Skip to content

Commit 2741b13

Browse files
Merge pull request #266436 from DaleKoetke/docs-editor/daily-cap-1708028525
Update daily-cap.md
2 parents 7997e72 + 0b925d4 commit 2741b13

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

articles/azure-monitor/logs/daily-cap.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -141,12 +141,11 @@ To create an alert when the daily cap is reached, create an [Activity log alert
141141

142142

143143
## View the effect of the daily cap
144-
The following query can be used to track the data volumes that are subject to the daily cap for a Log Analytics workspace between daily cap resets. This accounts for the security data types that aren't included in the daily cap. In this example, the workspace's reset hour is 14:00. Change this value for your workspace.
144+
The following query can be used to track the data volumes that are subject to the daily cap for a Log Analytics workspace between daily cap resets. In this example, the workspace's reset hour is 14:00. Change this value for your workspace.
145145

146146
```kusto
147147
let DailyCapResetHour=14;
148148
Usage
149-
| where DataType !in ("SecurityAlert", "SecurityBaseline", "SecurityBaselineSummary", "SecurityDetection", "SecurityEvent", "WindowsFirewall", "MaliciousIPCommunication", "LinuxAuditLog", "SysmonEvent", "ProtectionStatus", "WindowsEvent")
150149
| where TimeGenerated > ago(32d)
151150
| extend StartTime=datetime_add("hour",-1*DailyCapResetHour,StartTime)
152151
| where StartTime > startofday(ago(31d))

0 commit comments

Comments
 (0)