diff --git a/AKS/Alerts/README b/AKS/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/AKS/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/AKS/Queries/README b/AKS/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/AKS/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/AKS/Workbooks/Billing Usage/Billing Usage.workbook b/AKS/Workbooks/Billing Usage/Billing Usage.workbook new file mode 100644 index 0000000..410de5c --- /dev/null +++ b/AKS/Workbooks/Billing Usage/Billing Usage.workbook @@ -0,0 +1,432 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "Container Insights billable data usage", + "expandable": true, + "expanded": true, + "items": [ + { + "type": 1, + "content": { + "json": "This workbook provides you a summary & source for billable data collected by [Container Insights solution.](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/container-insights-overview)\r\n\r\nThe best way to understand how Container Insights ingest data in Log Analytics workspace is from this [article.](https://medium.com/microsoftazure/azure-monitor-for-containers-optimizing-data-collection-settings-for-cost-ce6f848aca32)\r\n\r\nIn this workbook you can understand your data by\r\n\r\n* You can view billable data ingested by **solution**.\r\n* You can view billable data ingested by **Container logs(application logs)**\r\n* You can view billable container logs data ingested segregated by **Kubernetes namespace**\r\n* You can view billable container logs data ingested segregated by **Cluster name**\r\n* You can view billable container log data ingested by **logsource entry**\r\n* You can view billable diagnostic data ingested by **diagnostic master node logs**\r\n\r\nYou can fine tune & control logging by turning off logging on the above mentioned vectors. [Learn how to fine-tune logging](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/container-insights-agent-config)\r\n\r\nYou can control your master nodes logs by updating the diagnostic settings. [Learn how to update diagnostic settings](https://docs.microsoft.com/en-us/azure/aks/view-master-logs)" + }, + "name": "text - 0" + }, + { + "type": 1, + "content": { + "json": "---" + }, + "name": "text - 10" + } + ] + }, + "name": "workbook-explanation" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "cbafb196-4c70-4f43-b189-1de7620db19e", + "version": "KqlParameterItem/1.0", + "name": "Time_range", + "label": "Time Range", + "type": 4, + "description": "Select time-range for data selection", + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "c9973557-1843-4b41-bc41-091c5090a336", + "version": "KqlParameterItem/1.0", + "name": "masterNodeExists", + "type": 1, + "query": "let MissingTable = view () { print isMissing=1 };\r\nlet masterNodeExists = toscalar(\r\nunion isfuzzy=true MissingTable, (\r\nAzureDiagnostics \r\n| getschema \r\n| summarize c=count() \r\n| project isMissing=iff(c > 0, 0, 1)\r\n) \r\n| top 1 by isMissing asc\r\n);\r\nprint(iif(masterNodeExists == 0, 'yes', 'no'))\r\n", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "time-range-and-master-node-pills" + }, + { + "type": 1, + "content": { + "json": "`Master node logs` are not enabled. [Learn how to enable](https://docs.microsoft.com/en-us/azure/aks/view-master-logs)" + }, + "conditionalVisibility": { + "parameterName": "masterNodeExists", + "comparison": "isEqualTo", + "value": "no" + }, + "name": "master-node-logs-are-not-enabled-msg" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union withsource = tt *\r\n| where _IsBillable == true\r\n| summarize BillableDataBytes = sum(_BilledSize) by bin(TimeGenerated, {Time_range:grain}), tt\r\n| render piechart", + "size": 0, + "showAnnotations": true, + "showAnalytics": true, + "title": "Billable data from Container Insights", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "chartSettings": { + "xAxis": "TimeGenerated", + "seriesLabelSettings": [ + { + "seriesName": "LogManagement", + "label": "LogManagementSolution(GB)" + }, + { + "seriesName": "ContainerInsights", + "label": "ContainerInsightsSolution(GB)" + } + ], + "ySettings": { + "unit": 2, + "min": null, + "max": null + } + } + }, + "customWidth": "50", + "name": "billable-data-from-ci", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let containerLogs = ContainerLog\r\n| where _IsBillable == true\r\n| summarize BillableDataBytes = sum(_BilledSize) by LogEntrySource, ContainerID;\r\nlet kpi = KubePodInventory\r\n| distinct ContainerID, Namespace;\r\ncontainerLogs\r\n| join kpi on $left.ContainerID == $right.ContainerID\r\n| summarize Total=sum(BillableDataBytes) by Namespace\r\n| render piechart\r\n", + "size": 0, + "showAnalytics": true, + "title": "Billable data per namespace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Namespace", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Total", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "Namespace", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "Total", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": null, + "max": null + } + } + }, + "customWidth": "50", + "name": "billable-data-per-namespace", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "Data at Namespace level", + "expandable": true, + "expanded": true, + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "d5701caa-0486-4e6f-adad-6fa5b8496a7d", + "version": "KqlParameterItem/1.0", + "name": "namespace", + "label": "Namespace", + "type": 2, + "description": "Selecting Namespace", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "ContainerLog\r\n| join(KubePodInventory) on ContainerID\r\n| distinct Namespace\r\n| project value = Namespace, label = Namespace, selected = false\r\n| sort by label asc", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "namespace-query" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let namespace = dynamic([{namespace}]);\r\nlet containerLogs = ContainerLog\r\n| where _IsBillable == true\r\n| summarize BillableDataBytes = sum(_BilledSize) by LogEntrySource, ContainerID;\r\nlet kpi = KubePodInventory\r\n| distinct ContainerID, Namespace;\r\ncontainerLogs\r\n| join kpi on $left.ContainerID == $right.ContainerID\r\n| where \"*\" in ({namespace}) or Namespace in ({namespace}) \r\n| extend sourceNamespace = strcat(LogEntrySource, \"/\", Namespace)\r\n| summarize Total=sum(BillableDataBytes) by sourceNamespace\r\n| render piechart", + "size": 0, + "showAnnotations": true, + "showAnalytics": true, + "title": "Billable data per log-source type for namespace selected", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "chartSettings": { + "ySettings": { + "unit": 2, + "min": null, + "max": null + } + } + }, + "customWidth": "50", + "name": "billable-data-per-log-source", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let namespace = dynamic([{namespace}]);\r\nContainerLog\r\n| join(KubePodInventory) on ContainerID\r\n| where \"*\" in ({namespace}) or Namespace in ({namespace})\r\n| summarize ContainerLogData = sum(_BilledSize) by bin(TimeGenerated, {Time_range:grain})\r\n| render linechart\r\n\r\n", + "size": 0, + "showAnnotations": true, + "showAnalytics": true, + "title": "Billable container log data for namespace selected", + "noDataMessage": "The query returned no result", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "chartSettings": { + "xSettings": {}, + "ySettings": { + "numberFormatSettings": { + "unit": 2, + "options": { + "style": "decimal" + } + } + } + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "namespace:label", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "billable-container-log-data-for-namespace-selected", + "styleSettings": { + "showBorder": true + } + } + ] + }, + "name": "data-at-namespace-level" + }, + { + "type": 1, + "content": { + "json": "---" + }, + "name": "text - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "ContainerLog\r\n|join(KubePodInventory) on ContainerID\r\n| summarize Total= sum(_BilledSize) by bin(TimeGenerated, {Time_range:grain}), ClusterName\r\n| render linechart", + "size": 0, + "showAnalytics": true, + "title": "Billable container log data per cluster name", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "chartSettings": { + "ySettings": { + "unit": 2, + "min": null, + "max": null + } + } + }, + "customWidth": "50", + "name": "billable-container-log-data-per-cluster-name", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureDiagnostics\r\n| summarize Total= sum(_BilledSize) by bin(TimeGenerated, {Time_range:grain}), Category\r\n| render barchart\r\n\r\n\r\n", + "size": 0, + "showAnnotations": true, + "showAnalytics": true, + "title": "Billable data from diagnostic master node logs", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Time_range", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "chartSettings": { + "ySettings": { + "unit": 2, + "min": null, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "masterNodeExists", + "comparison": "isEqualTo", + "value": "yes" + }, + "customWidth": "50", + "name": "billable-data-from-diagnostic-master-node-logs", + "styleSettings": { + "showBorder": true + } + } + ], + "styleSettings": { + "spacingStyle": "narrow" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/AKS/Workbooks/Billing Usage/settings.json b/AKS/Workbooks/Billing Usage/settings.json new file mode 100644 index 0000000..236ba1b --- /dev/null +++ b/AKS/Workbooks/Billing Usage/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Container Insights Usage", + "author": "Microsoft", + "galleries": [{ "type": "container-insights", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 600 }, + { "type": "workbook", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 600 }] +} diff --git a/AKS/Workbooks/Node Disk Capacity AKS Engine/Node Disk Capacity AKS Engine.workbook b/AKS/Workbooks/Node Disk Capacity AKS Engine/Node Disk Capacity AKS Engine.workbook new file mode 100644 index 0000000..f4e8576 --- /dev/null +++ b/AKS/Workbooks/Node Disk Capacity AKS Engine/Node Disk Capacity AKS Engine.workbook @@ -0,0 +1,506 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "_More information about the metrics in this workbook is available here_" + }, + "name": "text - 15" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "08bdcd8f-68e6-42c1-b82a-7302463d8901", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter by time range", + "isRequired": true, + "value": { + "durationMs": 1800000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "a9d18789-a7eb-4fe4-b679-a26a835615a8", + "version": "KqlParameterItem/1.0", + "name": "selectedNodes1", + "label": "Node", + "type": 2, + "description": "Filter by node", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName)\r\n| distinct HostName\r\n| project value = HostName, label = HostName, selected = false\r\n| sort by label asc\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "bdb126c9-59e6-46af-b2a4-59a0511b94d3", + "version": "KqlParameterItem/1.0", + "name": "selectedDevices1", + "label": "Device", + "type": 2, + "description": "Filter by device", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| distinct Device\r\n| project value = Device, label = Device, selected = false\r\n| sort by label asc\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "0d3faddf-bf4f-479e-ace2-7ccae85eff1c", + "version": "KqlParameterItem/1.0", + "name": "clusterId", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + } + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "dropdowns" + }, + { + "type": 1, + "content": { + "json": "
" + }, + "name": "text - 12 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let usedDiskUnhealthyThreshold = 90;\r\nlet usedDiskCriticalThreshold = 99;\r\nlet data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| where Name == 'used_percent'\r\n| extend ClusterID = extractjson(\"$['container.azm.ms/clusterId']\", Tags, typeof(string))\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where \"*\" in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where \"*\" in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| where ClusterID =~ tostring('{clusterId}')\r\n| summarize UsedDisk = max(Val) by NodeDisk\r\n| extend State = iff(UsedDisk >= usedDiskCriticalThreshold, 'Critical disks', iif((UsedDisk >= usedDiskUnhealthyThreshold and UsedDisk < usedDiskCriticalThreshold), 'Unhealthy disks', 'Healthy disks'));\r\ndata\r\n| summarize Count = count(), Disks = makeset(NodeDisk) by State\r\n| union (\r\n data\r\n | summarize Count = count(), Disks = dynamic([\"*\"])\r\n | extend State = 'All disks'\r\n)\r\n| join kind = fullouter (datatable (State: string) ['All disks', 'Critical disks', 'Unhealthy disks', 'Healthy disks']) on State\r\n| extend Count = iff(State == '', 0, Count), Disks = iff(State == '', dynamic([]), Disks)\r\n| order by Count desc\r\n", + "size": 4, + "aggregation": 2, + "title": "💡 Click on a tile to filter by disks in that state", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "timeBrushParameterName": "filteredTimeRange", + "exportFieldName": "Disks", + "exportParameterName": "DisksOfSelectedState", + "exportDefaultValue": "[\"*\"]", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "State1", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + "showBorder": false + } + }, + "name": "tiles" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 12" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a3f05500-bcb2-4247-b678-e3245ac4dc60", + "version": "KqlParameterItem/1.0", + "name": "topN", + "label": "Show", + "type": 2, + "description": "Show the top N disks by used disk % in the chart below", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": 3, \"label\": \"Top 3\", \"selected\": \"true\" },\r\n { \"value\": 5, \"label\": \"Top 5\", \"selected\": \"false\" },\r\n { \"value\": 10, \"label\": \"Top 10\", \"selected\": \"false\" },\r\n { \"value\": 15, \"label\": \"Top 15\", \"selected\": \"false\" },\r\n { \"value\": 1000, \"label\": \"All\", \"selected\": \"false\" }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 11" + }, + { + "type": 1, + "content": { + "json": "

{topN:label} Disks by Used Disk %

" + }, + "name": "text - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let selectedStateDisks = dynamic({DisksOfSelectedState});\r\nlet data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| where Name == 'used_percent'\r\n| extend ClusterID = extractjson(\"$['container.azm.ms/clusterId']\", Tags, typeof(string))\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where \"*\" in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where \"*\" in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| where ClusterID =~ tostring('{clusterId}')\r\n| where NodeDisk in (selectedStateDisks) or '*' in (selectedStateDisks);\r\nlet mostUsedDisks = data\r\n| top-nested {topN} of NodeDisk by MaxVal = max(Val);\r\ndata\r\n| where NodeDisk in (mostUsedDisks)\r\n| make-series ['Used Disk %'] = max(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by NodeDisk\r\n", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "showPin": true, + "name": "top-used-disk-grid" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n
\r\n" + }, + "name": "text - 14" + }, + { + "type": 1, + "content": { + "json": "

Disk Capacity Overview

" + }, + "name": "text - 13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let selectedStateDisks = dynamic({DisksOfSelectedState});\r\nlet data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| where Name == 'used_percent' or Name == 'free'\r\n| extend ClusterID = extractjson(\"$['container.azm.ms/clusterId']\", Tags, typeof(string))\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where \"*\" in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where \"*\" in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| where ClusterID =~ tostring('{clusterId}')\r\n| where NodeDisk in (selectedStateDisks) or '*' in (selectedStateDisks);\r\nlet usedPercent = data\r\n| where Name == 'used_percent';\r\nlet free = data\r\n| where Name == 'free';\r\nlet worstDisksPerNode = usedPercent\r\n| partition by HostName (\r\n summarize UsedPercent = max(Val) by HostName, Device, NodeDisk\r\n | top 1 by UsedPercent desc\r\n);\r\nusedPercent // used percent for devices\r\n| summarize UsedPercent = max(Val) by HostName, Device\r\n| join kind = inner (\r\n usedPercent \r\n | make-series UsedPercentTrend = max(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n) on HostName\r\n| where Device == Device1\r\n| project Id = strcat(HostName, Device), Name = strcat('🔹 ', Device), ParentId = HostName, Kind = 'Device', UsedPercent, UsedPercentTrend\r\n| union ( // used percent for nodes\r\n usedPercent\r\n | summarize UsedPercent = max(Val) by HostName\r\n | join kind = inner (\r\n usedPercent \r\n | make-series UsedPercentTrend = max(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName\r\n ) on HostName\r\n | project Id = HostName, Name = strcat('🖥️ ', HostName), ParentId = '', Kind = 'Node', UsedPercent, UsedPercentTrend\r\n)\r\n| join kind = inner (\r\n free // free space for devices\r\n | summarize Free = min(Val) by HostName, Device\r\n | join kind = inner (\r\n free \r\n | make-series FreeTrend = min(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n ) on HostName\r\n | where Device == Device1\r\n | project Id = strcat(HostName, Device), Name = Device, ParentId = HostName, Kind = 'Device', Free, FreeTrend\r\n | union ( // free space for nodes\r\n free\r\n | summarize Free = min(Val) by HostName, Device\r\n | join kind = inner ( // match the set of node-disk free space data to the nodes with the worst used percent data for setting the data in the node rows\r\n worstDisksPerNode\r\n ) on HostName, Device\r\n | join kind = inner (\r\n free \r\n | make-series FreeTrend = min(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n | join kind = inner (\r\n worstDisksPerNode\r\n ) on HostName, Device\r\n ) on HostName\r\n | project Id = HostName, Name = HostName, ParentId = '', Kind = 'Node', Free, FreeTrend\r\n )\r\n) on Id\r\n| project-away Id1, Name1, ParentId1, Kind1\r\n| project-rename ['Used Disk % (Max)'] = UsedPercent, ['Used Disk % Trend (Max)'] = UsedPercentTrend, ['Free Disk Space (Min)'] = Free, ['Free Disk Space Trend (Min)'] = FreeTrend\r\n| order by ['Used Disk % (Max)'] desc, Name asc", + "size": 0, + "showAnalytics": true, + "title": "💡 Click on a row to see the metrics for the node or device charted below over the selected time range", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "exportFieldName": "", + "exportParameterName": "selectedRow", + "exportDefaultValue": "{\"Kind\":\"Unselected\"}", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ParentId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Kind", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Used Disk % (Max)", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": ">=", + "thresholdValue": "99", + "representation": "critical", + "text": "{0}{1}" + }, + { + "operator": ">=", + "thresholdValue": "90", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Used Disk % Trend (Max)", + "formatter": 9, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed", + "showIcon": true + } + }, + { + "columnMatch": "Free Disk Space (Min)", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Free Disk Space Trend (Min)", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blueDark", + "showIcon": true + } + } + ], + "filter": true, + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "ParentId", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": true + } + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "Id", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "Used percent (p95)", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "showPin": true, + "name": "overview-grid" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "ac479e36-f134-4734-a5ba-2c03df30d0e0", + "version": "KqlParameterItem/1.0", + "name": "selectedRowId", + "type": 1, + "description": "The Id of the row selected in the grid", + "isRequired": true, + "query": "let selectedStateDisks = dynamic({DisksOfSelectedState});\r\nlet row = dynamic({selectedRow}).Id;\r\nlet usedPercent = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| where Name == 'used_percent'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device)), ClusterId = Tags['container.azm.ms/clusterId']\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where ClusterId =~ '{clusterId}'\r\n| where \"*\" in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where \"*\" in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| where NodeDisk in (selectedStateDisks) or '*' in (selectedStateDisks);\r\nlet worstDiskAcrossNodes = toscalar(\r\n usedPercent\r\n | summarize UsedPercent = max(Val) by NodeDisk\r\n | top 1 by UsedPercent desc\r\n | project NodeDisk\r\n); \r\nprint(iif(isempty(row), worstDiskAcrossNodes, row))", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "selected-row-id" + }, + { + "type": 1, + "content": { + "json": "

Details for {selectedRowId}:

