Query Details
All Tables Sentinel Price
Query
// All Tables with Estimated Sentinel Price Ingestion
// Shows every table in the workspace with actual size using estimate_data_size()
// and projected cost at current Sentinel + Log Analytics ingestion rate.
// Price = Sentinel ingestion + Log Analytics ingestion (update from Azure Pricing Calculator)
// =====================================================================
let Price = 3.0;
union withsource=TableName *
| where TimeGenerated > ago(30d)
| summarize
TotalEntries = count(),
TableSizeInGB = round(sum(estimate_data_size(*)) / 1000.0 / 1000.0 / 1000.0, 2),
TableSizeInMB = round(sum(estimate_data_size(*)) / 1000.0 / 1000.0, 2),
EstSentinelPriceUSD = round(sum(estimate_data_size(*)) / (1000.0 * 1000.0 * 1000.0) * Price, 2)
by TableName
| extend
DailyAvgMB = round(TableSizeInMB / 30.0, 2),
DailyAvgGB = round(TableSizeInGB / 30.0, 4),
PctOfTotal = round(TableSizeInGB / toscalar(
union withsource=T * | where TimeGenerated > ago(30d) | summarize round(sum(estimate_data_size(*)) / 1000.0 / 1000.0 / 1000.0, 2)
) * 100, 1)
| project
TableName, TotalEntries, TableSizeInGB, TableSizeInMB,
DailyAvgGB, DailyAvgMB,
EstSentinelPriceUSD, PctOfTotal
| order by TableSizeInGB desc
Explanation
This KQL (Kusto Query Language) query is designed to analyze and summarize data from all tables in a workspace over the past 30 days. Here's a simple breakdown of what it does:
-
Price Setting: It sets a variable
Priceto 3.0, which represents the cost per gigabyte for data ingestion, combining both Sentinel and Log Analytics rates. -
Data Collection: It gathers data from all tables in the workspace, capturing entries generated in the last 30 days.
-
Data Summarization:
- TotalEntries: Counts the total number of entries in each table.
- TableSizeInGB: Calculates the total size of each table in gigabytes.
- TableSizeInMB: Calculates the total size of each table in megabytes.
- EstSentinelPriceUSD: Estimates the cost of data ingestion for each table in USD, based on the size and the set price.
-
Daily Averages:
- DailyAvgMB: Computes the average daily size of data in megabytes.
- DailyAvgGB: Computes the average daily size of data in gigabytes.
-
Percentage of Total: Calculates what percentage of the total data size each table represents.
-
Data Presentation: It projects (selects) specific columns to display: TableName, TotalEntries, TableSizeInGB, TableSizeInMB, DailyAvgGB, DailyAvgMB, EstSentinelPriceUSD, and PctOfTotal.
-
Ordering: The results are ordered by the table size in gigabytes, from largest to smallest.
In summary, this query provides an overview of the data size and estimated ingestion costs for each table in the workspace, helping to identify which tables are the largest and most costly in terms of data ingestion.
Details
David Alonso
Released: April 8, 2026
Tables
Keywords
Operators