Evidence rules

Four rules govern every figure the check reports. They exist because a wrong number is worse than a missing one: a missing number prompts a question, and a wrong one gets acted on.

1. One row per request

The LLM table emits several records per logical request. Every query collapses to one row per CorrelationId before counting or summing.

Without this, count() returns log lines rather than requests — inflated by a multiple on a streaming estate — and sum() double-counts any token value that appears on more than one record.

2. A value is taken only where the records agree

Collapsing uses make_set(x, 2), which collects up to two distinct non-null values:

Distinct values	Meaning	Result
1	The records agree	The value is taken
0	Nothing was reported	Absent
more than 1	The records conflict	Absent, conflict flagged

Conflict is never resolved by choosing. In the normal streaming case only the terminal record carries usage, so exactly one distinct value exists and it is taken unambiguously. If several records report different counts, no aggregate is defensible — summing double-counts a cumulative counter, and taking the maximum understates true deltas — so the row's tokens are refused rather than invented.

3. Absent is not zero

Kusto's sum() returns 0, not null, for a group in which every value is null. Left alone, that turns "no request here reported usage" into "this consumed nothing".

For a throttled request that never reached a model, zero happens to be true. For a group whose requests predate the LLM diagnostic category being switched on, it is false in the worst direction — it reads as these failures cost nothing instead of we have no telemetry for these failures.

So a token total resting on zero reporting requests is returned absent. A bar at zero reads as measured absence of spend; a gap reads as absence of evidence, which is the fact.

4. The denominator keeps what it cannot explain

Requests that cannot be attributed stay in the total. Values that were never reported group under (not reported) rather than being dropped. Dropping the inconvenient rows shrinks the denominator and silently improves every percentage above it.

Reading coverage

UsageCoveragePct is the share of requests in a group whose token totals could be established. Below 100%, the totals are a floor. They are not an estimate of the remainder, and they should not be scaled up to guess at it.