Which table should I use to pull log ingestion numbers for Computers?

Question

Hello everyone,

I have been tasked by a client to create a query to get the total monthly log ingestion from a group of Computers using a Watchlist. My first thought was to use the Usage table, join that with the Watchlist and then get the log ingestion total. The problem I am having is that the Usage table has deprecated the Computer field from the Usage table. Which table do I pivot to now? I want this query to be accurate for my client but I am having trouble pin pointing which table I should pull this information from now that the Computer field has been deprecated from the Usage table.

Does anyone have any insight on this? I would greatly appreciate it, thanks!

Answer

Hi @Matthew Agosta , try using the Heartbeat table instead. The Heartbeat table contains information about the computers and their status, which can be joined with the Usage table to get the log ingestion data. You can use the Computer field in the Heartbeat table to match with your Watchlist and then calculate the total log ingestion.

For example:

let watchlist = datatable(Computer:string) [
    "Computer1",
    "Computer2",
    "Computer3"
];
Heartbeat
| where Computer in (watchlist)
| join kind=inner (
    Usage
    | summarize TotalLogIngestion = sum(Quantity) by Computer, bin(TimeGenerated, 1d)
) on Computer
| summarize MonthlyLogIngestion = sum(TotalLogIngestion) by Computer, bin(TimeGenerated, 1mo)

This query joins the Heartbeat table with your Watchlist and then joins it with the Usage table to get the total log ingestion for each computer on a monthly basis.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James

Share via

Which table should I use to pull log ingestion numbers for Computers?

1 answer

Your answer