CODEWITHSUNDEEP
kqlazure-log-analyticsazure-log-analytics-workspace
newby88
newby88

Reputation: 37

KQL return size of tables in a LAW with size in GB, MB, KB

I want to calculate the size of each table in a given Log Analytics workspace and have the sizes returned in GB, MB etc. The following code works partially , but since I'm not using the units arg the format_bytes func is not returning expected results for large values.

union withsource= table *
| where TimeGenerated between(datetime(2022-05-02) ..datetime(2022-05-03))
| summerize Size = sum(_BilledSize) by table, _IsBillable | sort by Size desc | extend Size2 = format_bytes(toint(Size), 2)

How could I overcome it, or perhaps solve my problem in a different way? KQL results

Upvotes: 2

Views: 8197

Answers (1)

Yoni L.
Yoni L.

Reputation: 25895

I'm not sure why you're casting a double value (Size) to an int before invoking format_bytes().

instead of this:

extend Size2 = format_bytes(toint(Size), 2)

try this:

| extend Size2 = format_bytes(Size, 2)

datatable(Size:double)
[
    17404157113,
]
| extend Your_Size2 = format_bytes(toint(Size), 2),
         Better_Size2 = format_bytes(Size, 2)
Size Your_Size2 Better_Size2
17404157113 -2147483648 Bytes 16.21 GB

Upvotes: 2

Related Questions