Share via

How do I know which service or part of service is generating a specific bill?

Nuno Rodrigues 20 Reputation points
2025-10-02T11:58:07.3133333+00:00

I marked as Data Explorer because it's where I am struggling currently but this can probably be applied to everything else.

I have an ADX Cluster which I am being charged, for example, Hot ZRS Read and Write Operations. I also have cold read and write operations although this one is Locally Redundant rather than Zone Redundant.

Is there a way to know what's triggering these, for example? Because I don't know how I have a Hot and a Cold storage at the same time.

Azure Data Explorer
Azure Data Explorer
An Azure data analytics service for real-time analysis on large volumes of data streaming from sources including applications, websites, and internet of things devices.
0 comments
Answer accepted by question author
  1. Alex Burlachenko 18,570 Reputation points Volunteer Moderator
    2025-10-02T13:53:08.96+00:00

    Nuno hello,

    the best way to dig into this is through azure cost analysis. go to the cost management + billing service in the portal, select your subscription, and then open 'cost analysis'.

    here, you can filter the view to your specific data explorer cluster. use the 'resource' filter and find your adx cluster. then, look at the costs grouped by 'meter'. this will break down the charges into line items like 'hot zrs read ops', 'cold lrs write ops', etc. this confirms what you're being charged for.

    to understand what is generating these operations, you need to look at the azure data explorer diagnostics. you should have diagnostic settings enabled to send logs to a log analytics workspace.

    once the logs are in log analytics, you can run kusto queries against the 'AzureDiagnostics' table to see the operations. you can filter by your cluster name and look for logs related to data ingestion, queries, and exports. a high volume of queries on older data would explain cold read operations, while constant data ingestion would explain hot write operations.

    the presence of both just means your cluster is interacting with data in both the hot cache and the long term storage archive, which is normal for an active cluster.

    regards,

    Alex

    and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer

    https://ctrlaltdel.blog/

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.