Hello, Hope you are doing well ! One of our customer has 300+ log analytics workspaces in his subscription. How can we get the workspaces in decreasing order of data ingestion? Also how to find data ingestion by each azure resource per day? Appreciate your help. Thank you!!

@anil kumar , thank you for the questions. The easiest way to get the workspace usage by high ingestion, will be using Azure's "Cost Management + Billing". In Azure portal, follow the step below: Search for "Cost Management + Billing" --> select the subscription Select "Cost by resources" on this page --> Apply the invoice date filter and Apply filter for The "Usage and estimated costs" menu of the log analytics workspace also gives you similar information and trends over the past 31 days. Regarding the log type by resource information in a workspace, see Data volume by Azure resource, resource group, or subscription Hope this helps. If the answer did not help, please add more context/follow-up question for it, and we will help you out. Else, if the answer helped, please click Accept answer so that it can help others in the community looking for help on similar topics.

How to find data ingestion size for each log analytics workspace in a subscription ?

Accepted answer

AnuragSingh-MSFT 20,431 Reputation points

2023-06-08T09:55:19.9433333+00:00
@anil kumar , thank you for the questions.

The easiest way to get the workspace usage by high ingestion, will be using Azure's "Cost Management + Billing". In Azure portal, follow the step below:

Search for "Cost Management + Billing" --> select the subscription

Select "Cost by resources" on this page --> Apply the invoice date filter and Apply filter for

The "Usage and estimated costs" menu of the log analytics workspace also gives you similar information and trends over the past 31 days.

Regarding the log type by resource information in a workspace, see Data volume by Azure resource, resource group, or subscription

Hope this helps.

If the answer did not help, please add more context/follow-up question for it, and we will help you out. Else, if the answer helped, please click Accept answer so that it can help others in the community looking for help on similar topics.
Please sign in to rate this answer.

1 person found this answer helpful.
anil kumar 1,641 Reputation points

2023-06-09T08:24:29.2733333+00:00

Thank you @AnuragSingh-MSFT for talking time to help!!

Actually my ask was to check data ingestion for multiple workspaces (300+) so we need to do that via a query.

Appreciate your response. Thank you!!

anil kumar 1,641 Reputation points

2023-06-19T07:30:57.3366667+00:00

Hello @AnuragSingh-MSFT ,

Could you please reply if your bandwidth permits ?

Awaiting your response. Thank you!!

AnuragSingh-MSFT 20,431 Reputation points

2023-06-20T04:58:24.23+00:00

anil kumar, Apologies for the delayed response. There isn't an out of box way to get the data ingestion of all the workspaces (in your case 300+), mainly because each workspace stores information about its own ingestion and usage in the Usage table and this information is used by Cost Management for billing purpose. However, there are other solutions available which could help, as suggested below:

An alternative would be to use Azure Cost Management to get an idea of the data ingestion by the workspaces, as mentioned in my answer above.

Azure PowerShell module Az.OperationalInsights has cmdlets which could easily help you get this information per workspace. For instance:
--> Use Get-AzOperationalInsightsWorkspace to get the list of all workspaces in your subscription/resource group of interest.
-->Use Invoke-AzOperationalInsightsQuery to execute the usage query on each workspace obtained in step a. above. Combine the output from individual workspaces to get an overview of ingestion/usage. For sample queries that can be used with Invoke-AzOperationalInsightsQuery to get ingestion related details, see Log queries. Hope this helps.

anil kumar 1,641 Reputation points

2023-06-20T06:51:39.4233333+00:00

Thank you @AnuragSingh-MSFT for taking time to help and clarify!!

Glad to mark your response as answer.

#StayBlessednHappy
Sign in to comment

How to find data ingestion size for each log analytics workspace in a subscription ?

0 additional answers