Thanks for your reply, Raman!
I have a couple of follow up questions.
I looked into joining `system.billing.usage` and `system.query.history` as you suggested, but ran into a problem: There is no column in our `system.billing.usage` table named `product`. Also, which column(s) should the two tables be joined on?
From the official documentation you linked to, the following is stated:
The identity_metadata column includes the run_as field, which shows the user or service principal whose credentials were used to run the workload.
However in our case, the `run_as` field is almost always `null`, contrary to what the documentation says, so we don't know which user of service principal ran the query.