" + }, + "name": "text - 13 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let selectedStateDisks = dynamic({DisksOfSelectedState});\r\nlet usedPercent = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| where Name == 'used_percent'\r\n| extend ClusterID = extractjson(\"$['container.azm.ms/clusterId']\", Tags, typeof(string))\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where ClusterID =~ tostring('{clusterId}')\r\n| where NodeDisk in (selectedStateDisks) or '*' in (selectedStateDisks);\r\nlet row = dynamic({selectedRow});\r\nlet worstDiskAcrossNodes = usedPercent\r\n| summarize UsedPercent = max(Val) by NodeDisk\r\n| top 1 by UsedPercent desc;\r\nusedPercent\r\n| where (row.Kind == 'Unselected') or (row.Kind == 'Node' and row.Id == HostName) or (row.Kind == 'Device' and row.Id == NodeDisk)\r\n| make-series ['Used Disk %'] = max(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by NodeDisk\r\n| where NodeDisk contains iff(row.Kind == 'Unselected', toscalar(worstDiskAcrossNodes | project NodeDisk), '')", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "title": "Used Disk %", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart" + }, + "customWidth": "50", + "showPin": true, + "name": "used-disk-space-chart" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let selectedStateDisks = dynamic({DisksOfSelectedState});\r\nlet data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| where Name == 'used_percent' or Name == 'free'\r\n| extend ClusterID = extractjson(\"$['container.azm.ms/clusterId']\", Tags, typeof(string))\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where ClusterID =~ tostring('{clusterId}')\r\n| where NodeDisk in (selectedStateDisks) or '*' in (selectedStateDisks);\r\nlet usedPercent = data\r\n| where Name == 'used_percent';\r\nlet free = data\r\n| where Name == 'free'\r\n| extend Val = Val / 1073741824;\r\nlet row = dynamic({selectedRow});\r\nlet worstDiskAcrossNodes = usedPercent\r\n| summarize UsedPercent = max(Val) by NodeDisk\r\n| top 1 by UsedPercent desc;\r\nfree\r\n| where (row.Kind == 'Unselected') or (row.Kind == 'Node' and row.Id == HostName) or (row.Kind == 'Device' and row.Id == NodeDisk)\r\n| make-series ['Free Disk Space'] = min(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by NodeDisk\r\n| where NodeDisk contains iff(row.Kind == 'Unselected', toscalar(worstDiskAcrossNodes | project NodeDisk), '')", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "title": "Free Disk Space (GiB)", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart" + }, + "customWidth": "50", + "showPin": true, + "name": "free-disk-space-chart" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/AKS/Workbooks/Node Disk Capacity AKS Engine/settings.json b/AKS/Workbooks/Node Disk Capacity AKS Engine/settings.json new file mode 100644 index 0000000..05e0eeb --- /dev/null +++ b/AKS/Workbooks/Node Disk Capacity AKS Engine/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Node Disk Capacity", + "author": "Microsoft", + "galleries": [ + { "type": "container-insights", "resourceType": "microsoft.operationalinsights/workspaces", "order": 100 } + ] +} diff --git a/AKS/Workbooks/Node Disk Capacity AKS/Node Disk Capacity AKS.workbook b/AKS/Workbooks/Node Disk Capacity AKS/Node Disk Capacity AKS.workbook new file mode 100644 index 0000000..c842950 --- /dev/null +++ b/AKS/Workbooks/Node Disk Capacity AKS/Node Disk Capacity AKS.workbook @@ -0,0 +1,492 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "_More information about the metrics in this workbook is available here_" + }, + "name": "text - 15" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "08bdcd8f-68e6-42c1-b82a-7302463d8901", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter by time range", + "isRequired": true, + "value": { + "durationMs": 21600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "a9d18789-a7eb-4fe4-b679-a26a835615a8", + "version": "KqlParameterItem/1.0", + "name": "selectedNodes1", + "label": "Node", + "type": 2, + "description": "Filter by node", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName)\r\n| distinct HostName\r\n| project value = HostName, label = HostName, selected = false\r\n| sort by label asc\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + { + "id": "bdb126c9-59e6-46af-b2a4-59a0511b94d3", + "version": "KqlParameterItem/1.0", + "name": "selectedDevices1", + "label": "Device", + "type": 2, + "description": "Filter by device", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| distinct Device\r\n| project value = Device, label = Device, selected = false\r\n| sort by label asc\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + "name": "dropdowns" + }, + { + "type": 1, + "content": { + "json": "
" + }, + "name": "text - 12 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let usedDiskUnhealthyThreshold = 90;\r\nlet usedDiskCriticalThreshold = 99;\r\nlet data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace == 'container.azm.ms/disk'\r\n| where Name == 'used_percent'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where \"*\" in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where \"*\" in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| summarize UsedDisk = max(Val) by NodeDisk\r\n| extend State = iff(UsedDisk >= usedDiskCriticalThreshold, 'Critical disks', iif((UsedDisk >= usedDiskUnhealthyThreshold and UsedDisk < usedDiskCriticalThreshold), 'Unhealthy disks', 'Healthy disks'));\r\ndata\r\n| summarize Count = count(), Disks = makeset(NodeDisk) by State\r\n| union (\r\n data\r\n | summarize Count = count(), Disks = dynamic([\"*\"])\r\n | extend State = 'All disks'\r\n)\r\n| join kind = fullouter (datatable (State: string) ['All disks', 'Critical disks', 'Unhealthy disks', 'Healthy disks']) on State\r\n| extend Count = iff(State == '', 0, Count), Disks = iff(State == '', dynamic([]), Disks)\r\n| order by Count desc\r\n", + "size": 4, + "aggregation": 2, + "title": "💡 Click on a tile to filter by disks in that state", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "timeBrushParameterName": "filteredTimeRange", + "exportFieldName": "Disks", + "exportParameterName": "DisksOfSelectedState", + "exportDefaultValue": "[\"*\"]", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "State1", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + "showBorder": false + } + }, + "name": "tiles" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 12" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a3f05500-bcb2-4247-b678-e3245ac4dc60", + "version": "KqlParameterItem/1.0", + "name": "topN", + "label": "Show", + "type": 2, + "description": "Show the top N disks by used disk % in the chart below", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": 3, \"label\": \"Top 3\", \"selected\": \"true\" },\r\n { \"value\": 5, \"label\": \"Top 5\", \"selected\": \"false\" },\r\n { \"value\": 10, \"label\": \"Top 10\", \"selected\": \"false\" },\r\n { \"value\": 15, \"label\": \"Top 15\", \"selected\": \"false\" },\r\n { \"value\": 1000, \"label\": \"All\", \"selected\": \"false\" }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + "name": "parameters - 11" + }, + { + "type": 1, + "content": { + "json": "

{topN:label} Disks by Used Disk %

" + }, + "name": "text - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let selectedStateDisks = dynamic({DisksOfSelectedState});\r\nlet data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| where Name == 'used_percent'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where \"*\" in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where \"*\" in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| where NodeDisk in (selectedStateDisks) or '*' in (selectedStateDisks);\r\nlet mostUsedDisks = data\r\n| top-nested {topN} of NodeDisk by MaxVal = max(Val);\r\ndata\r\n| where NodeDisk in (mostUsedDisks)\r\n| make-series ['Used Disk %'] = max(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by NodeDisk\r\n", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "showPin": true, + "name": "top-used-disk-grid" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n
\r\n" + }, + "name": "text - 14" + }, + { + "type": 1, + "content": { + "json": "

Disk Capacity Overview

" + }, + "name": "text - 13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let selectedStateDisks = dynamic({DisksOfSelectedState});\r\nlet data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| where Name == 'used_percent' or Name == 'free'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where \"*\" in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where \"*\" in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| where NodeDisk in (selectedStateDisks) or '*' in (selectedStateDisks);\r\nlet usedPercent = data\r\n| where Name == 'used_percent';\r\nlet free = data\r\n| where Name == 'free';\r\nlet worstDisksPerNode = usedPercent\r\n| partition by HostName (\r\n summarize UsedPercent = max(Val) by HostName, Device, NodeDisk\r\n | top 1 by UsedPercent desc\r\n);\r\nusedPercent // used percent for devices\r\n| summarize UsedPercent = max(Val) by HostName, Device\r\n| join kind = inner (\r\n usedPercent \r\n | make-series UsedPercentTrend = max(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n) on HostName\r\n| where Device == Device1\r\n| project Id = strcat(HostName, Device), Name = strcat('🔹 ', Device), ParentId = HostName, Kind = 'Device', UsedPercent, UsedPercentTrend\r\n| union ( // used percent for nodes\r\n usedPercent\r\n | summarize UsedPercent = max(Val) by HostName\r\n | join kind = inner (\r\n usedPercent \r\n | make-series UsedPercentTrend = max(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName\r\n ) on HostName\r\n | project Id = HostName, Name = strcat('🖥️ ', HostName), ParentId = '', Kind = 'Node', UsedPercent, UsedPercentTrend\r\n)\r\n| join kind = inner (\r\n free // free space for devices\r\n | summarize Free = min(Val) by HostName, Device\r\n | join kind = inner (\r\n free \r\n | make-series FreeTrend = min(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n ) on HostName\r\n | where Device == Device1\r\n | project Id = strcat(HostName, Device), Name = Device, ParentId = HostName, Kind = 'Device', Free, FreeTrend\r\n | union ( // free space for nodes\r\n free\r\n | summarize Free = min(Val) by HostName, Device\r\n | join kind = inner ( // match the set of node-disk free space data to the nodes with the worst used percent data for setting the data in the node rows\r\n worstDisksPerNode\r\n ) on HostName, Device\r\n | join kind = inner (\r\n free \r\n | make-series FreeTrend = min(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n | join kind = inner (\r\n worstDisksPerNode\r\n ) on HostName, Device\r\n ) on HostName\r\n | project Id = HostName, Name = HostName, ParentId = '', Kind = 'Node', Free, FreeTrend\r\n )\r\n) on Id\r\n| project-away Id1, Name1, ParentId1, Kind1\r\n| project-rename ['Used Disk % (Max)'] = UsedPercent, ['Used Disk % Trend (Max)'] = UsedPercentTrend, ['Free Disk Space (Min)'] = Free, ['Free Disk Space Trend (Min)'] = FreeTrend\r\n| order by ['Used Disk % (Max)'] desc, Name asc", + "size": 0, + "showAnalytics": true, + "title": "💡 Click on a row to see the metrics for the node or device charted below over the selected time range", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "exportFieldName": "", + "exportParameterName": "selectedRow", + "exportDefaultValue": "{\"Kind\":\"Unselected\"}", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ParentId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Kind", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Used Disk % (Max)", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": ">=", + "thresholdValue": "99", + "representation": "critical", + "text": "{0}{1}" + }, + { + "operator": ">=", + "thresholdValue": "90", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Used Disk % Trend (Max)", + "formatter": 9, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed", + "showIcon": true + } + }, + { + "columnMatch": "Free Disk Space (Min)", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Free Disk Space Trend (Min)", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blueDark", + "showIcon": true + } + } + ], + "filter": true, + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "ParentId", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": true + } + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "Id", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "Used percent (p95)", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "showPin": true, + "name": "overview-grid" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "ac479e36-f134-4734-a5ba-2c03df30d0e0", + "version": "KqlParameterItem/1.0", + "name": "selectedRowId", + "type": 1, + "description": "The Id of the row selected in the grid", + "query": "let selectedStateDisks = dynamic({DisksOfSelectedState});\r\nlet row = dynamic({selectedRow}).Id;\r\nlet usedPercent = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| where Name == 'used_percent'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where \"*\" in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where \"*\" in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| where NodeDisk in (selectedStateDisks) or '*' in (selectedStateDisks);\r\nlet worstDiskAcrossNodes = toscalar(\r\n usedPercent\r\n | summarize UsedPercent = max(Val) by NodeDisk\r\n | top 1 by UsedPercent desc\r\n | project NodeDisk\r\n); \r\nprint(iif(isempty(row), worstDiskAcrossNodes, row))", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + "name": "selected-row-id" + }, + { + "type": 1, + "content": { + "json": "

Details for {selectedRowId}:

" + }, + "name": "text - 13 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let selectedStateDisks = dynamic({DisksOfSelectedState});\r\nlet usedPercent = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| where Name == 'used_percent'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where \"*\" in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where \"*\" in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| where NodeDisk in (selectedStateDisks) or '*' in (selectedStateDisks);\r\nlet row = dynamic({selectedRow});\r\nlet worstDiskAcrossNodes = usedPercent\r\n| summarize UsedPercent = max(Val) by NodeDisk\r\n| top 1 by UsedPercent desc;\r\nusedPercent\r\n| where (row.Kind == 'Unselected') or (row.Kind == 'Node' and row.Id == HostName) or (row.Kind == 'Device' and row.Id == NodeDisk)\r\n| make-series ['Used Disk %'] = max(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by NodeDisk\r\n| where NodeDisk contains iff(row.Kind == 'Unselected', toscalar(worstDiskAcrossNodes | project NodeDisk), '')", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "title": "Used Disk %", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "linechart" + }, + "customWidth": "50", + "showPin": true, + "name": "used-disk-space-chart" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let selectedStateDisks = dynamic({DisksOfSelectedState});\r\nlet data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'disk' or Namespace =~ 'container.azm.ms/disk'\r\n| where Name == 'used_percent' or Name == 'free'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.device))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where \"*\" in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where \"*\" in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| where NodeDisk in (selectedStateDisks) or '*' in (selectedStateDisks);\r\nlet usedPercent = data\r\n| where Name == 'used_percent';\r\nlet free = data\r\n| where Name == 'free'\r\n| extend Val = Val / 1073741824;\r\nlet row = dynamic({selectedRow});\r\nlet worstDiskAcrossNodes = usedPercent\r\n| summarize UsedPercent = max(Val) by NodeDisk\r\n| top 1 by UsedPercent desc;\r\nfree\r\n| where (row.Kind == 'Unselected') or (row.Kind == 'Node' and row.Id == HostName) or (row.Kind == 'Device' and row.Id == NodeDisk)\r\n| make-series ['Free Disk Space'] = min(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by NodeDisk\r\n| where NodeDisk contains iff(row.Kind == 'Unselected', toscalar(worstDiskAcrossNodes | project NodeDisk), '')", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "title": "Free Disk Space (GiB)", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "linechart" + }, + "customWidth": "50", + "showPin": true, + "name": "free-disk-space-chart" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/AKS/Workbooks/Node Disk Capacity AKS/settings.json b/AKS/Workbooks/Node Disk Capacity AKS/settings.json new file mode 100644 index 0000000..ff2cb93 --- /dev/null +++ b/AKS/Workbooks/Node Disk Capacity AKS/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Node Disk Capacity", + "author": "Microsoft", + "galleries": [ + { "type": "container-insights", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 100 }, + { "type": "workbook", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 100 } + ] +} diff --git a/AKS/Workbooks/Node Disk IO AKS Engine/Node Disk IO AKS Engine.workbook b/AKS/Workbooks/Node Disk IO AKS Engine/Node Disk IO AKS Engine.workbook new file mode 100644 index 0000000..1e2ea6c --- /dev/null +++ b/AKS/Workbooks/Node Disk IO AKS Engine/Node Disk IO AKS Engine.workbook @@ -0,0 +1,627 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "_More information about the metrics in this workbook is available here_" + }, + "name": "text - 18" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e2b5cd30-7276-477f-a6bb-07da25ba5e5f", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter data by time range", + "isRequired": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "value": { + "durationMs": 1800000 + } + }, + { + "id": "4c9a0f80-fa3e-44af-8f0d-6744ecf503c6", + "version": "KqlParameterItem/1.0", + "name": "unit", + "label": "Unit", + "type": 2, + "description": "The units to use for the data", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"label\": \"Bytes\", \"value\": \"1\", \"selected\": \"true\" },\r\n { \"label\": \"Kilobytes\", \"value\": \"1000\", \"selected\": \"false\" },\r\n { \"label\": \"Megabytes\", \"value\": \"1000000\", \"selected\": \"false\" },\r\n { \"label\": \"Gigabytes\", \"value\": \"1000000000\", \"selected\": \"false\" }\r\n]" + }, + { + "id": "164c1cb5-5587-47de-994b-4b3251526f73", + "version": "KqlParameterItem/1.0", + "name": "aggregation1", + "label": "Aggregation", + "type": 2, + "description": "Choose which data aggregation you want to visualize on the time chart", + "value": "Average", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"label\": \"Max\", \"value\": \"Max\" },\r\n { \"label\": \"Average\", \"value\": \"Average\" },\r\n { \"label\": \"Min\", \"value\": \"Min\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange" + }, + { + "id": "f126ca9e-5dbb-4b5c-89bd-7568f9b75367", + "version": "KqlParameterItem/1.0", + "name": "selectedNodes1", + "label": "Node", + "type": 2, + "description": "Filter by node", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin =~ 'container.azm.ms/telegraf'\r\n| where Namespace =~ 'container.azm.ms/diskio'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName)\r\n| distinct HostName\r\n| sort by HostName asc\r\n\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "c8a9d7cf-eb5c-4bfb-a4ab-3481767ec8db", + "version": "KqlParameterItem/1.0", + "name": "selectedDevices1", + "label": "Device", + "type": 2, + "description": "Filter by device", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| distinct Device\r\n| project value = Device, label = Device, selected = false\r\n| sort by label asc\r\n\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "09c00b1b-cc62-44d9-a244-48ead4ddd23a", + "version": "KqlParameterItem/1.0", + "name": "clusterId", + "type": 1, + "description": "Filter the selected workspace by clusterId", + "isHiddenWhenLocked": true, + "value": "david-aks-engine-test" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "dropdowns" + }, + { + "type": 1, + "content": { + "json": "
" + }, + "name": "text - 21" + }, + { + "type": 1, + "content": { + "json": "

Disk IO Overview

" + }, + "name": "text - 24" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Origin =~ 'container.azm.ms/telegraf'\r\n| where Namespace =~ 'container.azm.ms/diskio'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| extend partitionKey = strcat(NodeDisk, '/', Name)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val, Val - PrevVal)\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, PrevTimeGenerated, HostName, Device, NodeDisk, Name, Rate;\r\nlet bytesRead = data\r\n| where Name == 'read_bytes'\r\n| extend Rate = iif(TimeGenerated == PrevTimeGenerated, 0.0, Rate / datetime_diff('Second', TimeGenerated, PrevTimeGenerated));\r\nlet msPerByteRead = data\r\n| where Name == 'read_bytes'\r\n| extend Rate = iif(Rate < 0, 0.0, (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000) / Rate);\r\nlet bytesWritten = data\r\n| where Name == 'write_bytes'\r\n| extend Rate = iif(TimeGenerated == PrevTimeGenerated, 0.0, Rate / datetime_diff('Second', TimeGenerated, PrevTimeGenerated));\r\nlet msPerByteWritten = data\r\n| where Name == 'write_bytes'\r\n| extend Rate = iif(Rate < 0, 0.0, (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000) / Rate);\r\nlet iopsInFlight = data\r\n| where Name == 'iops_in_progress'\r\n| extend Rate = iif(Rate < 0, 0.0, Rate);\r\nlet diskBusy = data\r\n| where Name == 'io_time'\r\n| extend Rate = iif(TimeGenerated == PrevTimeGenerated, 0.0, Rate/(datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000));\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nlet bytesReadTableData = bytesRead // bytes read per sec \r\n| summarize BytesReadPerSecond = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) by HostName, Device // for devices, group by parentId (HostName) in workbook config\r\n| join kind = inner (\r\n bytesRead\r\n | make-series BytesReadPerSecondTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n) on HostName\r\n| where Device == Device1\r\n| project Id = strcat(HostName, Device), HostName, Device, Name = strcat('🔹 ', Device), ParentId = strcat('🖥️ ', HostName), Kind = 'Device', BytesReadPerSecond, BytesReadPerSecondTrend;\r\nlet bytesWrittenTableData = bytesWritten // bytes witten per sec \r\n| summarize BytesWrittenPerSecond = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) by HostName, Device // for devices\r\n| join kind = inner (\r\n bytesWritten\r\n | make-series BytesWrittenPerSecondTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n) on HostName\r\n| where Device == Device1\r\n| project Id = strcat(HostName, Device), HostName, Device, Name = strcat('🔹 ', Device), ParentId = strcat('🖥️ ', HostName), Kind = 'Device', BytesWrittenPerSecond, BytesWrittenPerSecondTrend;\r\nlet diskBusyTableData = diskBusy // disk busy\r\n| summarize DiskBusy = max(Rate) by HostName, Device // for devices, group by parentId (HostName) in workbook config\r\n| join kind = inner (\r\n diskBusy\r\n | make-series DiskBusyTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n) on HostName\r\n| where Device == Device1\r\n| project Id = strcat(HostName, Device), HostName, Device, Name = strcat('🔹 ', Device), ParentId = strcat('🖥️ ', HostName), Kind = 'Device', DiskBusy, DiskBusyTrend;\r\nlet iopsTableData = iopsInFlight // iops\r\n| summarize IOPS = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) by HostName, Device // for devices, group by parentId (HostName) in workbook config\r\n| join kind = inner (\r\n iopsInFlight\r\n | make-series IOPSTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n) on HostName\r\n| where Device == Device1\r\n| project Id = strcat(HostName, Device), HostName, Device, Name = strcat('🔹 ', Device), ParentId = strcat('🖥️ ', HostName), Kind = 'Device', IOPS, IOPSTrend;\r\nbytesReadTableData\r\n| join kind = inner ( bytesWrittenTableData ) on Id\r\n| join kind = inner ( diskBusyTableData ) on Id\r\n| join kind = inner ( iopsTableData ) on Id\r\n| project-away Id1, Name1, ParentId1, Kind1, Id2, Name2, ParentId2, Kind2, Id3, Name3, ParentId3, Kind3, Device1, Device2, Device3, HostName1, HostName2, HostName3\r\n| project-rename ['Read Bytes/sec'] = BytesReadPerSecond, ['Read Bytes/sec Trend'] = BytesReadPerSecondTrend, ['Write Bytes/sec'] = BytesWrittenPerSecond, ['Write Bytes/sec Trend'] = BytesWrittenPerSecondTrend, ['% Disk Busy'] = DiskBusy, ['% Disk Busy Trend'] = DiskBusyTrend, ['IOPS Trend'] = IOPSTrend\r\n| order by Id asc\r\n| project-rename FullId = Id, GridId = Name, Name = ParentId", + "size": 0, + "exportParameterName": "selectedRow", + "exportDefaultValue": "{\"Kind\":\"Unselected\"}", + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "FullId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "HostName", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Device", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "GridId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Kind", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Read Bytes/sec", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Read Bytes/sec Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Write Bytes/sec", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Write Bytes/sec Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "% Disk Busy", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "percent", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "% Disk Busy Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "IOPS", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "IOPS Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "$gen_group", + "formatter": 0, + "formatOptions": { + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": false, + "showIcon": true, + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/AKS/Node-Disk-IO-Cluster-Context-Pane", + "typeSource": "workbook", + "gallerySource": "workbook" + } + } + } + ], + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Name" + ], + "expandTopLevel": true, + "finalBy": "GridId" + }, + "labelSettings": [] + } + }, + "showPin": true, + "name": "overview-grid" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n
\r\n" + }, + "name": "text - 21" + }, + { + "type": 1, + "content": { + "json": "

Read {unit:label}/sec

" + }, + "customWidth": "50", + "name": "text - 5" + }, + { + "type": 1, + "content": { + "json": "

Write {unit:label}/sec

" + }, + "customWidth": "50", + "name": "text - 5 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesReadPerSec = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'read_bytes'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit}), iif(PrevVal == Val, 0.0, (Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit})))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Device, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nbytesReadPerSec\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "tileSettings": { + "showBorder": false + } + }, + "customWidth": "50", + "showPin": true, + "name": "bytes-read-per-sec" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesWritePerSec = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'write_bytes'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit}), iif(PrevVal == Val, 0.0, (Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit})))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Device, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nbytesWritePerSec\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "bytes-written-per-sec" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 21" + }, + { + "type": 1, + "content": { + "json": "

