KQL return size of tables in a LAW with size in GB, MB, KB

Question

I want to calculate the size of each table in a given Log Analytics workspace and have the sizes returned in GB, MB etc. The following code works partially , but since I'm not using the units arg the format_bytes func is not returning expected results for large values.

union withsource= table *
| where TimeGenerated between(datetime(2022-05-02) ..datetime(2022-05-03))
| summerize Size = sum(_BilledSize) by table, _IsBillable | sort by Size desc | extend Size2 = format_bytes(toint(Size), 2)

How could I overcome it, or perhaps solve my problem in a different way?

Answer 1

I'm not sure why you're casting a double value (Size) to an int before invoking format_bytes().

instead of this:

extend Size2 = format_bytes(toint(Size), 2)

try this:

| extend Size2 = format_bytes(Size, 2)

datatable(Size:double)
[
    17404157113,
]
| extend Your_Size2 = format_bytes(toint(Size), 2),
         Better_Size2 = format_bytes(Size, 2)

Size	Your_Size2	Better_Size2
17404157113	-2147483648 Bytes	16.21 GB