2

I want to calculate the size of each table in a given Log Analytics workspace and have the sizes returned in GB, MB etc. The following code works partially , but since I'm not using the units arg the format_bytes func is not returning expected results for large values.

union withsource= table *
| where TimeGenerated between(datetime(2022-05-02) ..datetime(2022-05-03))
| summerize Size = sum(_BilledSize) by table, _IsBillable | sort by Size desc | extend Size2 = format_bytes(toint(Size), 2)

How could I overcome it, or perhaps solve my problem in a different way? KQL results

newby88
  • 27
  • 1
  • 6

1 Answers1

2

I'm not sure why you're casting a double value (Size) to an int before invoking format_bytes().

instead of this:

extend Size2 = format_bytes(toint(Size), 2)

try this:

| extend Size2 = format_bytes(Size, 2)

datatable(Size:double)
[
    17404157113,
]
| extend Your_Size2 = format_bytes(toint(Size), 2),
         Better_Size2 = format_bytes(Size, 2)
Size Your_Size2 Better_Size2
17404157113 -2147483648 Bytes 16.21 GB
Yoni L.
  • 22,627
  • 2
  • 29
  • 48
  • Thank you for your help. I'm casting it becuase per the docs "The _BilledSize column specifies the **size in bytes** of data that will be billed to your Azure account if _IsBillable is true." https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-standard-columns#_billedsize Since the `format_bytes()` arg `value` - `a number to be formatted as data size in bytes.` will this not break stuff? – newby88 May 09 '22 at 20:50
  • i don't understand the conflict. could you clarify why casting to a 32-bit wide integer is required? – Yoni L. May 10 '22 at 00:08
  • Hi, tbh if I think about it now, I don't see reason for casting it. Thank you! Could you please tell me if I could run this query across multiple Log Analytics workspaces at once? But in such a way that it would return results per LAW instead of combining it in one table ? – newby88 May 10 '22 at 08:02
  • 1
    Consider opening another question for that. I'm not personally familiar with log analytics workspaces – Yoni L. May 10 '22 at 13:30
  • Sure, Yoni - thank you for your help :)! – newby88 May 10 '22 at 14:36