This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 94%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESN%3C/text%3E%3C/svg%3E)
Hey folks,
When I want to look through archived data in Sentinel, is there a way to actually predict to cost of this? Both the Search job (on archived data) and the Restore function is based on the data in the given archived table. I either have to pay the data I look through (Search) or I restore (Restore).
So, is there a way to check how much data I have in an archived table in a given time window? Before running the Search job I would like to know how much it will cost me.
I don't have this log source anymore, so I cannot estimate it based on current usage, and I also don't have the Usage table information for this older time period anymore. Is there any other way to do this? Is there a way to check the size of an archived table or to estimate the cost of the above-mentioned functions?
https://azure.microsoft.com/en-us/pricing/details/monitor/ This is only a partial answer, but restore is for 2TB minimum so you can check that in the calculator https://azure.microsoft.com/en-us/pricing/calculator/ Unless you think you need more than 2TB of data?
Well I want to know the size regardless of the restore. In my spcecific case it will be less for sure, but I'm looking for a general answer. So I can estimate even if there is more data or if I want to use a Search job instead of restore
If a restore is kept for less than 12 hours, the restore will be billed for a 12-hour minimum duration. If less than 2 TB of data is restored, the billed volume of restored data will be rounded up to 2 TB for each day (or partial day) that the restore is retained.
So even if you want 1MB you need to budget for 2TB (which is the minimum) which is approx. $250.00
If your Tables are fluctuating each month you'll only get an estimate which is more of a guess really I'd look at the last 90days and use that as a baseline.