Total {unit:label} Read ({timeRange:grain} intervals)

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "

Total {unit:label} Written ({timeRange:grain} intervals)

" + }, + "customWidth": "50", + "name": "text - 5 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesReadTotal = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'read_bytes'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / {unit}, iif(PrevVal == Val, 0.0, (Val - PrevVal) / {unit}))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Device, Rate;\r\nlet sum = bytesReadTotal\r\n| make-series Val = sum(Rate) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device;\r\nsum", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "total-bytes-read" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesWrittenTotal = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'write_bytes'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / {unit}, iif(PrevVal == Val, 0.0, (Val - PrevVal) / {unit}))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Device, Rate;\r\nlet sum = bytesWrittenTotal\r\n| make-series Val = sum(Rate) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device;\r\nsum", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "total-bytes-written" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 22" + }, + { + "type": 1, + "content": { + "json": "

Milliseconds Per {unit:label} Read

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "

Milliseconds Per {unit:label} Written

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let msPerByteRead = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'read_bytes'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, pow(Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000 * {unit}), -1), pow((Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000 * {unit}), -1))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Device, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nmsPerByteRead\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "ms-per-bytes-read" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let msPerByteWritten = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'write_bytes'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, pow(Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000 * {unit}), -1), pow((Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000 * {unit}), -1))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Device, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nmsPerByteWritten\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "ms-per-bytes-written" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 23" + }, + { + "type": 1, + "content": { + "json": "

IOPS In Progress

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "

% Disk Busy

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let iops = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'iops_in_progress'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| project TimeGenerated, HostName, Device, Val;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\niops\r\n| make-series Val = iif(avgOn != -1, avg(Val), iif(maxOn != -1, max(Val), min(Val))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "iops-in-progress" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ioTime = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'io_time'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000), (Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000)) * 100\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, NodeDisk, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nioTime\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by NodeDisk\r\n| extend Name = NodeDisk\r\n| project-away NodeDisk", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "disk-busy-percentage" + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/AKS/Workbooks/Node Disk IO AKS Engine/settings.json b/AKS/Workbooks/Node Disk IO AKS Engine/settings.json new file mode 100644 index 0000000..7aad387 --- /dev/null +++ b/AKS/Workbooks/Node Disk IO AKS Engine/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Node Disk IO", + "author": "Microsoft", + "galleries": [ + { "type": "container-insights", "resourceType": "microsoft.operationalinsights/workspaces", "order": 200 } + ] +} diff --git a/AKS/Workbooks/Node Disk IO AKS/Node Disk IO AKS.workbook b/AKS/Workbooks/Node Disk IO AKS/Node Disk IO AKS.workbook new file mode 100644 index 0000000..43cb211 --- /dev/null +++ b/AKS/Workbooks/Node Disk IO AKS/Node Disk IO AKS.workbook @@ -0,0 +1,620 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "_More information about the metrics in this workbook is available here_" + }, + "name": "text - 18" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e2b5cd30-7276-477f-a6bb-07da25ba5e5f", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter data by time range", + "isRequired": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "value": { + "durationMs": 21600000 + } + }, + { + "id": "4c9a0f80-fa3e-44af-8f0d-6744ecf503c6", + "version": "KqlParameterItem/1.0", + "name": "unit", + "label": "Unit", + "type": 2, + "description": "The units to use for the data", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"label\": \"Bytes\", \"value\": \"1\", \"selected\": \"true\" },\r\n { \"label\": \"Kilobytes\", \"value\": \"1000\", \"selected\": \"false\" },\r\n { \"label\": \"Megabytes\", \"value\": \"1000000\", \"selected\": \"false\" },\r\n { \"label\": \"Gigabytes\", \"value\": \"1000000000\", \"selected\": \"false\" }\r\n]" + }, + { + "id": "164c1cb5-5587-47de-994b-4b3251526f73", + "version": "KqlParameterItem/1.0", + "name": "aggregation1", + "label": "Aggregation", + "type": 2, + "description": "Choose which data aggregation you want to visualize on the time chart", + "value": "Average", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"label\": \"Max\", \"value\": \"Max\" },\r\n { \"label\": \"Average\", \"value\": \"Average\" },\r\n { \"label\": \"Min\", \"value\": \"Min\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange" + }, + { + "id": "f126ca9e-5dbb-4b5c-89bd-7568f9b75367", + "version": "KqlParameterItem/1.0", + "name": "selectedNodes1", + "label": "Node", + "type": 2, + "description": "Filter by node", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName)\r\n| distinct HostName\r\n| sort by HostName asc\r\n\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + { + "id": "c8a9d7cf-eb5c-4bfb-a4ab-3481767ec8db", + "version": "KqlParameterItem/1.0", + "name": "selectedDevices1", + "label": "Device", + "type": 2, + "description": "Filter by device", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| distinct Device\r\n| project value = Device, label = Device, selected = false\r\n| sort by label asc\r\n\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + "name": "dropdowns" + }, + { + "type": 1, + "content": { + "json": "
" + }, + "name": "text - 21" + }, + { + "type": 1, + "content": { + "json": "

Disk IO Overview

" + }, + "name": "text - 24" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| extend partitionKey = strcat(NodeDisk, '/', Name)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val, Val - PrevVal)\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, PrevTimeGenerated, HostName, Device, NodeDisk, Name, Rate, Val;\r\nlet bytesRead = data\r\n| where Name == 'read_bytes'\r\n| extend Rate = Rate / datetime_diff('Second', TimeGenerated, PrevTimeGenerated);\r\nlet msPerByteRead = data\r\n| where Name == 'read_bytes'\r\n| extend Rate = (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000) / Rate;\r\nlet bytesWritten = data\r\n| where Name == 'write_bytes'\r\n| extend Rate = Rate / datetime_diff('Second', TimeGenerated, PrevTimeGenerated);\r\nlet msPerByteWritten = data\r\n| where Name == 'write_bytes'\r\n| extend Rate = (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000) / Rate;\r\nlet iopsInFlight = data\r\n| where Name == 'iops_in_progress'\r\n| extend Rate = Val;\r\nlet diskBusy = data\r\n| where Name == 'io_time'\r\n| extend Rate = iif(TimeGenerated == PrevTimeGenerated, 0.0, Rate / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000));\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nlet bytesReadTableData = bytesRead // bytes read per sec \r\n| summarize BytesReadPerSecond = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) by HostName, Device // for devices, group by parentId (HostName) in workbook config\r\n| join kind = inner (\r\n bytesRead\r\n | make-series BytesReadPerSecondTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n) on HostName\r\n| where Device == Device1\r\n| project Id = strcat(HostName, Device), HostName, Device, Name = strcat('🔹 ', Device), ParentId = strcat('🖥️ ', HostName), Kind = 'Device', BytesReadPerSecond, BytesReadPerSecondTrend;\r\nlet bytesWrittenTableData = bytesWritten // bytes witten per sec \r\n| summarize BytesWrittenPerSecond = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) by HostName, Device // for devices\r\n| join kind = inner (\r\n bytesWritten\r\n | make-series BytesWrittenPerSecondTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n) on HostName\r\n| where Device == Device1\r\n| project Id = strcat(HostName, Device), HostName, Device, Name = strcat('🔹 ', Device), ParentId = strcat('🖥️ ', HostName), Kind = 'Device', BytesWrittenPerSecond, BytesWrittenPerSecondTrend;\r\nlet diskBusyTableData = diskBusy // disk busy\r\n| summarize DiskBusy = max(Rate) by HostName, Device // for devices, group by parentId (HostName) in workbook config\r\n| join kind = inner (\r\n diskBusy\r\n | make-series DiskBusyTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n) on HostName\r\n| where Device == Device1\r\n| project Id = strcat(HostName, Device), HostName, Device, Name = strcat('🔹 ', Device), ParentId = strcat('🖥️ ', HostName), Kind = 'Device', DiskBusy, DiskBusyTrend;\r\nlet iopsTableData = iopsInFlight // iops\r\n| summarize IOPS = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) by HostName, Device // for devices, group by parentId (HostName) in workbook config\r\n| join kind = inner (\r\n iopsInFlight\r\n | make-series IOPSTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n) on HostName\r\n| where Device == Device1\r\n| project Id = strcat(HostName, Device), HostName, Device, Name = strcat('🔹 ', Device), ParentId = strcat('🖥️ ', HostName), Kind = 'Device', IOPS, IOPSTrend;\r\nbytesReadTableData\r\n| join kind = inner ( bytesWrittenTableData ) on Id\r\n| join kind = inner ( diskBusyTableData ) on Id\r\n| join kind = inner ( iopsTableData ) on Id\r\n| project-away Id1, Name1, ParentId1, Kind1, Id2, Name2, ParentId2, Kind2, Id3, Name3, ParentId3, Kind3, Device1, Device2, Device3, HostName1, HostName2, HostName3\r\n| project-rename ['Read Bytes/sec'] = BytesReadPerSecond, ['Read Bytes/sec Trend'] = BytesReadPerSecondTrend, ['Write Bytes/sec'] = BytesWrittenPerSecond, ['Write Bytes/sec Trend'] = BytesWrittenPerSecondTrend, ['% Disk Busy'] = DiskBusy, ['% Disk Busy Trend'] = DiskBusyTrend, ['IOPS Trend'] = IOPSTrend\r\n| order by Id asc\r\n| project-rename FullId = Id, GridId = Name, Name = ParentId", + "size": 0, + "exportParameterName": "selectedRow", + "exportDefaultValue": "{\"Kind\":\"Unselected\"}", + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "FullId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "HostName", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Device", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "GridId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Kind", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Read Bytes/sec", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Read Bytes/sec Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Write Bytes/sec", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Write Bytes/sec Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "% Disk Busy", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "percent", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "% Disk Busy Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "IOPS", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "IOPS Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "$gen_group", + "formatter": 0, + "formatOptions": { + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": false, + "showIcon": true, + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/AKS/Node-Disk-IO-Cluster-Context-Pane", + "typeSource": "workbook", + "gallerySource": "workbook" + } + } + } + ], + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Name" + ], + "expandTopLevel": true, + "finalBy": "GridId" + }, + "labelSettings": [] + } + }, + "showPin": true, + "name": "overview-grid" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n
\r\n" + }, + "name": "text - 21" + }, + { + "type": 1, + "content": { + "json": "

Read {unit:label}/sec

" + }, + "customWidth": "50", + "name": "text - 5" + }, + { + "type": 1, + "content": { + "json": "

Write {unit:label}/sec

" + }, + "customWidth": "50", + "name": "text - 5 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesReadPerSec = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'read_bytes'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit}), iif(PrevVal == Val, 0.0, (Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit})))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Device, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nbytesReadPerSec\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart", + "tileSettings": { + "showBorder": false + } + }, + "customWidth": "50", + "showPin": true, + "name": "bytes-read-per-sec" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesWritePerSec = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'write_bytes'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit}), iif(PrevVal == Val, 0.0, (Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit})))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Device, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nbytesWritePerSec\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "bytes-written-per-sec" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 21" + }, + { + "type": 1, + "content": { + "json": "

Total {unit:label} Read ({timeRange:grain} intervals)

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "

Total {unit:label} Written ({timeRange:grain} intervals)

" + }, + "customWidth": "50", + "name": "text - 5 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesReadTotal = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'read_bytes'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / {unit}, iif(PrevVal == Val, 0.0, (Val - PrevVal) / {unit}))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Device, Rate;\r\nlet sum = bytesReadTotal\r\n| make-series Val = sum(Rate) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device;\r\nsum", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "total-bytes-read" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesWrittenTotal = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'write_bytes'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / {unit}, iif(PrevVal == Val, 0.0, (Val - PrevVal) / {unit}))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Device, Rate;\r\nlet sum = bytesWrittenTotal\r\n| make-series Val = sum(Rate) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device;\r\nsum", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "total-bytes-written" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 22" + }, + { + "type": 1, + "content": { + "json": "

Milliseconds Per {unit:label} Read

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "

Milliseconds Per {unit:label} Written

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let msPerByteRead = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'read_bytes'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, pow(Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000 * {unit}), -1), pow((Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000 * {unit}), -1))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Device, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nmsPerByteRead\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "ms-per-bytes-read" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let msPerByteWritten = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'write_bytes'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(TimeGenerated == PrevTimeGenerated or (Val - PrevVal) == 0, 0.0, iif(PrevVal > Val, pow(Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000 * {unit}), -1), pow((Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000 * {unit}), -1)))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Device, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nmsPerByteWritten\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "ms-per-bytes-written" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 23" + }, + { + "type": 1, + "content": { + "json": "

IOPS In Progress

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "

