# Get average data size over period ```kusto search in (DeviceEvents, DeviceFileEvents, DeviceNetworkEvents) Timestamp >= ago(24h) | extend rowsize= estimate_data_size(*) | summarize 1msize=sum(rowsize) by bin(Timestamp, 1m) | summarize avgsize=avg(1msize) / 1024 / 1024 ```` # Get single highest payload size ```kusto search in (DeviceEvents, DeviceFileEvents, DeviceNetworkEvents) Timestamp >= ago(24h) | extend rowsize= estimate_data_size(*) | summarize 1msize=sum(rowsize) by bin(Timestamp, 1m) | summarize max=arg_max(1msize, *) | extend max=max/1024/1024 ``` # Get max per schema/table ```kusto let DeviceEventsMax = toscalar( DeviceEvents | where Timestamp >= ago(24h) | extend rowsize= estimate_data_size(*) | summarize 1msize=sum(rowsize) by bin(Timestamp, 1m) | summarize max(1msize)); let DeviceFileEventsMax = toscalar( DeviceFileEvents | where Timestamp >= ago(24h) | extend rowsize= estimate_data_size(*) | summarize 1msize=sum(rowsize) by bin(Timestamp, 1m) | summarize max(1msize)); let DeviceNetworkEventsMax = toscalar( DeviceNetworkEvents | where Timestamp >= ago(24h) | extend rowsize= estimate_data_size(*) | summarize 1msize=sum(rowsize) by bin(Timestamp, 1m) | summarize m=max(1msize)); print (DeviceNetworkEventsMax + DeviceFileEventsMax + DeviceEventsMax) / 1024 / 1024 ```