Hi,
you can try this:
fetch dt.system.events, scanLimitGBytes: -1
| filter event.kind == "BILLING_USAGE_EVENT"
| filter event.type == "Full-Stack Monitoring"
| filter isNotNull(dt.entity.host)
| dedup event.id
| summarize fs_gibih = sum(billed_gibibyte_hours),
by: { day = bin(timestamp, 1d), hostId = dt.entity.host }
| lookup [ fetch dt.entity.host ],
sourceField: hostId, lookupField: id
And this (not tested, i don't have enviroment to test it)
fetch dt.system.events, scanLimitGBytes: -1
| filter event.kind == "BILLING_USAGE_EVENT"
| filter event.type == "Infrastructure Monitoring"
| filter isNotNull(dt.entity.host)
| dedup event.id
| summarize infra_hosth = sum(billed_host_hours),
by: { day = bin(timestamp, 1d), hostId = dt.entity.host }
| lookup [ fetch dt.entity.host ],
sourceField: hostId, lookupField: id
fetch dt.system.events, scanLimitGBytes: -1
Fetches system events from storage (with no scan limit in this query).
| filter event.kind == "BILLING_USAGE_EVENT"
Keeps only billing-related events.
| filter event.type == "Full-Stack Monitoring"
Narrows to the “Full-Stack Monitoring” billing type (where fields like billed_gibibyte_hours are present).
| filter isNotNull(dt.entity.host)
Keeps only events that are linked to a specific host (i.e., have dt.entity.host).
| dedup event.id
Removes any duplicate events using the unique event.id.
| summarize fs_gibih = sum(billed_gibibyte_hours), by: { day = bin(timestamp, 1d), hostId = dt.entity.host }
Aggregates data so you get one row per (day, host):
- day — timestamp bucketed to 1 day (bin(..., 1d)),
- hostId — the host entity ID (e.g., HOST-...),
- fs_gibih — the sum of billed_gibibyte_hours for that host on that day.