% Disk Busy

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let iops = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'iops_in_progress'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| project TimeGenerated, HostName, Device, Val;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\niops\r\n| make-series Val = iif(avgOn != -1, avg(Val), iif(maxOn != -1, max(Val), min(Val))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Device\r\n| extend Name = strcat(HostName, Device)\r\n| project-away HostName, Device", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "iops-in-progress" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ioTime = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/diskio'\r\n| where Name == 'io_time'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Device = strcat('/dev/', tostring(Tags.name))\r\n| extend NodeDisk = strcat(HostName, Device)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedDevices1}) or Device in ({selectedDevices1})\r\n| order by NodeDisk asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(NodeDisk) != NodeDisk, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(NodeDisk) != NodeDisk, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000), (Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * 1000)) * 100\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, NodeDisk, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nioTime\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by NodeDisk\r\n| extend Name = NodeDisk\r\n| project-away NodeDisk", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "disk-busy-percentage" + } + ], + "fallbackResourceIds": [], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/AKS/Workbooks/Node Disk IO AKS/settings.json b/AKS/Workbooks/Node Disk IO AKS/settings.json new file mode 100644 index 0000000..11fb802 --- /dev/null +++ b/AKS/Workbooks/Node Disk IO AKS/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Node Disk IO", + "author": "Microsoft", + "galleries": [ + { "type": "container-insights", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 200 }, + { "type": "workbook", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 200 } + ] +} diff --git a/AKS/Workbooks/Node GPU AKS Engine/Node GPU AKS Engine.workbook b/AKS/Workbooks/Node GPU AKS Engine/Node GPU AKS Engine.workbook new file mode 100644 index 0000000..65f67cf --- /dev/null +++ b/AKS/Workbooks/Node GPU AKS Engine/Node GPU AKS Engine.workbook @@ -0,0 +1,587 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5de17819-f869-4a42-9c3d-27cf8f9085f0", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter data by time range", + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "bb8ed6dc-807e-4566-be76-26ac6ee7f90f", + "version": "KqlParameterItem/1.0", + "name": "selectedNodes", + "label": "GPU Node", + "type": 2, + "description": "Filter by GPU node", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics \r\n| where Name == \"nodeGpuAllocatable\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where Val > 0\r\n| distinct Computer", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "e57ba893-b9ba-47b9-95d5-38bc7be4a455", + "version": "KqlParameterItem/1.0", + "name": "clusterId", + "type": 1, + "description": "Filter the selected workspace by cluster id", + "isHiddenWhenLocked": true + }, + { + "id": "51f0a81e-6eef-4129-b8a4-dc7dd4114aff", + "version": "KqlParameterItem/1.0", + "name": "clusterIdWhereClause", + "type": 1, + "description": "use this to filter by clusterid ", + "value": "| where \"a\" == \"a\"", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (clusterId is not empty ), result = '| where clusterId =~ \"{clusterId}\"'", + "criteriaContext": { + "leftOperand": "clusterId", + "operator": "isNotNull", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where clusterId =~ \"{clusterId}\"" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union\r\n(InsightsMetrics \r\n| where Name == \"nodeGpuAllocatable\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| where Val > 0\r\n//add cluster filter\r\n| summarize GPUsPerComputer=arg_max(Val,*) by Computer, bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['Total GPUs'] = toint(sum(GPUsPerComputer)) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} \r\n),\r\n(\r\nInsightsMetrics \r\n| where Name == \"containerGpuDutyCycle\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| where Val > 0\r\n| extend gpuId = tostring(Tags.gpuId)\r\n| summarize count() by bin(TimeGenerated, {timeRange:grain}), gpuId\r\n| make-series ['Busy GPUs'] = count() default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} \r\n)", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Usage", + "color": "turquoise", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "gpuVendor", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "gpuCount", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "gpuVendor", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "gpuCount", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "showLegend": true, + "seriesLabelSettings": [ + { + "seriesName": "Busy Gpus", + "color": "redBright" + } + ], + "xSettings": { + "unit": 17, + "min": null, + "max": null + }, + "ySettings": { + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-Usage", + "styleSettings": { + "maxWidth": "50", + "progressStyle": "loader", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union\r\n(InsightsMetrics \r\n| where Name == \"containerGpumemoryTotalBytes\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n//| extend tags=parse_json(Tags) \r\n| extend gpuVendor=tostring(Tags.gpuVendor)\r\n| extend gpuId = tostring(Tags.gpuId)\r\n| extend gpuModel = tostring(Tags.gpuModel)\r\n| extend gpu=strcat(gpuVendor, \"/\", gpuModel)\r\n| summarize GpuMemoryBytes=max(Val) by bin(TimeGenerated, {timeRange:grain}), gpu, gpuId, Computer//, metricname\r\n| make-series ['Total-GPUMemory'] = sum(GpuMemoryBytes) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} //by status\r\n),\r\n(InsightsMetrics \r\n| where Name == \"containerGpumemoryUsedBytes\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| make-series ['Max-Used'] = max(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain}\r\n),\r\n(InsightsMetrics \r\n| where Name == \"containerGpumemoryUsedBytes\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| make-series ['95th-ptile-Used'] = percentile(Val,95) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain}\r\n),\r\n(InsightsMetrics \r\n| where Name == \"containerGpumemoryUsedBytes\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| make-series ['99th-ptile-Used'] = percentile(Val,99) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain}\r\n)\r\n", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Memory Usage", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart", + "chartSettings": { + "showLegend": true, + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-MemoryUsage", + "styleSettings": { + "maxWidth": "50", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let im = InsightsMetrics\r\n| where Name == \"nodeGpuAllocatable\"\r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| where Val >= 1\r\n| distinct Computer;\r\nKubeNodeInventory\r\n| extend clusterId = ClusterId\r\n{clusterIdWhereClause}\r\n| where Computer in (im)\r\n| extend status=iif(strlen(Status) == 0 ,\"Unknown\", Status)\r\n| summarize count() by Computer, status, bin(TimeGenerated, {timeRange:grain})\r\n| summarize val=count() by status, bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['Node Count by status'] = sum(val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by status\r\n\r\n", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Node Count by Node Status", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart", + "tileSettings": { + "titleContent": { + "columnMatch": "status", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Node Count by State", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false + }, + "chartSettings": { + "showLegend": true, + "seriesLabelSettings": [ + { + "seriesName": "Ready", + "color": "green" + }, + { + "seriesName": "Unknown", + "color": "blue" + } + ], + "ySettings": { + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-NodeCountByNodeStatus", + "styleSettings": { + "maxWidth": "50", + "progressStyle": "loader", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let im = InsightsMetrics\r\n| where Name in (\"containerGpuRequests\", \"containerGpuLimits\")\r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| extend selectedNodes = {selectedNodes}\r\n| extend nodeList = iif(selectedNodes == \"*\", \",*\", selectedNodes) \r\n| where '*' in (selectedNodes) or Computer in (selectedNodes)\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n//| extend tags=parse_json(Tags)\r\n| extend containerName = tostring(Tags.containerName)\r\n| extend poduidArray = split(containerName, \"/\")\r\n| extend podUid = iif(array_length(poduidArray) == 2, poduidArray[0], \"\")\r\n| where Val >= 1\r\n| where podUid != \"\"\r\n| distinct podUid;\r\nKubePodInventory\r\n| where PodUid in (im)\r\n| extend clusterId = ClusterId\r\n{clusterIdWhereClause}\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| extend selectedNodes = {selectedNodes}\r\n| extend nodeList = iif(selectedNodes == \"*\", \",*\", selectedNodes) \r\n| where '*' in (selectedNodes) or Computer in (selectedNodes)\r\n| summarize count() by PodUid, PodStatus, bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['GPU Pod Count by status'] = count() default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by PodStatus", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Pod Count by Pod Status", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "chartSettings": { + "showLegend": true, + "seriesLabelSettings": [ + { + "seriesName": "Succeeded", + "color": "greenDark" + }, + { + "seriesName": "Running", + "color": "green" + } + ], + "ySettings": { + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-PodCountByPodStatus", + "styleSettings": { + "maxWidth": "50", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let im = InsightsMetrics\r\n| where Name in (\"containerGpuRequests\", \"containerGpuLimits\")\r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| extend selectedNodes = {selectedNodes}\r\n| extend nodeList = iif(selectedNodes == \"*\", \",*\", selectedNodes)\r\n| where '*' in (selectedNodes) or Computer in (selectedNodes)\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n//| extend tags=parse_json(Tags)\r\n| extend containerName = tostring(Tags.containerName)\r\n| extend poduidArray = split(containerName, \"/\")\r\n| extend podUid = iif(array_length(poduidArray) == 2, poduidArray[0], \"\")\r\n| where Val >= 1\r\n| where podUid != \"\"\r\n| distinct podUid;\r\nKubePodInventory\r\n| where PodUid in (im)\r\n| extend clusterId = ClusterId\r\n{clusterIdWhereClause}\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| summarize count() by PodUid, Namespace, PodStatus, bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['GPU Pods by namespace'] = count() default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by Namespace, PodStatus\r\n", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Pod Count by Kubernetes Namespace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart", + "tileSettings": { + "titleContent": { + "columnMatch": "Namespace", + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "PodStatus", + "formatOptions": { + "showIcon": true + } + }, + "rightContent": { + "columnMatch": "GPU Pods by namespace", + "formatter": 10, + "formatOptions": { + "palette": "red", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "hello {0}" + } + }, + "showBorder": false, + "sortCriteriaField": "Namespace" + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "Namespace", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "PodStatus", + "formatOptions": { + "showIcon": true + } + }, + "centerContent": { + "columnMatch": "podcount", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "nodeIdField": "Namespace", + "nodeSize": null, + "staticNodeSize": 100, + "colorSettings": null, + "hivesMargin": 5 + }, + "chartSettings": { + "showLegend": true, + "ySettings": { + "unit": 17, + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-PodCountByK8SNamespace", + "styleSettings": { + "maxWidth": "50", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics \r\n| where Name == \"nodeGpuAllocatable\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| extend gpuVendor=strcat ('🔹 ',tostring(Tags.gpuVendor))\r\n| summarize gpuCountPerComputer=max(Val) by gpuVendor, Computer , bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['GPU count by make'] =sum(gpuCountPerComputer) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by gpuVendor\r\n\r\n\r\n\r\n\r\n\r\n\r\n", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Count by Make", + "color": "blue", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "gpuVendor", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "GPU count by make", + "formatter": 10, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + }, + "tooltipFormat": { + "tooltip": "{0}" + } + }, + { + "columnMatch": "TimeGenerated", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "labelSettings": [ + { + "columnId": "gpuVendor", + "label": "Make", + "comment": "" + }, + { + "columnId": "GPU count by make", + "label": "Count" + }, + { + "columnId": "TimeGenerated" + } + ] + }, + "tileSettings": { + "titleContent": { + "columnMatch": "gpuVendor", + "formatOptions": { + "showIcon": true + } + }, + "rightContent": { + "columnMatch": "GPU count by make", + "formatter": 10, + "formatOptions": { + "palette": "blue", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "{0}" + } + }, + "showBorder": true, + "sortCriteriaField": "TimeGenerated", + "sortOrderField": 1 + }, + "chartSettings": { + "ySettings": { + "unit": 17, + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-GpuCountByMake", + "styleSettings": { + "maxWidth": "50", + "progressStyle": "loader", + "showBorder": true + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [] + }, + "name": "links - 7" + } + ], + "fallbackResourceIds": [], + "styleSettings": { + "progressStyle": "loader" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/AKS/Workbooks/Node GPU AKS Engine/settings.json b/AKS/Workbooks/Node GPU AKS Engine/settings.json new file mode 100644 index 0000000..b2d5a98 --- /dev/null +++ b/AKS/Workbooks/Node GPU AKS Engine/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Node GPU", + "author": "Microsoft", + "galleries": [ + { "type": "container-insights", "resourceType": "microsoft.operationalinsights/workspaces", "order": 500 } + ] +} diff --git a/AKS/Workbooks/Node GPU AKS/Node GPU AKS.workbook b/AKS/Workbooks/Node GPU AKS/Node GPU AKS.workbook new file mode 100644 index 0000000..384515f --- /dev/null +++ b/AKS/Workbooks/Node GPU AKS/Node GPU AKS.workbook @@ -0,0 +1,587 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5de17819-f869-4a42-9c3d-27cf8f9085f0", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter data by time range", + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "bb8ed6dc-807e-4566-be76-26ac6ee7f90f", + "version": "KqlParameterItem/1.0", + "name": "selectedNodes", + "label": "GPU Node", + "type": 2, + "description": "Filter by GPU node", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics \r\n| where Name == \"nodeGpuAllocatable\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where Val > 0\r\n| distinct Computer", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + { + "id": "e57ba893-b9ba-47b9-95d5-38bc7be4a455", + "version": "KqlParameterItem/1.0", + "name": "clusterId", + "type": 1, + "description": "Filter the selected workspace by cluster id", + "isHiddenWhenLocked": true + }, + { + "id": "51f0a81e-6eef-4129-b8a4-dc7dd4114aff", + "version": "KqlParameterItem/1.0", + "name": "clusterIdWhereClause", + "type": 1, + "description": "use this to filter by clusterid ", + "value": "| where \"a\" == \"a\"", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (clusterId is not empty ), result = '| where clusterId =~ \"{clusterId}\"'", + "criteriaContext": { + "leftOperand": "clusterId", + "operator": "isNotNull", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where clusterId =~ \"{clusterId}\"" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + "name": "parameters - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union\r\n(InsightsMetrics \r\n| where Name == \"nodeGpuAllocatable\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| where Val > 0\r\n//add cluster filter\r\n| summarize GPUsPerComputer=arg_max(Val,*) by Computer, bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['Total GPUs'] = toint(sum(GPUsPerComputer)) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} \r\n),\r\n(\r\nInsightsMetrics \r\n| where Name == \"containerGpuDutyCycle\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| where Val > 0\r\n| extend gpuId = tostring(Tags.gpuId)\r\n| summarize count() by bin(TimeGenerated, {timeRange:grain}), gpuId\r\n| make-series ['Busy GPUs'] = count() default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} \r\n)", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Usage", + "color": "turquoise", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "gpuVendor", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "gpuCount", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "gpuVendor", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "gpuCount", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "showLegend": true, + "seriesLabelSettings": [ + { + "seriesName": "Busy Gpus", + "color": "redBright" + } + ], + "xSettings": { + "unit": 17, + "min": null, + "max": null + }, + "ySettings": { + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-Usage", + "styleSettings": { + "maxWidth": "50", + "progressStyle": "loader", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union\r\n(InsightsMetrics \r\n| where Name == \"containerGpumemoryTotalBytes\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n//| extend tags=parse_json(Tags) \r\n| extend gpuVendor=tostring(Tags.gpuVendor)\r\n| extend gpuId = tostring(Tags.gpuId)\r\n| extend gpuModel = tostring(Tags.gpuModel)\r\n| extend gpu=strcat(gpuVendor, \"/\", gpuModel)\r\n| summarize GpuMemoryBytes=max(Val) by bin(TimeGenerated, {timeRange:grain}), gpu, gpuId, Computer//, metricname\r\n| make-series ['Total-GPUMemory'] = sum(GpuMemoryBytes) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} //by status\r\n),\r\n(InsightsMetrics \r\n| where Name == \"containerGpumemoryUsedBytes\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| make-series ['Max-Used'] = max(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain}\r\n),\r\n(InsightsMetrics \r\n| where Name == \"containerGpumemoryUsedBytes\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| make-series ['95th-ptile-Used'] = percentile(Val,95) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain}\r\n),\r\n(InsightsMetrics \r\n| where Name == \"containerGpumemoryUsedBytes\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| make-series ['99th-ptile-Used'] = percentile(Val,99) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain}\r\n)\r\n", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Memory Usage", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "linechart", + "chartSettings": { + "showLegend": true, + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-MemoryUsage", + "styleSettings": { + "maxWidth": "50", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let im = InsightsMetrics\r\n| where Name == \"nodeGpuAllocatable\"\r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| where Val >= 1\r\n| distinct Computer;\r\nKubeNodeInventory\r\n| extend clusterId = ClusterId\r\n{clusterIdWhereClause}\r\n| where Computer in (im)\r\n| extend status=iif(strlen(Status) == 0 ,\"Unknown\", Status)\r\n| summarize count() by Computer, status, bin(TimeGenerated, {timeRange:grain})\r\n| summarize val=count() by status, bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['Node Count by status'] = sum(val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by status\r\n\r\n", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Node Count by Node Status", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "linechart", + "tileSettings": { + "titleContent": { + "columnMatch": "status", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Node Count by State", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false + }, + "chartSettings": { + "showLegend": true, + "seriesLabelSettings": [ + { + "seriesName": "Ready", + "color": "green" + }, + { + "seriesName": "Unknown", + "color": "blue" + } + ], + "ySettings": { + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-NodeCountByNodeStatus", + "styleSettings": { + "maxWidth": "50", + "progressStyle": "loader", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let im = InsightsMetrics\r\n| where Name in (\"containerGpuRequests\", \"containerGpuLimits\")\r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| extend selectedNodes = {selectedNodes}\r\n| extend nodeList = iif(selectedNodes == \"*\", \",*\", selectedNodes) \r\n| where '*' in (selectedNodes) or Computer in (selectedNodes)\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n//| extend tags=parse_json(Tags)\r\n| extend containerName = tostring(Tags.containerName)\r\n| extend poduidArray = split(containerName, \"/\")\r\n| extend podUid = iif(array_length(poduidArray) == 2, poduidArray[0], \"\")\r\n| where Val >= 1\r\n| where podUid != \"\"\r\n| distinct podUid;\r\nKubePodInventory\r\n| where PodUid in (im)\r\n| extend clusterId = ClusterId\r\n{clusterIdWhereClause}\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| extend selectedNodes = {selectedNodes}\r\n| extend nodeList = iif(selectedNodes == \"*\", \",*\", selectedNodes) \r\n| where '*' in (selectedNodes) or Computer in (selectedNodes)\r\n| summarize count() by PodUid, PodStatus, bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['GPU Pod Count by status'] = count() default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by PodStatus", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Pod Count by Pod Status", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart", + "chartSettings": { + "showLegend": true, + "seriesLabelSettings": [ + { + "seriesName": "Succeeded", + "color": "greenDark" + }, + { + "seriesName": "Running", + "color": "green" + } + ], + "ySettings": { + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-PodCountByPodStatus", + "styleSettings": { + "maxWidth": "50", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let im = InsightsMetrics\r\n| where Name in (\"containerGpuRequests\", \"containerGpuLimits\")\r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| extend selectedNodes = {selectedNodes}\r\n| extend nodeList = iif(selectedNodes == \"*\", \",*\", selectedNodes)\r\n| where '*' in (selectedNodes) or Computer in (selectedNodes)\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n//| extend tags=parse_json(Tags)\r\n| extend containerName = tostring(Tags.containerName)\r\n| extend poduidArray = split(containerName, \"/\")\r\n| extend podUid = iif(array_length(poduidArray) == 2, poduidArray[0], \"\")\r\n| where Val >= 1\r\n| where podUid != \"\"\r\n| distinct podUid;\r\nKubePodInventory\r\n| where PodUid in (im)\r\n| extend clusterId = ClusterId\r\n{clusterIdWhereClause}\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| summarize count() by PodUid, Namespace, PodStatus, bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['GPU Pods by namespace'] = count() default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by Namespace, PodStatus\r\n", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Pod Count by Kubernetes Namespace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "linechart", + "tileSettings": { + "titleContent": { + "columnMatch": "Namespace", + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "PodStatus", + "formatOptions": { + "showIcon": true + } + }, + "rightContent": { + "columnMatch": "GPU Pods by namespace", + "formatter": 10, + "formatOptions": { + "palette": "red", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "hello {0}" + } + }, + "showBorder": false, + "sortCriteriaField": "Namespace" + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "Namespace", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "PodStatus", + "formatOptions": { + "showIcon": true + } + }, + "centerContent": { + "columnMatch": "podcount", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "nodeIdField": "Namespace", + "nodeSize": null, + "staticNodeSize": 100, + "colorSettings": null, + "hivesMargin": 5 + }, + "chartSettings": { + "showLegend": true, + "ySettings": { + "unit": 17, + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-PodCountByK8SNamespace", + "styleSettings": { + "maxWidth": "50", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics \r\n| where Name == \"nodeGpuAllocatable\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| extend gpuVendor=strcat ('🔹 ',tostring(Tags.gpuVendor))\r\n| summarize gpuCountPerComputer=max(Val) by gpuVendor, Computer , bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['GPU count by make'] =sum(gpuCountPerComputer) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by gpuVendor\r\n\r\n\r\n\r\n\r\n\r\n\r\n", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Count by Make", + "color": "blue", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "gpuVendor", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "GPU count by make", + "formatter": 10, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + }, + "tooltipFormat": { + "tooltip": "{0}" + } + }, + { + "columnMatch": "TimeGenerated", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "labelSettings": [ + { + "columnId": "gpuVendor", + "label": "Make", + "comment": "" + }, + { + "columnId": "GPU count by make", + "label": "Count" + }, + { + "columnId": "TimeGenerated" + } + ] + }, + "tileSettings": { + "titleContent": { + "columnMatch": "gpuVendor", + "formatOptions": { + "showIcon": true + } + }, + "rightContent": { + "columnMatch": "GPU count by make", + "formatter": 10, + "formatOptions": { + "palette": "blue", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "{0}" + } + }, + "showBorder": true, + "sortCriteriaField": "TimeGenerated", + "sortOrderField": 1 + }, + "chartSettings": { + "ySettings": { + "unit": 17, + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-GpuCountByMake", + "styleSettings": { + "maxWidth": "50", + "progressStyle": "loader", + "showBorder": true + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [] + }, + "name": "links - 7" + } + ], + "fallbackResourceIds": [], + "styleSettings": { + "progressStyle": "loader" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/AKS/Workbooks/Node GPU AKS/settings.json b/AKS/Workbooks/Node GPU AKS/settings.json new file mode 100644 index 0000000..e5f1749 --- /dev/null +++ b/AKS/Workbooks/Node GPU AKS/settings.json @@ -0,0 +1,10 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Node GPU", + "author": "Microsoft", + "isPreview": "true", + "galleries": [ + { "type": "container-insights", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 500 }, + { "type": "workbook", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 500 } + ] +} diff --git a/AKS/Workbooks/Node GPU/Node GPU.workbook b/AKS/Workbooks/Node GPU/Node GPU.workbook new file mode 100644 index 0000000..384515f --- /dev/null +++ b/AKS/Workbooks/Node GPU/Node GPU.workbook @@ -0,0 +1,587 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5de17819-f869-4a42-9c3d-27cf8f9085f0", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter data by time range", + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "bb8ed6dc-807e-4566-be76-26ac6ee7f90f", + "version": "KqlParameterItem/1.0", + "name": "selectedNodes", + "label": "GPU Node", + "type": 2, + "description": "Filter by GPU node", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics \r\n| where Name == \"nodeGpuAllocatable\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where Val > 0\r\n| distinct Computer", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + { + "id": "e57ba893-b9ba-47b9-95d5-38bc7be4a455", + "version": "KqlParameterItem/1.0", + "name": "clusterId", + "type": 1, + "description": "Filter the selected workspace by cluster id", + "isHiddenWhenLocked": true + }, + { + "id": "51f0a81e-6eef-4129-b8a4-dc7dd4114aff", + "version": "KqlParameterItem/1.0", + "name": "clusterIdWhereClause", + "type": 1, + "description": "use this to filter by clusterid ", + "value": "| where \"a\" == \"a\"", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (clusterId is not empty ), result = '| where clusterId =~ \"{clusterId}\"'", + "criteriaContext": { + "leftOperand": "clusterId", + "operator": "isNotNull", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where clusterId =~ \"{clusterId}\"" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + "name": "parameters - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union\r\n(InsightsMetrics \r\n| where Name == \"nodeGpuAllocatable\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| where Val > 0\r\n//add cluster filter\r\n| summarize GPUsPerComputer=arg_max(Val,*) by Computer, bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['Total GPUs'] = toint(sum(GPUsPerComputer)) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} \r\n),\r\n(\r\nInsightsMetrics \r\n| where Name == \"containerGpuDutyCycle\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| where Val > 0\r\n| extend gpuId = tostring(Tags.gpuId)\r\n| summarize count() by bin(TimeGenerated, {timeRange:grain}), gpuId\r\n| make-series ['Busy GPUs'] = count() default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} \r\n)", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Usage", + "color": "turquoise", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "gpuVendor", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "gpuCount", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "gpuVendor", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "gpuCount", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "showLegend": true, + "seriesLabelSettings": [ + { + "seriesName": "Busy Gpus", + "color": "redBright" + } + ], + "xSettings": { + "unit": 17, + "min": null, + "max": null + }, + "ySettings": { + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-Usage", + "styleSettings": { + "maxWidth": "50", + "progressStyle": "loader", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union\r\n(InsightsMetrics \r\n| where Name == \"containerGpumemoryTotalBytes\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n//| extend tags=parse_json(Tags) \r\n| extend gpuVendor=tostring(Tags.gpuVendor)\r\n| extend gpuId = tostring(Tags.gpuId)\r\n| extend gpuModel = tostring(Tags.gpuModel)\r\n| extend gpu=strcat(gpuVendor, \"/\", gpuModel)\r\n| summarize GpuMemoryBytes=max(Val) by bin(TimeGenerated, {timeRange:grain}), gpu, gpuId, Computer//, metricname\r\n| make-series ['Total-GPUMemory'] = sum(GpuMemoryBytes) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} //by status\r\n),\r\n(InsightsMetrics \r\n| where Name == \"containerGpumemoryUsedBytes\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| make-series ['Max-Used'] = max(Val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain}\r\n),\r\n(InsightsMetrics \r\n| where Name == \"containerGpumemoryUsedBytes\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| make-series ['95th-ptile-Used'] = percentile(Val,95) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain}\r\n),\r\n(InsightsMetrics \r\n| where Name == \"containerGpumemoryUsedBytes\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| make-series ['99th-ptile-Used'] = percentile(Val,99) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain}\r\n)\r\n", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Memory Usage", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "linechart", + "chartSettings": { + "showLegend": true, + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-MemoryUsage", + "styleSettings": { + "maxWidth": "50", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let im = InsightsMetrics\r\n| where Name == \"nodeGpuAllocatable\"\r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| where Val >= 1\r\n| distinct Computer;\r\nKubeNodeInventory\r\n| extend clusterId = ClusterId\r\n{clusterIdWhereClause}\r\n| where Computer in (im)\r\n| extend status=iif(strlen(Status) == 0 ,\"Unknown\", Status)\r\n| summarize count() by Computer, status, bin(TimeGenerated, {timeRange:grain})\r\n| summarize val=count() by status, bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['Node Count by status'] = sum(val) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by status\r\n\r\n", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Node Count by Node Status", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "linechart", + "tileSettings": { + "titleContent": { + "columnMatch": "status", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Node Count by State", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false + }, + "chartSettings": { + "showLegend": true, + "seriesLabelSettings": [ + { + "seriesName": "Ready", + "color": "green" + }, + { + "seriesName": "Unknown", + "color": "blue" + } + ], + "ySettings": { + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-NodeCountByNodeStatus", + "styleSettings": { + "maxWidth": "50", + "progressStyle": "loader", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let im = InsightsMetrics\r\n| where Name in (\"containerGpuRequests\", \"containerGpuLimits\")\r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| extend selectedNodes = {selectedNodes}\r\n| extend nodeList = iif(selectedNodes == \"*\", \",*\", selectedNodes) \r\n| where '*' in (selectedNodes) or Computer in (selectedNodes)\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n//| extend tags=parse_json(Tags)\r\n| extend containerName = tostring(Tags.containerName)\r\n| extend poduidArray = split(containerName, \"/\")\r\n| extend podUid = iif(array_length(poduidArray) == 2, poduidArray[0], \"\")\r\n| where Val >= 1\r\n| where podUid != \"\"\r\n| distinct podUid;\r\nKubePodInventory\r\n| where PodUid in (im)\r\n| extend clusterId = ClusterId\r\n{clusterIdWhereClause}\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| extend selectedNodes = {selectedNodes}\r\n| extend nodeList = iif(selectedNodes == \"*\", \",*\", selectedNodes) \r\n| where '*' in (selectedNodes) or Computer in (selectedNodes)\r\n| summarize count() by PodUid, PodStatus, bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['GPU Pod Count by status'] = count() default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by PodStatus", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Pod Count by Pod Status", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart", + "chartSettings": { + "showLegend": true, + "seriesLabelSettings": [ + { + "seriesName": "Succeeded", + "color": "greenDark" + }, + { + "seriesName": "Running", + "color": "green" + } + ], + "ySettings": { + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-PodCountByPodStatus", + "styleSettings": { + "maxWidth": "50", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let im = InsightsMetrics\r\n| where Name in (\"containerGpuRequests\", \"containerGpuLimits\")\r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| extend selectedNodes = {selectedNodes}\r\n| extend nodeList = iif(selectedNodes == \"*\", \",*\", selectedNodes)\r\n| where '*' in (selectedNodes) or Computer in (selectedNodes)\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n//| extend tags=parse_json(Tags)\r\n| extend containerName = tostring(Tags.containerName)\r\n| extend poduidArray = split(containerName, \"/\")\r\n| extend podUid = iif(array_length(poduidArray) == 2, poduidArray[0], \"\")\r\n| where Val >= 1\r\n| where podUid != \"\"\r\n| distinct podUid;\r\nKubePodInventory\r\n| where PodUid in (im)\r\n| extend clusterId = ClusterId\r\n{clusterIdWhereClause}\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| summarize count() by PodUid, Namespace, PodStatus, bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['GPU Pods by namespace'] = count() default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by Namespace, PodStatus\r\n", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Pod Count by Kubernetes Namespace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "linechart", + "tileSettings": { + "titleContent": { + "columnMatch": "Namespace", + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "PodStatus", + "formatOptions": { + "showIcon": true + } + }, + "rightContent": { + "columnMatch": "GPU Pods by namespace", + "formatter": 10, + "formatOptions": { + "palette": "red", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "hello {0}" + } + }, + "showBorder": false, + "sortCriteriaField": "Namespace" + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "Namespace", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "PodStatus", + "formatOptions": { + "showIcon": true + } + }, + "centerContent": { + "columnMatch": "podcount", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "nodeIdField": "Namespace", + "nodeSize": null, + "staticNodeSize": 100, + "colorSettings": null, + "hivesMargin": 5 + }, + "chartSettings": { + "showLegend": true, + "ySettings": { + "unit": 17, + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-PodCountByK8SNamespace", + "styleSettings": { + "maxWidth": "50", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics \r\n| where Name == \"nodeGpuAllocatable\" \r\n| where Namespace == \"container.azm.ms/gpu\" \r\n| where Origin == \"container.azm.ms\"\r\n| where TimeGenerated >= {timeRange:start}\r\n| where TimeGenerated < {timeRange:end}\r\n| where '*' in ({selectedNodes}) or Computer in ({selectedNodes})\r\n| extend Tags = todynamic(Tags)\r\n| extend clusterId = tostring(Tags['container.azm.ms/clusterId'])\r\n{clusterIdWhereClause}\r\n| extend gpuVendor=strcat ('🔹 ',tostring(Tags.gpuVendor))\r\n| summarize gpuCountPerComputer=max(Val) by gpuVendor, Computer , bin(TimeGenerated, {timeRange:grain})\r\n| make-series ['GPU count by make'] =sum(gpuCountPerComputer) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by gpuVendor\r\n\r\n\r\n\r\n\r\n\r\n\r\n", + "size": 0, + "aggregation": 5, + "showAnnotations": true, + "showAnalytics": true, + "title": "GPU Count by Make", + "color": "blue", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "gpuVendor", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "GPU count by make", + "formatter": 10, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + }, + "tooltipFormat": { + "tooltip": "{0}" + } + }, + { + "columnMatch": "TimeGenerated", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "labelSettings": [ + { + "columnId": "gpuVendor", + "label": "Make", + "comment": "" + }, + { + "columnId": "GPU count by make", + "label": "Count" + }, + { + "columnId": "TimeGenerated" + } + ] + }, + "tileSettings": { + "titleContent": { + "columnMatch": "gpuVendor", + "formatOptions": { + "showIcon": true + } + }, + "rightContent": { + "columnMatch": "GPU count by make", + "formatter": 10, + "formatOptions": { + "palette": "blue", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "{0}" + } + }, + "showBorder": true, + "sortCriteriaField": "TimeGenerated", + "sortOrderField": 1 + }, + "chartSettings": { + "ySettings": { + "unit": 17, + "min": 0, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "GPU-GpuCountByMake", + "styleSettings": { + "maxWidth": "50", + "progressStyle": "loader", + "showBorder": true + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [] + }, + "name": "links - 7" + } + ], + "fallbackResourceIds": [], + "styleSettings": { + "progressStyle": "loader" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/AKS/Workbooks/Node GPU/settings.json b/AKS/Workbooks/Node GPU/settings.json new file mode 100644 index 0000000..caa7214 --- /dev/null +++ b/AKS/Workbooks/Node GPU/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Node GPU", + "author": "Microsoft", + "galleries": [ + { "type": "container-insights", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 500 }, + { "type": "workbook", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 500 } + ] +} diff --git a/AKS/Workbooks/Node Kubelet AKS Engine/Node Kubelet AKS Engine.workbook b/AKS/Workbooks/Node Kubelet AKS Engine/Node Kubelet AKS Engine.workbook new file mode 100644 index 0000000..93ff75e --- /dev/null +++ b/AKS/Workbooks/Node Kubelet AKS Engine/Node Kubelet AKS Engine.workbook @@ -0,0 +1,300 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "6548df2b-011e-4652-8f50-a53d9a07cd02", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter data by time range", + "isRequired": true, + "value": { + "durationMs": 1800000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "634f054b-c813-467d-af61-2e00eeadf88d", + "version": "KqlParameterItem/1.0", + "name": "selectedNodes1", + "label": "Node", + "type": 2, + "description": "Filter by Node", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin =~ 'container.azm.ms/telegraf'\r\n| where Namespace =~ 'container.azm.ms/prometheus'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName)\r\n| distinct HostName\r\n| sort by HostName asc\r\n\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "3dd04449-6ef7-45a9-bfb6-8e994907efcb", + "version": "KqlParameterItem/1.0", + "name": "selectedOperationTypes1", + "label": "Operation Type", + "type": 2, + "description": "Filter by operation type", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin =~ 'container.azm.ms/telegraf'\r\n| where Namespace =~ 'container.azm.ms/prometheus'\r\n| extend Tags = todynamic(Tags)\r\n| extend OperationType = tostring(Tags['operation_type'])\r\n| distinct OperationType\r\n| order by OperationType asc\r\n\r\n\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "315814b2-805d-4f4e-b92d-6f48249f5f04", + "version": "KqlParameterItem/1.0", + "name": "clusterId", + "type": 1, + "description": "Filter the selected workspace by cluster id", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "value": "" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "dropdowns" + }, + { + "type": 1, + "content": { + "json": "

