How to estimate the cost of Search jobs and Restore options

Sándor Tőkési 161 Reputation points

Hey folks,
When I want to look through archived data in Sentinel, is there a way to actually predict to cost of this? Both the Search job (on archived data) and the Restore function is based on the data in the given archived table. I either have to pay the data I look through (Search) or I restore (Restore).

So, is there a way to check how much data I have in an archived table in a given time window? Before running the Search job I would like to know how much it will cost me.

I don't have this log source anymore, so I cannot estimate it based on current usage, and I also don't have the Usage table information for this older time period anymore. Is there any other way to do this? Is there a way to check the size of an archived table or to estimate the cost of the above-mentioned functions?

Not Monitored
Not Monitored
Tag not monitored by Microsoft.
36,509 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Clive Watson 5,801 Reputation points MVP
    2023-10-02T13:01:16.8333333+00:00 This is only a partial answer, but restore is for 2TB minimum so you can check that in the calculator Unless you think you need more than 2TB of data?