How to use `sum` within `summarize` in a KQL query?

Question

I'm working at logging an Azure Storage Account. Have a Diagnostic Setting applied and am using Log Analytics to write KQL queries.

My goal is to determine the number of GetBlob requests (OperationName) for a given fileSize (RequestBodySize).

The challenge is that I need to sum the RequestBodySize for all GetBlob operations on each file. I'm not sure how to nest sum in summarize.

Tried so far:

StorageBlobLogs
| where TimeGenerated >= ago(5h)
  and AccountName == 'storageAccount'
  and OperationName  == 'GetBlob'
| summarize count() by Uri, fileSize = format_bytes(RequestBodySize)
| render scatterchart 

Results in:

Also tried: fileSize = format_bytes(sum(RequestBodySize)) but this errored out.

Any ideas?

EDIT 1: Testing out @Yoni's solution.

• Here is an example of RequestBodySize with no summarization:

• When implementing the summarize query (| summarize count() by Uri, fileSize = format_bytes(RequestBodySize)), the results are 0 bytes.
• Though its clear there are multiple calls for a given Uri, the sum doesn't seem to be working.

EDIT 2:

• And yeah... pays to verify the field names! There is no RequestBodySize field available, only ResponseBodySize. Using the correct value worked (imagine that!).

Answer 1

I need to sum the RequestBodySize for all GetBlob operations on each file

If I understood your question correctly, you could try this:

StorageBlobLogs
| where TimeGenerated >= ago(5h)
  and AccountName == 'storageAccount'
  and OperationName  == 'GetBlob'
| summarize count(), total_size = format_bytes(sum(RequestBodySize)) by Uri

Here's an example using a dummy data set:

datatable(Url:string, ResponseBodySize:long)
[
    "https://something1", 33554432,
    "https://something3", 12341234,
    "https://something1", 33554432,
    "https://something2", 12345678,
    "https://something2", 98765432,
]
| summarize count(), total_size = format_bytes(sum(ResponseBodySize)) by Url

Url	count_	total_size
https://something1	2	64 MB
https://something3	1	12 MB
https://something2	2	106 MB