Overview By Node

" + }, + "customWidth": "50", + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "

Overview By Operation Type

" + }, + "customWidth": "50", + "name": "text - 7 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/prometheus'\r\n| where Name in ('kubelet_docker_operations', 'kubelet_runtime_operations', 'kubelet_docker_operations_errors','kubelet_runtime_operations_errors')\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), OperationType = tostring(Tags['operation_type']), HostName = tostring(Tags.hostName)\r\n| where ClusterId =~ '{clusterId}'\r\n| extend OperationType = tostring(Tags['operation_type']), HostName = tostring(Tags.hostName)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedOperationTypes1}) or OperationType in ({selectedOperationTypes1})\r\n| extend partitionKey = strcat(HostName, '/' , Name, '/', OperationType)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val, Val - PrevVal)\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, Name, HostName, Rate;\r\nlet operationData = data\r\n| where Name in ('kubelet_docker_operations', 'kubelet_runtime_operations');\r\nlet totalOperationsByNode = operationData\r\n| summarize Rate = sum(Rate) by HostName\r\n| project HostName, TotalOperations = Rate;\r\nlet totalOperationsByNodeSeries = operationData\r\n| make-series TotalOperationsSeries = sum(Rate) default = 0 on TimeGenerated from ago(21600s) to now() step 10m by HostName\r\n| project-away TimeGenerated;\r\nlet errorData = data\r\n| where Name in ('kubelet_docker_operations', 'kubelet_runtime_operations');\r\nlet totalErrorsByNode = errorData\r\n| summarize Rate = sum(Rate) by HostName\r\n| project HostName, TotalErrors = Rate;\r\nlet totalErrorsByNodeSeries = errorData\r\n| make-series TotalErrorsSeries = sum(Rate) default = 0 on TimeGenerated from ago(21600s) to now() step 10m by HostName\r\n| project-away TimeGenerated;\r\ntotalOperationsByNode\r\n| join kind = leftouter (\r\n totalErrorsByNode\r\n) on HostName\r\n| join kind = leftouter (\r\n totalOperationsByNodeSeries\r\n) on HostName\r\n| join kind = leftouter (\r\n totalErrorsByNodeSeries\r\n) on HostName\r\n| extend TotalErrors = iif(isempty(TotalErrors), 0.0, TotalErrors)\r\n| extend SeriesOfEqualLength = range(1, array_length(TotalOperationsSeries), 1)\r\n| extend SeriesOfZeroes = series_multiply(SeriesOfEqualLength, 0)\r\n| extend TotalErrorsSeries = iif(isempty(TotalErrorsSeries), SeriesOfZeroes, TotalErrorsSeries)\r\n| project-away HostName1, HostName2, HostName3\r\n| extend TotalSuccessfulOperationsSeries = series_subtract(TotalOperationsSeries, TotalErrorsSeries)\r\n| extend IsNegativeTotalSuccessfulOperationsSeries = series_less(TotalSuccessfulOperationsSeries, SeriesOfZeroes)\r\n| extend TotalSuccessfulOperationsSeries = array_iif(IsNegativeTotalSuccessfulOperationsSeries, SeriesOfZeroes, TotalSuccessfulOperationsSeries)\r\n| extend SuccessPercentage = round(iif(TotalOperations == 0, 1.0, iif(TotalErrors > TotalOperations, 0.0, 1 - (TotalErrors / TotalOperations))), 4), SuccessPercentageSeries = series_divide(TotalSuccessfulOperationsSeries, TotalOperationsSeries)\r\n| extend SeriesOfOneHundo = series_multiply(series_divide(SeriesOfEqualLength, SeriesOfEqualLength), 100)\r\n| extend SuccessfulOperationsEqualsTotalOperationsSeries = series_equals(TotalSuccessfulOperationsSeries, TotalOperationsSeries)\r\n| extend SuccessPercentageSeries = array_iff(SuccessfulOperationsEqualsTotalOperationsSeries, SeriesOfOneHundo, SuccessPercentageSeries)\r\n| project HostName, TotalOperations, TotalErrors, SuccessPercentage, SuccessPercentageSeries\r\n| order by SuccessPercentage asc, HostName asc\r\n| project-rename Node = HostName, ['Total Operations'] = TotalOperations, ['Total Errors'] = TotalErrors, ['Success %'] = SuccessPercentage, ['Success % Trend'] = SuccessPercentageSeries", + "size": 0, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Node", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Total Operations", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Total Errors", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Success %", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 1, + "palette": "redGreen", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "percent", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Success % Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "max": 1, + "palette": "redGreen", + "showIcon": true + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "showPin": true, + "name": "overview-by-node-grid" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/prometheus'\r\n| where Name in ('kubelet_docker_operations', 'kubelet_runtime_operations', 'kubelet_docker_operations_errors','kubelet_runtime_operations_errors')\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), OperationType = tostring(Tags['operation_type']), HostName = tostring(Tags.hostName)\r\n| where ClusterId =~ '{clusterId}'\r\n| extend OperationType = tostring(Tags['operation_type']), HostName = tostring(Tags.hostName)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedOperationTypes1}) or OperationType in ({selectedOperationTypes1})\r\n| extend partitionKey = strcat(HostName, '/' , Name, '/', OperationType)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val, Val - PrevVal)\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, Name, OperationType, Rate;\r\nlet operationData = data\r\n| where Name in ('kubelet_docker_operations', 'kubelet_runtime_operations');\r\nlet totalOperationsByType = operationData\r\n| summarize Rate = sum(Rate) by OperationType\r\n| project OperationType, TotalOperations = Rate;\r\nlet totalOperationsByTypeSeries = operationData\r\n| make-series TotalOperationsByTypeSeries = sum(Rate) default = 0 on TimeGenerated from ago(21600s) to now() step 10m by OperationType\r\n| project-away TimeGenerated;\r\nlet errorsData = data\r\n| where Name in ('kubelet_docker_operations_errors','kubelet_runtime_operations_errors');\r\nlet totalErrorsByType = errorsData\r\n| summarize Rate = sum(Rate) by OperationType\r\n| project OperationType, TotalErrors = Rate;\r\nlet totalErrorsByTypeSeries = errorsData\r\n| make-series TotalErrorsByTypeSeries = sum(Rate) default = 0 on TimeGenerated from ago(21600s) to now() step 10m by OperationType\r\n| project-away TimeGenerated;\r\nlet seriesLength = toscalar( totalOperationsByTypeSeries\r\n| extend ArrayLength = array_length(TotalOperationsByTypeSeries)\r\n| summarize Array_Length = max(ArrayLength) );\r\ntotalOperationsByType\r\n| join kind = leftouter (\r\n totalErrorsByType\r\n) on OperationType\r\n| project-away OperationType1\r\n| extend TotalErrors = iif(isempty(TotalErrors), 0.0, TotalErrors)\r\n| join kind = leftouter (\r\n totalErrorsByTypeSeries\r\n) on OperationType\r\n| project-away OperationType1\r\n| extend SeriesOfEqualLength = range(1, seriesLength, 1)\r\n| extend SeriesOfZeroes = series_subtract(SeriesOfEqualLength, SeriesOfEqualLength)\r\n| extend SeriesOfOneHundo = series_multiply(series_divide(SeriesOfEqualLength, SeriesOfEqualLength), 100)\r\n| extend TotalErrorsByTypeSeries = iif(isempty(TotalErrorsByTypeSeries), SeriesOfZeroes, TotalErrorsByTypeSeries)\r\n| join kind=leftouter (\r\n totalOperationsByTypeSeries\r\n) on OperationType\r\n| project-away OperationType1\r\n| extend TotalSuccessfulOperationsByTypeSeries = series_subtract(TotalOperationsByTypeSeries, TotalErrorsByTypeSeries)\r\n| extend IsNegativeTotalSuccessfulOperationsByTypeSeries = series_less(TotalSuccessfulOperationsByTypeSeries, SeriesOfZeroes)\r\n| extend TotalSuccessfulOperationsByTypeSeries = array_iif(IsNegativeTotalSuccessfulOperationsByTypeSeries, SeriesOfZeroes, TotalSuccessfulOperationsByTypeSeries) \r\n| extend SuccessPercentage = round(iif(TotalOperations == 0, 1.0, iif(TotalErrors > TotalOperations, 0.0, 1 - (TotalErrors / TotalOperations))), 4), SuccessPercentageSeries = series_divide(TotalSuccessfulOperationsByTypeSeries, TotalOperationsByTypeSeries)\r\n| extend SuccessfulOperationsEqualsTotalOperationsSeries = series_equals(TotalSuccessfulOperationsByTypeSeries, TotalOperationsByTypeSeries)\r\n| extend SuccessPercentageSeries = array_iff(SuccessfulOperationsEqualsTotalOperationsSeries, SeriesOfOneHundo, SuccessPercentageSeries)\r\n| project OperationType, TotalOperations, TotalErrors, SuccessPercentage, SuccessPercentageSeries\r\n| order by SuccessPercentage asc, OperationType asc\r\n| project-rename ['Operation Type'] = OperationType, ['Total Operations'] = TotalOperations, ['Total Errors'] = TotalErrors, ['Success %'] = SuccessPercentage, ['Success % Trend'] = SuccessPercentageSeries", + "size": 0, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Operation Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TotalOperations", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Total Errors", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Success %", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 1, + "palette": "redGreen", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "percent", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Success % Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "max": 1, + "palette": "redGreen", + "showIcon": true + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "showPin": true, + "name": "overview-by-operation-type-grid" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/AKS/Workbooks/Node Kubelet AKS Engine/settings.json b/AKS/Workbooks/Node Kubelet AKS Engine/settings.json new file mode 100644 index 0000000..604704d --- /dev/null +++ b/AKS/Workbooks/Node Kubelet AKS Engine/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Kubelet", + "author": "Microsoft", + "galleries": [ + { "type": "container-insights", "resourceType": "microsoft.operationalinsights/workspaces", "order": 300 } + ] +} diff --git a/AKS/Workbooks/Node Kubelet AKS/Node Kubelet AKS.workbook b/AKS/Workbooks/Node Kubelet AKS/Node Kubelet AKS.workbook new file mode 100644 index 0000000..6456791 --- /dev/null +++ b/AKS/Workbooks/Node Kubelet AKS/Node Kubelet AKS.workbook @@ -0,0 +1,287 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "6548df2b-011e-4652-8f50-a53d9a07cd02", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter data by time range", + "isRequired": true, + "value": { + "durationMs": 21600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "634f054b-c813-467d-af61-2e00eeadf88d", + "version": "KqlParameterItem/1.0", + "name": "selectedNodes1", + "label": "Node", + "type": 2, + "description": "Filter by node", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/prometheus'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName)\r\n| distinct HostName\r\n| sort by HostName asc\r\n\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + { + "id": "3dd04449-6ef7-45a9-bfb6-8e994907efcb", + "version": "KqlParameterItem/1.0", + "name": "selectedOperationTypes1", + "label": "Operation Type", + "type": 2, + "description": "Filter by operation type", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/prometheus'\r\n| extend Tags = todynamic(Tags)\r\n| extend OperationType = tostring(Tags['operation_type'])\r\n| distinct OperationType\r\n| order by OperationType asc\r\n\r\n\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + "name": "dropdowns" + }, + { + "type": 1, + "content": { + "json": "

Overview By Node

" + }, + "customWidth": "50", + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "

