kqlazure-log-analyticsazure-log-analytics-workspace

KQL return size of tables in a LAW with size in GB, MB, KB


I want to calculate the size of each table in a given Log Analytics workspace and have the sizes returned in GB, MB etc. The following code works partially , but since I'm not using the units arg the format_bytes func is not returning expected results for large values.

union withsource= table *
| where TimeGenerated between(datetime(2022-05-02) ..datetime(2022-05-03))
| summerize Size = sum(_BilledSize) by table, _IsBillable | sort by Size desc | extend Size2 = format_bytes(toint(Size), 2)

How could I overcome it, or perhaps solve my problem in a different way? KQL results


Solution

  • I'm not sure why you're casting a double value (Size) to an int before invoking format_bytes().

    instead of this:

    extend Size2 = format_bytes(toint(Size), 2)

    try this:

    | extend Size2 = format_bytes(Size, 2)

    datatable(Size:double)
    [
        17404157113,
    ]
    | extend Your_Size2 = format_bytes(toint(Size), 2),
             Better_Size2 = format_bytes(Size, 2)
    
    Size Your_Size2 Better_Size2
    17404157113 -2147483648 Bytes 16.21 GB