cost & Ingest / Ingest Trends Log Sources With Greatest Delta

  Which data sources moved the most between the previous 30 days and the current 30 days — the "who suddenly got loud" query.

• Pi-hole Pihole Usage

  Billable ingest volume for the Pi-hole custom log over the last 90 days.

• Reporting Data Sources With Biggest Delta In Log Volume

  Data sources with the biggest log-volume delta between comparison periods — configurable tunables at the top of the query.