Overview By Operation Type

" + }, + "customWidth": "50", + "name": "text - 7 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/prometheus'\r\n| where Name in ('kubelet_docker_operations', 'kubelet_runtime_operations', 'kubelet_docker_operations_errors','kubelet_runtime_operations_errors')\r\n| extend Tags = todynamic(Tags)\r\n| extend OperationType = tostring(Tags['operation_type']), HostName = tostring(Tags.hostName)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedOperationTypes1}) or OperationType in ({selectedOperationTypes1})\r\n| extend partitionKey = strcat(HostName, '/' , Name, '/', OperationType)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val, Val - PrevVal)\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, Name, HostName, Rate;\r\nlet operationData = data\r\n| where Name in ('kubelet_docker_operations', 'kubelet_runtime_operations');\r\nlet totalOperationsByNode = operationData\r\n| summarize Rate = sum(Rate) by HostName\r\n| project HostName, TotalOperations = Rate;\r\nlet totalOperationsByNodeSeries = operationData\r\n| make-series TotalOperationsSeries = sum(Rate) default = 0 on TimeGenerated from ago(21600s) to now() step 10m by HostName\r\n| project-away TimeGenerated;\r\nlet errorData = data\r\n| where Name in ('kubelet_docker_operations_errors','kubelet_runtime_operations_errors');\r\nlet totalErrorsByNode = errorData\r\n| summarize Rate = sum(Rate) by HostName\r\n| project HostName, TotalErrors = Rate;\r\nlet totalErrorsByNodeSeries = errorData\r\n| make-series TotalErrorsSeries = sum(Rate) default = 0 on TimeGenerated from ago(21600s) to now() step 10m by HostName\r\n| project-away TimeGenerated;\r\ntotalOperationsByNode\r\n| join kind = leftouter (\r\n totalErrorsByNode\r\n) on HostName\r\n| join kind = leftouter (\r\n totalOperationsByNodeSeries\r\n) on HostName\r\n| join kind = leftouter (\r\n totalErrorsByNodeSeries\r\n) on HostName\r\n| extend TotalErrors = iif(isempty(TotalErrors), 0.0, TotalErrors)\r\n| extend SeriesOfEqualLength = range(1, array_length(TotalOperationsSeries), 1)\r\n| extend SeriesOfZeroes = series_multiply(SeriesOfEqualLength, 0)\r\n| extend TotalErrorsSeries = iif(isempty(TotalErrorsSeries), SeriesOfZeroes, TotalErrorsSeries)\r\n| project-away HostName1, HostName2, HostName3\r\n| extend TotalSuccessfulOperationsSeries = series_subtract(TotalOperationsSeries, TotalErrorsSeries)\r\n| extend IsNegativeTotalSuccessfulOperationsSeries = series_less(TotalSuccessfulOperationsSeries, SeriesOfZeroes)\r\n| extend TotalSuccessfulOperationsSeries = array_iif(IsNegativeTotalSuccessfulOperationsSeries, SeriesOfZeroes, TotalSuccessfulOperationsSeries)\r\n| extend SuccessPercentage = round(iif(TotalOperations == 0, 1.0, iif(TotalErrors > TotalOperations, 0.0, 1 - (TotalErrors / TotalOperations))), 4), SuccessPercentageSeries = series_divide(TotalSuccessfulOperationsSeries, TotalOperationsSeries)\r\n| extend SeriesOfOneHundo = series_multiply(series_divide(SeriesOfEqualLength, SeriesOfEqualLength), 100)\r\n| extend SuccessfulOperationsEqualsTotalOperationsSeries = series_equals(TotalSuccessfulOperationsSeries, TotalOperationsSeries)\r\n| extend SuccessPercentageSeries = array_iff(SuccessfulOperationsEqualsTotalOperationsSeries, SeriesOfOneHundo, SuccessPercentageSeries)\r\n| project HostName, TotalOperations, TotalErrors, SuccessPercentage, SuccessPercentageSeries\r\n| order by SuccessPercentage asc, HostName asc\r\n| project-rename Node = HostName, ['Total Operations'] = TotalOperations, ['Total Errors'] = TotalErrors, ['Success %'] = SuccessPercentage, ['Success % Trend'] = SuccessPercentageSeries", + "size": 0, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Node", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Total Operations", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Total Errors", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Success %", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 1, + "palette": "redGreen", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "percent", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Success % Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "max": 1, + "palette": "redGreen", + "showIcon": true + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "showPin": true, + "name": "overview-by-node-grid" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/prometheus'\r\n| where Name in ('kubelet_docker_operations', 'kubelet_runtime_operations', 'kubelet_docker_operations_errors','kubelet_runtime_operations_errors')\r\n| extend Tags = todynamic(Tags)\r\n| extend OperationType = tostring(Tags['operation_type']), HostName = tostring(Tags.hostName)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedOperationTypes1}) or OperationType in ({selectedOperationTypes1})\r\n| extend partitionKey = strcat(HostName, '/' , Name, '/', OperationType)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val, Val - PrevVal)\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, Name, OperationType, Rate;\r\nlet operationData = data\r\n| where Name in ('kubelet_docker_operations', 'kubelet_runtime_operations');\r\nlet totalOperationsByType = operationData\r\n| summarize Rate = sum(Rate) by OperationType\r\n| project OperationType, TotalOperations = Rate;\r\nlet totalOperationsByTypeSeries = operationData\r\n| make-series TotalOperationsByTypeSeries = sum(Rate) default = 0 on TimeGenerated from ago(21600s) to now() step 10m by OperationType\r\n| project-away TimeGenerated;\r\nlet errorsData = data\r\n| where Name in ('kubelet_docker_operations_errors','kubelet_runtime_operations_errors');\r\nlet totalErrorsByType = errorsData\r\n| summarize Rate = sum(Rate) by OperationType\r\n| project OperationType, TotalErrors = Rate;\r\nlet totalErrorsByTypeSeries = errorsData\r\n| make-series TotalErrorsByTypeSeries = sum(Rate) default = 0 on TimeGenerated from ago(21600s) to now() step 10m by OperationType\r\n| project-away TimeGenerated;\r\nlet seriesLength = toscalar( totalOperationsByTypeSeries\r\n| extend ArrayLength = array_length(TotalOperationsByTypeSeries)\r\n| summarize Array_Length = max(ArrayLength) );\r\ntotalOperationsByType\r\n| join kind = leftouter (\r\n totalErrorsByType\r\n) on OperationType\r\n| project-away OperationType1\r\n| extend TotalErrors = iif(isempty(TotalErrors), 0.0, TotalErrors)\r\n| join kind = leftouter (\r\n totalErrorsByTypeSeries\r\n) on OperationType\r\n| project-away OperationType1\r\n| extend SeriesOfEqualLength = range(1, seriesLength, 1)\r\n| extend SeriesOfZeroes = series_subtract(SeriesOfEqualLength, SeriesOfEqualLength)\r\n| extend SeriesOfOneHundo = series_multiply(series_divide(SeriesOfEqualLength, SeriesOfEqualLength), 100)\r\n| extend TotalErrorsByTypeSeries = iif(isempty(TotalErrorsByTypeSeries), SeriesOfZeroes, TotalErrorsByTypeSeries)\r\n| join kind=leftouter (\r\n totalOperationsByTypeSeries\r\n) on OperationType\r\n| project-away OperationType1\r\n| extend TotalSuccessfulOperationsByTypeSeries = series_subtract(TotalOperationsByTypeSeries, TotalErrorsByTypeSeries)\r\n| extend IsNegativeTotalSuccessfulOperationsByTypeSeries = series_less(TotalSuccessfulOperationsByTypeSeries, SeriesOfZeroes)\r\n| extend TotalSuccessfulOperationsByTypeSeries = array_iif(IsNegativeTotalSuccessfulOperationsByTypeSeries, SeriesOfZeroes, TotalSuccessfulOperationsByTypeSeries) \r\n| extend SuccessPercentage = round(iif(TotalOperations == 0, 1.0, iif(TotalErrors > TotalOperations, 0.0, 1 - (TotalErrors / TotalOperations))), 4), SuccessPercentageSeries = series_divide(TotalSuccessfulOperationsByTypeSeries, TotalOperationsByTypeSeries)\r\n| extend SuccessfulOperationsEqualsTotalOperationsSeries = series_equals(TotalSuccessfulOperationsByTypeSeries, TotalOperationsByTypeSeries)\r\n| extend SuccessPercentageSeries = array_iff(SuccessfulOperationsEqualsTotalOperationsSeries, SeriesOfOneHundo, SuccessPercentageSeries)\r\n| project OperationType, TotalOperations, TotalErrors, SuccessPercentage, SuccessPercentageSeries\r\n| order by SuccessPercentage asc, OperationType asc\r\n| project-rename ['Operation Type'] = OperationType, ['Total Operations'] = TotalOperations, ['Total Errors'] = TotalErrors, ['Success %'] = SuccessPercentage, ['Success % Trend'] = SuccessPercentageSeries", + "size": 0, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Operation Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TotalOperations", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Total Errors", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Success %", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 1, + "palette": "redGreen", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "percent", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Success % Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "max": 1, + "palette": "redGreen", + "showIcon": true + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "showPin": true, + "name": "overview-by-operation-type-grid" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/AKS/Workbooks/Node Kubelet AKS/settings.json b/AKS/Workbooks/Node Kubelet AKS/settings.json new file mode 100644 index 0000000..8987355 --- /dev/null +++ b/AKS/Workbooks/Node Kubelet AKS/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Kubelet", + "author": "Microsoft", + "galleries": [ + { "type": "container-insights", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 300 }, + { "type": "workbook", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 300 } + ] +} diff --git a/AKS/Workbooks/Node Network AKS Engine/Node Network AKS Engine.workbook b/AKS/Workbooks/Node Network AKS Engine/Node Network AKS Engine.workbook new file mode 100644 index 0000000..0eeb9ea --- /dev/null +++ b/AKS/Workbooks/Node Network AKS Engine/Node Network AKS Engine.workbook @@ -0,0 +1,634 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "
More information about the metrics in this workbook is available here
" + }, + "name": "text - 18" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e2b5cd30-7276-477f-a6bb-07da25ba5e5f", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter data by time range", + "isRequired": true, + "value": { + "durationMs": 1800000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "4c9a0f80-fa3e-44af-8f0d-6744ecf503c6", + "version": "KqlParameterItem/1.0", + "name": "unit", + "label": "Unit", + "type": 2, + "description": "The units to use for the data", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"label\": \"Bytes\", \"value\": \"1\", \"selected\": \"true\" },\r\n { \"label\": \"Kilobytes\", \"value\": \"1000\", \"selected\": \"false\" },\r\n { \"label\": \"Megabytes\", \"value\": \"1000000\", \"selected\": \"false\" },\r\n { \"label\": \"Gigabytes\", \"value\": \"1000000000\", \"selected\": \"false\" }\r\n]" + }, + { + "id": "5a7770ff-fdc2-4590-85e2-5ee1c5653805", + "version": "KqlParameterItem/1.0", + "name": "aggregation1", + "label": "Aggregation", + "type": 2, + "description": "Choose which data aggregation you want to visualize on the time chart", + "value": "Average", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"label\": \"Max\", \"value\": \"Max\" },\r\n { \"label\": \"Average\", \"value\": \"Average\" },\r\n { \"label\": \"Min\", \"value\": \"Min\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange" + }, + { + "id": "0c040f71-7b0d-4021-96e0-bbcdb6390de9", + "version": "KqlParameterItem/1.0", + "name": "selectedNodes1", + "label": "Node", + "type": 2, + "description": "Filter by node", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName)\r\n| distinct HostName\r\n| sort by HostName asc\r\n\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "3201a4f3-4914-45cd-810e-551688fd9069", + "version": "KqlParameterItem/1.0", + "name": "selectedInterfaces1", + "label": "Interface", + "type": 2, + "description": "Filter by interface", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| distinct Interface\r\n| sort by Interface asc\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "b8998f52-b18f-4319-8194-098a29fa6f80", + "version": "KqlParameterItem/1.0", + "name": "clusterId", + "type": 1, + "description": "Filter the selected workspace by cluster id", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "dropdowns" + }, + { + "type": 1, + "content": { + "json": "
" + }, + "name": "text - 20" + }, + { + "type": 1, + "content": { + "json": "

Network Details

" + }, + "name": "text - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where ClusterId =~ '{clusterId}'\r\n| where \"*\" in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where \"*\" in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface, '/', Name)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / datetime_diff('Second', TimeGenerated, PrevTimeGenerated), (Val - PrevVal) / datetime_diff('Second', TimeGenerated, PrevTimeGenerated))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Name, Rate;\r\nlet bytesSent = data\r\n| where Name == 'bytes_sent';\r\nlet bytesReceived = data\r\n| where Name == 'bytes_recv';\r\nlet errorsOut = data\r\n| where Name == 'err_out';\r\nlet errorsIn = data\r\n| where Name == 'err_in';\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nlet bytesSentTableData = bytesSent // bytes sent per sec data\r\n| summarize BytesSentPerSecond = avg(Rate) by HostName, Interface // for interfaces, group by parentId (HostName) \r\n| join kind = inner (\r\n bytesSent\r\n | make-series BytesSentPerSecondTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n) on HostName\r\n| where Interface == Interface1\r\n| project Id = strcat(HostName, Interface), HostName, Interface, Name = strcat('🔹 ', Interface), ParentId = strcat('🖥️ ', HostName), Kind = 'Interface', BytesSentPerSecond, BytesSentPerSecondTrend;\r\nlet bytesReceivedTableData = bytesReceived // bytes received per sec data\r\n| summarize BytesReceivedPerSecond = avg(Rate) by HostName, Interface\r\n| join kind = inner (\r\n bytesReceived\r\n | make-series BytesReceivedPerSecondTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n) on HostName\r\n| where Interface == Interface1\r\n| project Id = strcat(HostName, Interface), HostName, Interface, Name = strcat('🔹 ', Interface), ParentId = strcat('🖥️ ', HostName), Kind = 'Interface', BytesReceivedPerSecond, BytesReceivedPerSecondTrend;\r\nlet errorsOutTableData = errorsOut // errors out per sec data\r\n| summarize ErrorsOutPerSecond = avg(Rate) by HostName, Interface\r\n| join kind = inner (\r\n errorsOut\r\n | make-series ErrorsOutPerSecondTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n) on HostName\r\n| where Interface == Interface1\r\n| project Id = strcat(HostName, Interface), HostName, Interface, Name = strcat('🔹 ', Interface), ParentId = strcat('🖥️ ', HostName), Kind = 'Interface', ErrorsOutPerSecond, ErrorsOutPerSecondTrend;\r\nlet errorsInTableData = errorsIn // errors in per sec data\r\n| summarize ErrorsInPerSecond = avg(Rate) by HostName, Interface\r\n| join kind = inner (\r\n errorsIn\r\n | make-series ErrorsInPerSecondTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n) on HostName\r\n| where Interface == Interface1\r\n| project Id = strcat(HostName, Interface), HostName, Interface, Name = strcat('🔹 ', Interface), ParentId = strcat('🖥️ ', HostName), Kind = 'Interface', ErrorsInPerSecond, ErrorsInPerSecondTrend;\r\nbytesSentTableData\r\n| join kind = inner ( bytesReceivedTableData ) on Id\r\n| project-away Id1, Name1, ParentId1, Kind1, HostName1, Interface1\r\n| join kind = inner ( errorsOutTableData ) on Id\r\n| project-away Id1, Name1, ParentId1, Kind1, HostName1, Interface1\r\n| join kind = inner ( errorsInTableData ) on Id\r\n| project-away Id1, Name1, ParentId1, Kind1, HostName1, Interface1\r\n| project-rename ['Sent Bytes/sec'] = BytesSentPerSecond, ['Sent Bytes/sec Trend'] = BytesSentPerSecondTrend, ['Received Bytes/sec'] = BytesReceivedPerSecond, ['Received Bytes/sec Trend'] = BytesReceivedPerSecondTrend, ['Errors Out/sec'] = ErrorsOutPerSecond, ['ErrorsOut/sec Trend'] = ErrorsOutPerSecondTrend, ['Errors In/sec'] = ErrorsInPerSecond, ['Errors In/sec Trend'] = ErrorsInPerSecondTrend\r\n| order by Id asc\r\n| project-rename FullId = Id, GridId = Name, Name = ParentId", + "size": 0, + "exportDefaultValue": "{\"Kind\":\"Unselected\"}", + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "FullId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "HostName", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Interface", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "GridId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Kind", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Sent Bytes/sec", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Sent Bytes/sec Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Received Bytes/sec", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Received Bytes/sec Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Errors Out/sec", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ErrorsOut/sec Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Errors In/sec", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Errors In/sec Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Id", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "$gen_group", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Name" + ], + "expandTopLevel": true, + "finalBy": "GridId" + }, + "labelSettings": [] + } + }, + "showPin": true, + "name": "overview-grid" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n
\r\n" + }, + "name": "text - 20 - Copy" + }, + { + "type": 1, + "content": { + "json": "

Sent {unit:label}/sec

" + }, + "customWidth": "50", + "name": "text - 5" + }, + { + "type": 1, + "content": { + "json": "

Received {unit:label}/sec

" + }, + "customWidth": "50", + "name": "text - 5 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesSentPerSecond = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'bytes_sent'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit}), (Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit}))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nbytesSentPerSecond\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "tileSettings": { + "showBorder": false + } + }, + "customWidth": "50", + "showPin": true, + "name": "bytes-sent-per-sec" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesReceivedPerSecond = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'bytes_recv'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit}), (Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit}))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nbytesReceivedPerSecond\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "bytes-received-per-sec" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 22" + }, + { + "type": 1, + "content": { + "json": "

Total {unit:label} Sent (by {timeRange:grain} intervals)

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "

Total {unit:label} Received (by {timeRange:grain} intervals)

" + }, + "customWidth": "50", + "name": "text - 5 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesSentTotal = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'bytes_sent'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / {unit}, (Val - PrevVal) / {unit})\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\nbytesSentTotal\r\n| make-series Val = sum(Rate) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, '/', Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "total-bytes-sent" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesReceivedTotal = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'bytes_recv'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / {unit}, (Val - PrevVal) / {unit})\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Rate;\r\nlet sum = bytesReceivedTotal\r\n| make-series Val = sum(Rate) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName\r\n| extend Name = strcat(HostName, ':', 'Sum')\r\n| project-away HostName;\r\nsum", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "total-bytes-received" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 23" + }, + { + "type": 1, + "content": { + "json": "

Errors Out/sec

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "

Errors In/sec

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let errorsOutPerSecond = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'err_out'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / datetime_diff('Second', TimeGenerated, PrevTimeGenerated), (Val - PrevVal) / datetime_diff('Second', TimeGenerated, PrevTimeGenerated))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nerrorsOutPerSecond\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "errors-out-per-sec" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let errorsInPerSecond = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'err_in'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / datetime_diff('Second', TimeGenerated, PrevTimeGenerated), (Val - PrevVal) / datetime_diff('Second', TimeGenerated, PrevTimeGenerated))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nerrorsInPerSecond\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "errors-in-per-sec" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 24" + }, + { + "type": 1, + "content": { + "json": "

Total Errors Out (by {timeRange:grain} intervals)

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "

Total Errors In (by {timeRange:grain} intervals)

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let totalErrorsOut = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'err_out'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val, Val - PrevVal)\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\ntotalErrorsOut\r\n| make-series Val = sum(Rate) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, '/', Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "total-errors-out" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let totalErrorsIn = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'err_in'\r\n| extend Tags = todynamic(Tags)\r\n| extend ClusterId = tostring(Tags['container.azm.ms/clusterId']), HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where ClusterId =~ '{clusterId}'\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val, Val - PrevVal)\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\ntotalErrorsIn\r\n| make-series Val = sum(Rate) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, '/', Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "total-errors-in" + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/AKS/Workbooks/Node Network AKS Engine/settings.json b/AKS/Workbooks/Node Network AKS Engine/settings.json new file mode 100644 index 0000000..b63e887 --- /dev/null +++ b/AKS/Workbooks/Node Network AKS Engine/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Node Network", + "author": "Microsoft", + "galleries": [ + { "type": "container-insights", "resourceType": "microsoft.operationalinsights/workspaces", "order": 400 } + ] +} diff --git a/AKS/Workbooks/Node Network AKS/Node Network AKS.workbook b/AKS/Workbooks/Node Network AKS/Node Network AKS.workbook new file mode 100644 index 0000000..bf90a30 --- /dev/null +++ b/AKS/Workbooks/Node Network AKS/Node Network AKS.workbook @@ -0,0 +1,623 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "
More information about the metrics in this workbook is available here
" + }, + "name": "text - 18" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e2b5cd30-7276-477f-a6bb-07da25ba5e5f", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter data by time range", + "isRequired": true, + "value": { + "durationMs": 21600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "4c9a0f80-fa3e-44af-8f0d-6744ecf503c6", + "version": "KqlParameterItem/1.0", + "name": "unit", + "label": "Unit", + "type": 2, + "description": "The units to use for the data", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"label\": \"Bytes\", \"value\": \"1\", \"selected\": \"true\" },\r\n { \"label\": \"Kilobytes\", \"value\": \"1000\", \"selected\": \"false\" },\r\n { \"label\": \"Megabytes\", \"value\": \"1000000\", \"selected\": \"false\" },\r\n { \"label\": \"Gigabytes\", \"value\": \"1000000000\", \"selected\": \"false\" }\r\n]" + }, + { + "id": "5a7770ff-fdc2-4590-85e2-5ee1c5653805", + "version": "KqlParameterItem/1.0", + "name": "aggregation1", + "label": "Aggregation", + "type": 2, + "description": "Choose which data aggregation you want to visualize on the time chart", + "value": "Average", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"label\": \"Max\", \"value\": \"Max\" },\r\n { \"label\": \"Average\", \"value\": \"Average\" },\r\n { \"label\": \"Min\", \"value\": \"Min\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange" + }, + { + "id": "0c040f71-7b0d-4021-96e0-bbcdb6390de9", + "version": "KqlParameterItem/1.0", + "name": "selectedNodes1", + "label": "Node", + "type": 2, + "description": "Filter by node", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName)\r\n| distinct HostName\r\n| sort by HostName asc\r\n\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + { + "id": "3201a4f3-4914-45cd-810e-551688fd9069", + "version": "KqlParameterItem/1.0", + "name": "selectedInterfaces1", + "label": "Interface", + "type": 2, + "description": "Filter by interface", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| extend Tags = todynamic(Tags)\r\n| project HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| distinct Interface\r\n| sort by Interface asc\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + "name": "dropwdowns" + }, + { + "type": 1, + "content": { + "json": "
" + }, + "name": "text - 20" + }, + { + "type": 1, + "content": { + "json": "

Network Overview

" + }, + "name": "text - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where \"*\" in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where \"*\" in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface, '/', Name)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / datetime_diff('Second', TimeGenerated, PrevTimeGenerated), (Val - PrevVal) / datetime_diff('Second', TimeGenerated, PrevTimeGenerated))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Name, Rate;\r\nlet bytesSent = data\r\n| where Name == 'bytes_sent';\r\nlet bytesReceived = data\r\n| where Name == 'bytes_recv';\r\nlet errorsOut = data\r\n| where Name == 'err_out';\r\nlet errorsIn = data\r\n| where Name == 'err_in';\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nlet bytesSentTableData = bytesSent // bytes sent per sec data\r\n| summarize BytesSentPerSecond = avg(Rate) by HostName, Interface // for interfaces, group by parentId (HostName) \r\n| join kind = inner (\r\n bytesSent\r\n | make-series BytesSentPerSecondTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n) on HostName\r\n| where Interface == Interface1\r\n| project Id = strcat(HostName, Interface), HostName, Interface, Name = strcat('🔹 ', Interface), ParentId = strcat('🖥️ ', HostName), Kind = 'Interface', BytesSentPerSecond, BytesSentPerSecondTrend;\r\nlet bytesReceivedTableData = bytesReceived // bytes received per sec data\r\n| summarize BytesReceivedPerSecond = avg(Rate) by HostName, Interface\r\n| join kind = inner (\r\n bytesReceived\r\n | make-series BytesReceivedPerSecondTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n) on HostName\r\n| where Interface == Interface1\r\n| project Id = strcat(HostName, Interface), HostName, Interface, Name = strcat('🔹 ', Interface), ParentId = strcat('🖥️ ', HostName), Kind = 'Interface', BytesReceivedPerSecond, BytesReceivedPerSecondTrend;\r\nlet errorsOutTableData = errorsOut // errors out per sec data\r\n| summarize ErrorsOutPerSecond = avg(Rate) by HostName, Interface\r\n| join kind = inner (\r\n errorsOut\r\n | make-series ErrorsOutPerSecondTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n) on HostName\r\n| where Interface == Interface1\r\n| project Id = strcat(HostName, Interface), HostName, Interface, Name = strcat('🔹 ', Interface), ParentId = strcat('🖥️ ', HostName), Kind = 'Interface', ErrorsOutPerSecond, ErrorsOutPerSecondTrend;\r\nlet errorsInTableData = errorsIn // errors in per sec data\r\n| summarize ErrorsInPerSecond = avg(Rate) by HostName, Interface\r\n| join kind = inner (\r\n errorsIn\r\n | make-series ErrorsInPerSecondTrend = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n) on HostName\r\n| where Interface == Interface1\r\n| project Id = strcat(HostName, Interface), HostName, Interface, Name = strcat('🔹 ', Interface), ParentId = strcat('🖥️ ', HostName), Kind = 'Interface', ErrorsInPerSecond, ErrorsInPerSecondTrend;\r\nbytesSentTableData\r\n| join kind = inner ( bytesReceivedTableData ) on Id\r\n| project-away Id1, Name1, ParentId1, Kind1, HostName1, Interface1\r\n| join kind = inner ( errorsOutTableData ) on Id\r\n| project-away Id1, Name1, ParentId1, Kind1, HostName1, Interface1\r\n| join kind = inner ( errorsInTableData ) on Id\r\n| project-away Id1, Name1, ParentId1, Kind1, HostName1, Interface1\r\n| project-rename ['Sent Bytes/sec'] = BytesSentPerSecond, ['Sent Bytes/sec Trend'] = BytesSentPerSecondTrend, ['Received Bytes/sec'] = BytesReceivedPerSecond, ['Received Bytes/sec Trend'] = BytesReceivedPerSecondTrend, ['Errors Out/sec'] = ErrorsOutPerSecond, ['ErrorsOut/sec Trend'] = ErrorsOutPerSecondTrend, ['Errors In/sec'] = ErrorsInPerSecond, ['Errors In/sec Trend'] = ErrorsInPerSecondTrend\r\n| order by Id asc\r\n| project-rename FullId = Id, GridId = Name, Name = ParentId", + "size": 0, + "exportDefaultValue": "{\"Kind\":\"Unselected\"}", + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "FullId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "HostName", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Interface", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "GridId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Kind", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Sent Bytes/sec", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Sent Bytes/sec Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Received Bytes/sec", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Received Bytes/sec Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Errors Out/sec", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ErrorsOut/sec Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Errors In/sec", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Errors In/sec Trend", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Id", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "$gen_group", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Name" + ], + "expandTopLevel": true, + "finalBy": "GridId" + }, + "labelSettings": [] + } + }, + "showPin": true, + "name": "overview-grid" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n
\r\n" + }, + "name": "text - 20 - Copy" + }, + { + "type": 1, + "content": { + "json": "

