onelinecommand

union withsource=LogTable *
| where TimeGenerated > ago(60d)
| extend ResourceId = tostring(parse_json(tostring(_ResourceId)))
| extend ResourceName = tostring(split(ResourceId, “/”)[8])
| extend ResourceType = case(
LogTable in (“Heartbeat”, “Perf”, “InsightsMetrics”, “Syslog”, “SecurityEvent”, “VMConnection”, “Update”), “Virtual Machine”,
LogTable startswith “App”, “Application”,
LogTable in (“CommonSecurityLog”, “AzureDiagnostics”), “Firewall”,
“Other”
)
| summarize
LogCount = count(),
IngestedVolumeMB = sum(_BilledSize) / 1024.0,
TotalBilledVolumeMB = sum(_BilledSize) / 1024.0 // Same as IngestedVolumeMB unless raw size is available
by LogTable, ResourceType, ResourceName
| extend
IngestedVolumeGB = round(IngestedVolumeMB / 1024.0, 2),
TotalBilledVolumeGB = round(TotalBilledVolumeMB / 1024.0, 2)
| project ResourceType, ResourceName, LogType = LogTable, IngestedVolumeGB, TotalBilledVolumeGB
| order by ResourceType, ResourceName

Sample Output