KQL Load Balancer Bytes

Question

Hi I've been trying to convert a query from bytes to GB, however I'm getting some strange results. I also get the same component showing up incrementally increasing in size, which makes sense as we are getting the bytes used, which we wold expect to see increased, but I would only like the latest set of data (when the query was run). Can anyone see where I'm going wrong?

AzureMetrics
| where TimeGenerated >=ago(1d)
| where Resource contains "LB"
| where MetricName contains "ByteCount"
| extend  TotalGB = Total/1024
| summarize by Resource, TimeGenerated, TotalGB, MetricName, UnitName
| sort by TotalGB desc 
| render piechart

In the table below, it shows the loadbal-1 reporting several times in a short window and the same for loadbal2 and 13. I'd like to capture these all in a single line, also I think I might have messed up the query for "TotalGB" (converting bytes to GB)

Answer 1

I would only like the latest set of data (when the query was run)

you can use the arg_max() aggregation function.

for example:

AzureMetrics
| where TimeGenerated >=ago(1d)
| where Resource contains "LB"
| where MetricName contains "ByteCount"
| summarize arg_max(TimeGenerated, *) by Resource

---

I've been trying to convert a query from bytes to GB, however I'm getting some strange results... I think I might have messed up the query for "TotalGB" (converting bytes to GB)

If the raw data is in bytes, then you need to divide it by exp2(30) (or 1024*1024*1024 ) to get the value as GBs.

Or, you can use the format_bytes() function instead

for example:

print bytes = 18027051483.0
| extend gb_1 = format_bytes(bytes), gb_2 = bytes/exp2(30), gb_3 = bytes/1024/1024/1024

bytes	gb_1	gb_2	gb_3
18027051483	17 GB	16.7889999998733	16.7889999998733