Sent {unit:label}/sec

" + }, + "customWidth": "50", + "name": "text - 5" + }, + { + "type": 1, + "content": { + "json": "

Received {unit:label}/sec

" + }, + "customWidth": "50", + "name": "text - 5 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesSentPerSecond = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'bytes_sent'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit}), (Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit}))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nbytesSentPerSecond\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart", + "tileSettings": { + "showBorder": false + } + }, + "customWidth": "50", + "showPin": true, + "name": "bytes-sent-per-sec" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesReceivedPerSecond = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'bytes_recv'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit}), (Val - PrevVal) / (datetime_diff('Second', TimeGenerated, PrevTimeGenerated) * {unit}))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nbytesReceivedPerSecond\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "bytes-received-per-sec" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 22" + }, + { + "type": 1, + "content": { + "json": "

Total {unit:label} Sent (by {timeRange:grain} intervals)

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "

Total {unit:label} Received (by {timeRange:grain} intervals)

" + }, + "customWidth": "50", + "name": "text - 5 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesSentTotal = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'bytes_sent'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / {unit}, (Val - PrevVal) / {unit})\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\nbytesSentTotal\r\n| make-series Val = sum(Rate) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, '/', Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "total-bytes-sent" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bytesReceivedTotal = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'bytes_recv'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / {unit}, (Val - PrevVal) / {unit})\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Rate;\r\nlet sum = bytesReceivedTotal\r\n| make-series Val = sum(Rate) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName\r\n| extend Name = strcat(HostName, ':', 'Sum')\r\n| project-away HostName;\r\nsum", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "total-bytes-received" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 23" + }, + { + "type": 1, + "content": { + "json": "

Errors Out/sec

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "

Errors In/sec

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let errorsOutPerSecond = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'err_out'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / datetime_diff('Second', TimeGenerated, PrevTimeGenerated), (Val - PrevVal) / datetime_diff('Second', TimeGenerated, PrevTimeGenerated))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nerrorsOutPerSecond\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "errors-out-per-sec" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let errorsInPerSecond = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'err_in'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val / datetime_diff('Second', TimeGenerated, PrevTimeGenerated), (Val - PrevVal) / datetime_diff('Second', TimeGenerated, PrevTimeGenerated))\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\nlet maxOn = indexof(\"{aggregation1}\", 'Max');\r\nlet avgOn = indexof(\"{aggregation1}\", 'Average');\r\nlet minOn = indexof(\"{aggregation1}\", 'Min');\r\nerrorsInPerSecond\r\n| make-series Val = iif(avgOn != -1, avg(Rate), iif(maxOn != -1, max(Rate), min(Rate))) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "errors-in-per-sec" + }, + { + "type": 1, + "content": { + "json": "
\r\n
\r\n" + }, + "name": "text - 24" + }, + { + "type": 1, + "content": { + "json": "

Total Errors Out (by {timeRange:grain} intervals)

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "

Total Errors In (by {timeRange:grain} intervals)

" + }, + "customWidth": "50", + "name": "text - 5 - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let totalErrorsOut = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'err_out'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val, Val - PrevVal)\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\ntotalErrorsOut\r\n| make-series Val = sum(Rate) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, '/', Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "total-errors-out" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let totalErrorsIn = InsightsMetrics\r\n| where Origin == 'container.azm.ms/telegraf'\r\n| where Namespace == 'container.azm.ms/net'\r\n| where Name == 'err_in'\r\n| extend Tags = todynamic(Tags)\r\n| extend HostName = tostring(Tags.hostName), Interface = tostring(Tags.interface)\r\n| where '*' in ({selectedNodes1}) or HostName in ({selectedNodes1})\r\n| where '*' in ({selectedInterfaces1}) or Interface in ({selectedInterfaces1})\r\n| extend partitionKey = strcat(HostName, '/', Interface)\r\n| order by partitionKey asc, TimeGenerated asc\r\n| serialize\r\n| extend PrevVal = iif(prev(partitionKey) != partitionKey, 0.0, prev(Val)), PrevTimeGenerated = iif(prev(partitionKey) != partitionKey, datetime(null), prev(TimeGenerated))\r\n| where isnotnull(PrevTimeGenerated) and PrevTimeGenerated != TimeGenerated\r\n| extend Rate = iif(PrevVal > Val, Val, Val - PrevVal)\r\n| where isnotnull(Rate)\r\n| project TimeGenerated, HostName, Interface, Rate;\r\ntotalErrorsIn\r\n| make-series Val = sum(Rate) default = 0 on TimeGenerated from {timeRange:start} to {timeRange:end} step {timeRange:grain} by HostName, Interface\r\n| extend Name = strcat(HostName, '/', Interface)\r\n| project-away HostName, Interface", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "total-errors-in" + } + ], + "fallbackResourceIds": [], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/AKS/Workbooks/Node Network AKS/settings.json b/AKS/Workbooks/Node Network AKS/settings.json new file mode 100644 index 0000000..d4055c9 --- /dev/null +++ b/AKS/Workbooks/Node Network AKS/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Node Network", + "author": "Microsoft", + "galleries": [ + { "type": "container-insights", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 400 }, + { "type": "workbook", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 400 } + ] +} diff --git a/AKS/Workbooks/Workload Details AKS Engine/Workload Details AKS Engine.workbook b/AKS/Workbooks/Workload Details AKS Engine/Workload Details AKS Engine.workbook new file mode 100644 index 0000000..2676e63 --- /dev/null +++ b/AKS/Workbooks/Workload Details AKS Engine/Workload Details AKS Engine.workbook @@ -0,0 +1,1117 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "e2b5cd30-7276-477f-a6bb-07da25ba5e5f", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter data by time range", + "isRequired": true, + "value": { + "durationMs": 2592000000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "9767de49-ba31-4847-9ffc-714c02e7523c", + "version": "KqlParameterItem/1.0", + "name": "clusterId", + "type": 1, + "description": "Filter the selected workspace by cluster id", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components", + "value": "" + }, + { + "id": "cba109cf-db6e-4261-8d3a-fe038593622d", + "version": "KqlParameterItem/1.0", + "name": "clusterIdWhereClause", + "type": 1, + "description": "use this to filter by clusterid ", + "value": "| where \"a\" == \"a\"", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (clusterId is not empty ), result = '| where ClusterId =~ '{clusterId}''", + "criteriaContext": { + "leftOperand": "clusterId", + "operator": "isNotNull", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where ClusterId =~ '{clusterId}'" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "ee080bd8-83dc-4fa0-b688-b2f16b956b92", + "version": "KqlParameterItem/1.0", + "name": "workloadType", + "label": "Workload Type", + "type": 2, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n| distinct ControllerKind", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + }, + { + "id": "cf611d4b-aa93-4949-a7a1-c1d174af29ca", + "version": "KqlParameterItem/1.0", + "name": "workloadKindWhereClause", + "type": 1, + "value": "| where \"a\" == \"a\"", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (workloadType is not empty ), result = '| where ControllerKind in ({workloadType})'", + "criteriaContext": { + "leftOperand": "workloadType", + "operator": "isNotNull", + "rightValType": "static", + "rightVal": "unset", + "resultValType": "static", + "resultVal": "| where ControllerKind in ({workloadType})" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "034caae5-bee3-4b66-8f80-c120a2a25c77", + "version": "KqlParameterItem/1.0", + "name": "namespace", + "label": "Namespace", + "type": 2, + "description": "Filter the workbook by namespace", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n{workloadKindWhereClause}\r\n| distinct Namespace", + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "faeee248-e4c3-4fae-b435-ef5fb6dabe3b", + "version": "KqlParameterItem/1.0", + "name": "namespaceWhereClause", + "type": 1, + "value": "| where \"a\" == \"a\"", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (namespace is not empty ), result = '| where Namespace in ({namespace})'", + "criteriaContext": { + "leftOperand": "namespace", + "operator": "isNotNull", + "rightValType": "static", + "rightVal": "unset", + "resultValType": "static", + "resultVal": "| where Namespace in ({namespace})" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "8943e259-1dde-44cd-a00b-e815eea9de34", + "version": "KqlParameterItem/1.0", + "name": "workloadName", + "label": "Workload Name", + "type": 2, + "description": "Filter the data for a particular workbook", + "isRequired": true, + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n{namespaceWhereClause}\r\n{workloadKindWhereClause}\r\n| distinct ControllerName", + "value": "value::1", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "00a9be6c-ab0b-400b-b195-9775a47ecddd", + "version": "KqlParameterItem/1.0", + "name": "podStatus", + "label": "Pod Status", + "type": 2, + "description": "Filter by Pod status like Pending/Running/Failed etc.", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n| where ControllerName == '{workloadName:value}'\r\n| distinct PodStatus", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "388ea6aa-12d8-485a-8e80-b4d7b8994bd8", + "version": "KqlParameterItem/1.0", + "name": "podStatusWhereClause", + "type": 1, + "value": "| where PodStatus in ('Running','Failed','Pending')", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (podStatus is not empty ), result = '| where PodStatus in ({podStatus})'", + "criteriaContext": { + "leftOperand": "podStatus", + "operator": "isNotNull", + "rightValType": "static", + "rightVal": "unset", + "resultValType": "static", + "resultVal": "| where PodStatus in ({podStatus})" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "64de23e6-96b5-4105-b65d-36e40f73f4ec", + "version": "KqlParameterItem/1.0", + "name": "podName", + "label": "Pod Name", + "type": 2, + "description": "Filter by pod name ", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n| where ControllerName == '{workloadName:value}'\r\n{podStatusWhereClause}\r\n| summarize arg_max(TimeGenerated, PodStatus) by Name\r\n| project Name", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "4f7059c2-ebd7-4fc2-86c4-c51e66703582", + "version": "KqlParameterItem/1.0", + "name": "podNameWhereClause", + "type": 1, + "value": "| where PodName in ('vishwa-all-logs-100persec-77b8cd9d55-hlbxt','vishwa-all-logs-100persec-77b8cd9d55-tczsv','vishwa-all-logs-100persec-77b8cd9d55-mt85n','vishwa-all-logs-100persec-77b8cd9d55-fgzcp','vishwa-all-logs-100persec-77b8cd9d55-vkvd4','vishwa-all-logs-100persec-77b8cd9d55-tthg7','vishwa-all-logs-100persec-77b8cd9d55-8kr9m','vishwa-all-logs-100persec-77b8cd9d55-6m5gz','vishwa-all-logs-100persec-77b8cd9d55-vn7vx')", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (podName is not empty ), result = '| where PodName in ({podName})'", + "criteriaContext": { + "leftOperand": "podName", + "operator": "isNotNull", + "rightValType": "static", + "rightVal": "unset", + "resultValType": "static", + "resultVal": "| where PodName in ({podName})" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "e60298ff-36da-485e-acea-73c0692b8446", + "version": "KqlParameterItem/1.0", + "name": "workloadNameSpace", + "type": 1, + "description": "for displaying name space of the selected workload", + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n| where ControllerName == '{workloadName}'\r\n| take 1 \r\n| project Namespace", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "9f8d0d65-d7bc-42c9-bc5c-b394288b5216", + "version": "KqlParameterItem/1.0", + "name": "workloadTypeText", + "type": 1, + "description": "for displaying workload type of the selected workload", + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n| where ControllerName == '{workloadName}'\r\n| take 1 \r\n| project ControllerKind", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "dropwdowns" + }, + { + "type": 1, + "content": { + "json": "

