Did you get any examples to share?
- It is amazing how much detail is in each of these JSON structured Billing records.
- On the other hand, getting this 24+ hours later, is an issue.
Here is one overview search by subscription, cumulative from beginning of month:
sourcetype="azure:billing" earliest=@mon latest=-1d@h
| spath properties.pretaxCost
| dedup name
|bucket _time span=1d | timechart sum("properties.pretaxCost") AS cost by
properties.subscriptionName | streamstats sum(*) as *
Choose visualization as stacked area chart.
Note: The dedup on "name" to remove duplicate billing records.
... View more