\r\n{workloadName} | {workloadTypeText} | Namespace: {workloadNameSpace}\r\n

" + }, + "conditionalVisibility": { + "parameterName": "workloadNameSpace", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "text - 10", + "styleSettings": { + "margin": "0 0 0 0", + "padding": "0px", + "progressStyle": "loader" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "POD/Container Status", + "subTarget": "Status", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Kubernetes Events", + "subTarget": "Events", + "style": "link" + } + ] + }, + "name": "links - 11" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nlet capacityCounterName = 'cpuLimitNanoCores';\r\nlet usageCounterName = 'cpuUsageNanoCores';\r\nlet controllerName= '{workloadName:value}';\r\nKubePodInventory\r\n| where TimeGenerated < endDateTime\r\n| where TimeGenerated >= startDateTime\r\n{clusterIdWhereClause}\r\n| where ControllerName in (controllerName)\r\n| extend InstanceName = strcat(ClusterId, '/', ContainerName),\r\n ContainerName = strcat(controllerName, '/', tostring(split(ContainerName, '/')[1])),\r\n PodName = Name\r\n{podStatusWhereClause}\r\n{podNameWhereClause}\r\n| distinct Computer, InstanceName, ContainerName\r\n| join hint.strategy=shuffle (\r\n Perf\r\n | where TimeGenerated < endDateTime\r\n | where TimeGenerated >= startDateTime\r\n | where ObjectName == 'K8SContainer'\r\n | where CounterName == capacityCounterName\r\n | summarize LimitValue = max(CounterValue) by Computer, InstanceName, bin(TimeGenerated, trendBinSize)\r\n | project Computer, InstanceName, LimitStartTime = TimeGenerated, LimitEndTime = TimeGenerated + trendBinSize, LimitValue, limitA=100\r\n) on Computer, InstanceName\r\n| join kind=inner hint.strategy=shuffle (\r\n Perf\r\n | where TimeGenerated < endDateTime + trendBinSize\r\n | where TimeGenerated >= startDateTime - trendBinSize\r\n | where ObjectName == 'K8SContainer'\r\n | where CounterName == usageCounterName\r\n | project Computer, InstanceName, UsageValue = CounterValue, limit=100, TimeGenerated\r\n) on Computer, InstanceName\r\n| where TimeGenerated >= LimitStartTime and TimeGenerated < LimitEndTime\r\n| project ContainerName, TimeGenerated, UsagePercent = UsageValue * 100.0 / LimitValue \r\n| summarize AggregatedValue=max(UsagePercent) by bin(TimeGenerated, trendBinSize), ContainerName", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "title": "Max CPU usage by PODs", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "chartSettings": { + "ySettings": { + "unit": 1, + "min": null, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "1", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nlet capacityCounterName = 'memoryLimitBytes';\r\nlet usageCounterName = 'memoryRssBytes';\r\nlet controllerName= '{workloadName:value}';\r\nKubePodInventory\r\n| where TimeGenerated < endDateTime\r\n| where TimeGenerated >= startDateTime\r\n{clusterIdWhereClause}\r\n| where ControllerName == controllerName\r\n| extend InstanceName = strcat(ClusterId, '/', ContainerName),\r\n ContainerName = strcat(controllerName, '/', tostring(split(ContainerName, '/')[1])),\r\n PodName=Name\r\n{podStatusWhereClause}\r\n{podNameWhereClause}\r\n| distinct Computer, InstanceName, ContainerName\r\n| join hint.strategy=shuffle (\r\n Perf\r\n | where TimeGenerated < endDateTime\r\n | where TimeGenerated >= startDateTime\r\n | where ObjectName == 'K8SContainer'\r\n | where CounterName == capacityCounterName\r\n | summarize LimitValue = max(CounterValue) by Computer, InstanceName, bin(TimeGenerated, trendBinSize)\r\n | project Computer, InstanceName, LimitStartTime = TimeGenerated, LimitEndTime = TimeGenerated + trendBinSize, LimitValue\r\n) on Computer, InstanceName\r\n| join kind=inner hint.strategy=shuffle (\r\n Perf\r\n | where TimeGenerated < endDateTime + trendBinSize\r\n | where TimeGenerated >= startDateTime - trendBinSize\r\n | where ObjectName == 'K8SContainer'\r\n | where CounterName == usageCounterName\r\n | project Computer, InstanceName, UsageValue = CounterValue, TimeGenerated\r\n) on Computer, InstanceName\r\n| where TimeGenerated >= LimitStartTime and TimeGenerated < LimitEndTime\r\n| project Computer, ContainerName, TimeGenerated, UsagePercent = UsageValue * 100.0 / LimitValue\r\n| summarize AggregatedValue = max(UsagePercent) by bin(TimeGenerated, trendBinSize) , ContainerName\r\n", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "title": "Max Memory usage by PODs", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "chartSettings": { + "ySettings": { + "unit": 1, + "min": null, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "2", + "styleSettings": { + "showBorder": true + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let controllerName= '{workloadName:value}';\r\nlet endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nKubePodInventory\r\n| where TimeGenerated >= startDateTime\r\n| where TimeGenerated < endDateTime\r\n{clusterIdWhereClause}\r\n| where isnotempty(ClusterName)\r\n| where isnotempty(Namespace)\r\n| where ControllerName == controllerName\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podNameWhereClause}\r\n| summarize PodStatus = any(PodStatus) by PodName, TimeGenerated\r\n| make-series Trend = dcount(PodName) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step trendBinSize by PodStatus\r\n| extend PodCount=Trend[(arraylength(Trend)-1)]", + "size": 3, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "exportFieldName": "PodStatus", + "exportParameterName": "podStatusTileText", + "exportDefaultValue": "All", + "exportToExcelOptions": "all", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "PodStatus", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Running", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Pending", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Failed", + "representation": "red", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": null, + "text": "{0}{1}" + } + ] + } + }, + "leftContent": { + "columnMatch": "PodCount", + "formatter": 12, + "formatOptions": {} + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue" + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "query - 5" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "55cc0c6d-51df-4e58-9543-c8b21bc71e29", + "version": "KqlParameterItem/1.0", + "name": "podTileStatusWhereClause", + "type": 1, + "value": null, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (podStatusTileText != 'All'), result = '| where PodStatus == '{podStatusTileText}''", + "criteriaContext": { + "leftOperand": "podStatusTileText", + "operator": "!=", + "rightValType": "static", + "rightVal": "All", + "resultValType": "static", + "resultVal": "| where PodStatus == '{podStatusTileText}'" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nlet controllerName= '{workloadName:value}';\r\nKubePodInventory\r\n| where TimeGenerated >= startDateTime\r\n| where TimeGenerated < endDateTime\r\n{clusterIdWhereClause}\r\n| where isnotempty(ClusterName)\r\n| where isnotempty(Namespace)\r\n| where ControllerName == controllerName\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podTileStatusWhereClause}\r\n{podNameWhereClause}\r\n| summarize PodRestartCount=max(PodRestartCount) by PodName, bin(TimeGenerated, trendBinSize)\r\n| order by PodName asc nulls last, TimeGenerated asc\r\n| serialize \r\n| extend prevValue=iif(prev(PodName) == PodName, prev(PodRestartCount), PodRestartCount)\r\n| extend RestartCount=PodRestartCount - prevValue\r\n| extend RestartCount=iif(RestartCount < 0, 0, RestartCount) \r\n| project TimeGenerated, PodName, RestartCount\r\n| render timechart", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "POD restart trend", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "50", + "showPin": true, + "name": "5", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nlet controllerName= '{workloadName:value}';\r\nKubePodInventory\r\n| where TimeGenerated >= startDateTime\r\n| where TimeGenerated < endDateTime\r\n{clusterIdWhereClause}\r\n| where isnotempty(ClusterName)\r\n| where isnotempty(Namespace)\r\n| where ControllerName == controllerName\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podTileStatusWhereClause}\r\n{podNameWhereClause}\r\n| extend ContainerName=tostring(split(ContainerName, '/')[1])\r\n| where isempty(ContainerName) == false\r\n| summarize ContainerRestartCount=sum(ContainerRestartCount) by ContainerName, bin(TimeGenerated, 1tick)\r\n| order by ContainerName asc nulls last, TimeGenerated asc\r\n| serialize \r\n| extend prevValue=iif(prev(ContainerName) == ContainerName, prev(ContainerRestartCount), ContainerRestartCount)\r\n| extend RestartCount=ContainerRestartCount - prevValue\r\n| extend RestartCount=iif(RestartCount < 0, 0, RestartCount) \r\n| project TimeGenerated, ContainerName, RestartCount\r\n| summarize RestartCount=sum(RestartCount) by ContainerName, bin(TimeGenerated, trendBinSize)", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Container restart trend", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "5 - Copy", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nlet controllerName= '{workloadName:value}';\r\nKubePodInventory\r\n| where TimeGenerated >= startDateTime\r\n| where TimeGenerated < endDateTime\r\n{clusterIdWhereClause}\r\n| where isnotempty(ClusterName)\r\n| where isnotempty(Namespace)\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podTileStatusWhereClause}\r\n{podNameWhereClause}\r\n| where ControllerName == controllerName\r\n| extend InstanceName = strcat(ClusterId, '/', ContainerName),\r\n ContainerName = strcat(Name, '/', tostring(split(ContainerName, '/')[1]))\r\n| summarize arg_max(TimeGenerated, *) by ContainerName, Name| extend ContainerLastStatus = todynamic(ContainerLastStatus) \r\n| project TimeGenerated, ContainerName, PodStatus, ContainerStatus, LastState=ContainerLastStatus.lastState, LastStateReason=ContainerLastStatus.reason, LastStateStartTime=ContainerLastStatus.startedAt,\r\nLastStateFinishTime=ContainerLastStatus.finishedAt\r\n", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Latest container status for PODs", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "TimeGenerated", + "formatter": 6, + "formatOptions": {}, + "dateFormat": { + "showUtcTime": null, + "formatName": "shortDateTimePattern" + } + }, + { + "columnMatch": "PodStatus", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Running", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Pending", + "representation": "pending", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Failed", + "representation": "failed", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Blank", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ContainerStatus", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Running", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "waiting", + "representation": "pending", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "LastState", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "LastStateReason", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "LastStateStartTime", + "formatter": 6, + "formatOptions": {}, + "dateFormat": { + "showUtcTime": null, + "formatName": "shortDateTimePattern" + } + }, + { + "columnMatch": "LastStateFinishTime", + "formatter": 6, + "formatOptions": {}, + "dateFormat": { + "showUtcTime": null, + "formatName": "shortDateTimePattern" + } + } + ] + }, + "sortBy": [] + }, + "showPin": true, + "name": "query - 2 - Copy - Copy - Copy - Copy" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Status" + }, + "name": "POD/Container Status" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let controllerName= '{workloadName:value}';\r\nlet trendBinSize = {timeRange:grain};\r\nKubePodInventory\r\n{clusterIdWhereClause}\r\n| where ControllerName == controllerName\r\n| join KubeEvents\r\non Name, $left.Name == $right.Name\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podNameWhereClause}\r\n| summarize count() by KubeEventType \r\n\r\n", + "size": 4, + "showAnalytics": true, + "title": "Kube Events Types", + "noDataMessage": "There are no Kube events for the selected criteria", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "exportFieldName": "KubeEventType", + "exportParameterName": "kubeEventType", + "exportDefaultValue": "All", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "KubeEventType", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Error", + "representation": "redBright", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Warning", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Normal", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "gray", + "text": "{0}{1}" + } + ] + } + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false + } + }, + "customWidth": "30", + "showPin": true, + "name": "4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a6b031e3-3d7a-42f2-8cb5-07e8b0f8158c", + "version": "KqlParameterItem/1.0", + "name": "kubeEventWhereClause", + "type": 1, + "value": "| where KubeEventType == 'Warning'", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (kubeEventType != 'All'), result = '| where KubeEventType == '{kubeEventType}''", + "criteriaContext": { + "leftOperand": "kubeEventType", + "operator": "!=", + "rightValType": "static", + "rightVal": "All", + "resultValType": "static", + "resultVal": "| where KubeEventType == '{kubeEventType}'" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "1", + "name": "parameters - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let controllerName= '{workloadName:value}';\r\nlet trendBinSize = {timeRange:grain};\r\nKubePodInventory\r\n{clusterIdWhereClause}\r\n| where ControllerName == controllerName\r\n| join KubeEvents\r\non Name, $left.Name == $right.Name\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podNameWhereClause}\r\n{kubeEventWhereClause}\r\n| summarize count() by Reason \r\n\r\n", + "size": 4, + "showAnalytics": true, + "title": "Kube Event Reasons", + "noDataMessage": "There are no Kube events for the selected criteria", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "exportFieldName": "Reason", + "exportParameterName": "kubeEventReason", + "exportDefaultValue": "All", + "exportToExcelOptions": "all", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "titleContent": { + "columnMatch": "KubeEventType", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Error", + "representation": "redBright", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Warning", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Normal", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "gray", + "text": "{0}{1}" + } + ] + } + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false + } + }, + "customWidth": "60", + "showPin": true, + "name": "4 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nlet controllerName= '{workloadName:value}';\r\nKubePodInventory\r\n| where TimeGenerated >= startDateTime\r\n| where TimeGenerated < endDateTime\r\n{clusterIdWhereClause}\r\n| where isnotempty(ClusterName)\r\n| where isnotempty(Namespace)\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podNameWhereClause}\r\n| join (KubeEvents\r\n{kubeEventWhereClause}\r\n| where TimeGenerated >= startDateTime\r\n| where TimeGenerated < endDateTime)\r\non Name, $left.Name == $right.Name\r\n| where ControllerName == controllerName\r\n| extend Priority = iif(isempty(Computer), 1, 0)\r\n| order by Priority desc, TimeGenerated desc\r\n| project TimeGenerated, KubeEventType, PodName=Name,Reason, EventMessage=Message, NodeName=Computer\r\n", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Kube Events for the controller", + "noDataMessage": "There are no kube events for the selected criteria", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "TimeGenerated", + "formatter": 6, + "formatOptions": {}, + "dateFormat": { + "showUtcTime": null, + "formatName": "shortDateTimePattern" + } + }, + { + "columnMatch": "KubeEventType", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Warning", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Normal", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Error", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "NodeName", + "formatter": 5, + "formatOptions": {} + } + ], + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "NodeName" + ], + "expandTopLevel": true + } + } + }, + "showPin": true, + "name": "7" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Events" + }, + "name": "Kubernetes Events" + } + ], + "fallbackResourceIds": [], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/AKS/Workbooks/Workload Details AKS Engine/settings.json b/AKS/Workbooks/Workload Details AKS Engine/settings.json new file mode 100644 index 0000000..580de64 --- /dev/null +++ b/AKS/Workbooks/Workload Details AKS Engine/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Workload Details", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "container-insights", "resourceType": "Microsoft.operationalinsights/workspaces", "order": 700 } + ] +} diff --git a/AKS/Workbooks/Workload Details AKS/Workload Details AKS.workbook b/AKS/Workbooks/Workload Details AKS/Workload Details AKS.workbook new file mode 100644 index 0000000..8c83a0d --- /dev/null +++ b/AKS/Workbooks/Workload Details AKS/Workload Details AKS.workbook @@ -0,0 +1,1117 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "e2b5cd30-7276-477f-a6bb-07da25ba5e5f", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "description": "Filter data by time range", + "isRequired": true, + "value": { + "durationMs": 2592000000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "9767de49-ba31-4847-9ffc-714c02e7523c", + "version": "KqlParameterItem/1.0", + "name": "clusterId", + "type": 1, + "description": "Filter the selected workspace by cluster id", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components", + "value": "" + }, + { + "id": "cba109cf-db6e-4261-8d3a-fe038593622d", + "version": "KqlParameterItem/1.0", + "name": "clusterIdWhereClause", + "type": 1, + "description": "use this to filter by clusterid ", + "value": "| where \"a\" == \"a\"", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (clusterId is not empty ), result = '| where ClusterId =~ '{clusterId}''", + "criteriaContext": { + "leftOperand": "clusterId", + "operator": "isNotNull", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where ClusterId =~ '{clusterId}'" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "ee080bd8-83dc-4fa0-b688-b2f16b956b92", + "version": "KqlParameterItem/1.0", + "name": "workloadType", + "label": "Workload Type", + "type": 2, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n| distinct ControllerKind", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "value": null + }, + { + "id": "cf611d4b-aa93-4949-a7a1-c1d174af29ca", + "version": "KqlParameterItem/1.0", + "name": "workloadKindWhereClause", + "type": 1, + "value": "| where \"a\" == \"a\"", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (workloadType is not empty ), result = '| where ControllerKind in ({workloadType})'", + "criteriaContext": { + "leftOperand": "workloadType", + "operator": "isNotNull", + "rightValType": "static", + "rightVal": "unset", + "resultValType": "static", + "resultVal": "| where ControllerKind in ({workloadType})" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "034caae5-bee3-4b66-8f80-c120a2a25c77", + "version": "KqlParameterItem/1.0", + "name": "namespace", + "label": "Namespace", + "type": 2, + "description": "Filter the workbook by namespace", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n{workloadKindWhereClause}\r\n| distinct Namespace", + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + { + "id": "faeee248-e4c3-4fae-b435-ef5fb6dabe3b", + "version": "KqlParameterItem/1.0", + "name": "namespaceWhereClause", + "type": 1, + "value": "| where \"a\" == \"a\"", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (namespace is not empty ), result = '| where Namespace in ({namespace})'", + "criteriaContext": { + "leftOperand": "namespace", + "operator": "isNotNull", + "rightValType": "static", + "rightVal": "unset", + "resultValType": "static", + "resultVal": "| where Namespace in ({namespace})" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "8943e259-1dde-44cd-a00b-e815eea9de34", + "version": "KqlParameterItem/1.0", + "name": "workloadName", + "label": "Workload Name", + "type": 2, + "description": "Filter the data for a particular workbook", + "isRequired": true, + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n{namespaceWhereClause}\r\n{workloadKindWhereClause}\r\n| distinct ControllerName", + "value": "value::1", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + { + "id": "00a9be6c-ab0b-400b-b195-9775a47ecddd", + "version": "KqlParameterItem/1.0", + "name": "podStatus", + "label": "Pod Status", + "type": 2, + "description": "Filter by Pod status like Pending/Running/Failed etc.", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n| where ControllerName == '{workloadName:value}'\r\n| distinct PodStatus", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + { + "id": "388ea6aa-12d8-485a-8e80-b4d7b8994bd8", + "version": "KqlParameterItem/1.0", + "name": "podStatusWhereClause", + "type": 1, + "value": "| where PodStatus in ('Running','Failed','Pending')", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (podStatus is not empty ), result = '| where PodStatus in ({podStatus})'", + "criteriaContext": { + "leftOperand": "podStatus", + "operator": "isNotNull", + "rightValType": "static", + "rightVal": "unset", + "resultValType": "static", + "resultVal": "| where PodStatus in ({podStatus})" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "64de23e6-96b5-4105-b65d-36e40f73f4ec", + "version": "KqlParameterItem/1.0", + "name": "podName", + "label": "Pod Name", + "type": 2, + "description": "Filter by pod name ", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n| where ControllerName == '{workloadName:value}'\r\n{podStatusWhereClause}\r\n| summarize arg_max(TimeGenerated, PodStatus) by Name\r\n| project Name", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + { + "id": "4f7059c2-ebd7-4fc2-86c4-c51e66703582", + "version": "KqlParameterItem/1.0", + "name": "podNameWhereClause", + "type": 1, + "value": "| where PodName in ('vishwa-all-logs-100persec-77b8cd9d55-hlbxt','vishwa-all-logs-100persec-77b8cd9d55-tczsv','vishwa-all-logs-100persec-77b8cd9d55-mt85n','vishwa-all-logs-100persec-77b8cd9d55-fgzcp','vishwa-all-logs-100persec-77b8cd9d55-vkvd4','vishwa-all-logs-100persec-77b8cd9d55-tthg7','vishwa-all-logs-100persec-77b8cd9d55-8kr9m','vishwa-all-logs-100persec-77b8cd9d55-6m5gz','vishwa-all-logs-100persec-77b8cd9d55-vn7vx')", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (podName is not empty ), result = '| where PodName in ({podName})'", + "criteriaContext": { + "leftOperand": "podName", + "operator": "isNotNull", + "rightValType": "static", + "rightVal": "unset", + "resultValType": "static", + "resultVal": "| where PodName in ({podName})" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "e60298ff-36da-485e-acea-73c0692b8446", + "version": "KqlParameterItem/1.0", + "name": "workloadNameSpace", + "type": 1, + "description": "for displaying name space of the selected workload", + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n| where ControllerName == '{workloadName}'\r\n| take 1 \r\n| project Namespace", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + { + "id": "9f8d0d65-d7bc-42c9-bc5c-b394288b5216", + "version": "KqlParameterItem/1.0", + "name": "workloadTypeText", + "type": 1, + "description": "for displaying workload type of the selected workload", + "query": "KubePodInventory\r\n{clusterIdWhereClause}\r\n| where ControllerName == '{workloadName}'\r\n| take 1 \r\n| project ControllerKind", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "dropwdowns" + }, + { + "type": 1, + "content": { + "json": "

\r\n{workloadName} | {workloadTypeText} | Namespace: {workloadNameSpace}\r\n

" + }, + "conditionalVisibility": { + "parameterName": "workloadNameSpace", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "text - 10", + "styleSettings": { + "margin": "0 0 0 0", + "padding": "0px", + "progressStyle": "loader" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "POD/Container Status", + "subTarget": "Status", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Kubernetes Events", + "subTarget": "Events", + "style": "link" + } + ] + }, + "name": "links - 11" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nlet capacityCounterName = 'cpuLimitNanoCores';\r\nlet usageCounterName = 'cpuUsageNanoCores';\r\nlet controllerName= '{workloadName:value}';\r\nKubePodInventory\r\n| where TimeGenerated < endDateTime\r\n| where TimeGenerated >= startDateTime\r\n{clusterIdWhereClause}\r\n| where ControllerName in (controllerName)\r\n| extend InstanceName = strcat(ClusterId, '/', ContainerName),\r\n ContainerName = strcat(controllerName, '/', tostring(split(ContainerName, '/')[1])),\r\n PodName = Name\r\n{podStatusWhereClause}\r\n{podNameWhereClause}\r\n| distinct Computer, InstanceName, ContainerName\r\n| join hint.strategy=shuffle (\r\n Perf\r\n | where TimeGenerated < endDateTime\r\n | where TimeGenerated >= startDateTime\r\n | where ObjectName == 'K8SContainer'\r\n | where CounterName == capacityCounterName\r\n | summarize LimitValue = max(CounterValue) by Computer, InstanceName, bin(TimeGenerated, trendBinSize)\r\n | project Computer, InstanceName, LimitStartTime = TimeGenerated, LimitEndTime = TimeGenerated + trendBinSize, LimitValue, limitA=100\r\n) on Computer, InstanceName\r\n| join kind=inner hint.strategy=shuffle (\r\n Perf\r\n | where TimeGenerated < endDateTime + trendBinSize\r\n | where TimeGenerated >= startDateTime - trendBinSize\r\n | where ObjectName == 'K8SContainer'\r\n | where CounterName == usageCounterName\r\n | project Computer, InstanceName, UsageValue = CounterValue, limit=100, TimeGenerated\r\n) on Computer, InstanceName\r\n| where TimeGenerated >= LimitStartTime and TimeGenerated < LimitEndTime\r\n| project ContainerName, TimeGenerated, UsagePercent = UsageValue * 100.0 / LimitValue \r\n| summarize AggregatedValue=max(UsagePercent) by bin(TimeGenerated, trendBinSize), ContainerName", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "title": "Max CPU usage by PODs", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart", + "chartSettings": { + "ySettings": { + "unit": 1, + "min": null, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "1", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nlet capacityCounterName = 'memoryLimitBytes';\r\nlet usageCounterName = 'memoryRssBytes';\r\nlet controllerName= '{workloadName:value}';\r\nKubePodInventory\r\n| where TimeGenerated < endDateTime\r\n| where TimeGenerated >= startDateTime\r\n{clusterIdWhereClause}\r\n| where ControllerName == controllerName\r\n| extend InstanceName = strcat(ClusterId, '/', ContainerName),\r\n ContainerName = strcat(controllerName, '/', tostring(split(ContainerName, '/')[1])),\r\n PodName=Name\r\n{podStatusWhereClause}\r\n{podNameWhereClause}\r\n| distinct Computer, InstanceName, ContainerName\r\n| join hint.strategy=shuffle (\r\n Perf\r\n | where TimeGenerated < endDateTime\r\n | where TimeGenerated >= startDateTime\r\n | where ObjectName == 'K8SContainer'\r\n | where CounterName == capacityCounterName\r\n | summarize LimitValue = max(CounterValue) by Computer, InstanceName, bin(TimeGenerated, trendBinSize)\r\n | project Computer, InstanceName, LimitStartTime = TimeGenerated, LimitEndTime = TimeGenerated + trendBinSize, LimitValue\r\n) on Computer, InstanceName\r\n| join kind=inner hint.strategy=shuffle (\r\n Perf\r\n | where TimeGenerated < endDateTime + trendBinSize\r\n | where TimeGenerated >= startDateTime - trendBinSize\r\n | where ObjectName == 'K8SContainer'\r\n | where CounterName == usageCounterName\r\n | project Computer, InstanceName, UsageValue = CounterValue, TimeGenerated\r\n) on Computer, InstanceName\r\n| where TimeGenerated >= LimitStartTime and TimeGenerated < LimitEndTime\r\n| project Computer, ContainerName, TimeGenerated, UsagePercent = UsageValue * 100.0 / LimitValue\r\n| summarize AggregatedValue = max(UsagePercent) by bin(TimeGenerated, trendBinSize) , ContainerName\r\n", + "size": 0, + "aggregation": 2, + "showAnalytics": true, + "title": "Max Memory usage by PODs", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart", + "chartSettings": { + "ySettings": { + "unit": 1, + "min": null, + "max": null + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "2", + "styleSettings": { + "showBorder": true + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let controllerName= '{workloadName:value}';\r\nlet endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nKubePodInventory\r\n| where TimeGenerated >= startDateTime\r\n| where TimeGenerated < endDateTime\r\n{clusterIdWhereClause}\r\n| where isnotempty(ClusterName)\r\n| where isnotempty(Namespace)\r\n| where ControllerName == controllerName\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podNameWhereClause}\r\n| summarize PodStatus = any(PodStatus) by PodName, TimeGenerated\r\n| make-series Trend = dcount(PodName) default=0 on TimeGenerated from {timeRange:start} to {timeRange:end} step trendBinSize by PodStatus\r\n| extend PodCount=Trend[(arraylength(Trend)-1)]", + "size": 3, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "exportFieldName": "PodStatus", + "exportParameterName": "podStatusTileText", + "exportDefaultValue": "All", + "exportToExcelOptions": "all", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "PodStatus", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Running", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Pending", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Failed", + "representation": "red", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": null, + "text": "{0}{1}" + } + ] + } + }, + "leftContent": { + "columnMatch": "PodCount", + "formatter": 12, + "formatOptions": {} + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue" + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "query - 5" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "55cc0c6d-51df-4e58-9543-c8b21bc71e29", + "version": "KqlParameterItem/1.0", + "name": "podTileStatusWhereClause", + "type": 1, + "value": null, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (podStatusTileText != 'All'), result = '| where PodStatus == '{podStatusTileText}''", + "criteriaContext": { + "leftOperand": "podStatusTileText", + "operator": "!=", + "rightValType": "static", + "rightVal": "All", + "resultValType": "static", + "resultVal": "| where PodStatus == '{podStatusTileText}'" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nlet controllerName= '{workloadName:value}';\r\nKubePodInventory\r\n| where TimeGenerated >= startDateTime\r\n| where TimeGenerated < endDateTime\r\n{clusterIdWhereClause}\r\n| where isnotempty(ClusterName)\r\n| where isnotempty(Namespace)\r\n| where ControllerName == controllerName\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podTileStatusWhereClause}\r\n{podNameWhereClause}\r\n| summarize PodRestartCount=max(PodRestartCount) by PodName, bin(TimeGenerated, trendBinSize)\r\n| order by PodName asc nulls last, TimeGenerated asc\r\n| serialize \r\n| extend prevValue=iif(prev(PodName) == PodName, prev(PodRestartCount), PodRestartCount)\r\n| extend RestartCount=PodRestartCount - prevValue\r\n| extend RestartCount=iif(RestartCount < 0, 0, RestartCount) \r\n| project TimeGenerated, PodName, RestartCount\r\n| render timechart", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "POD restart trend", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + "customWidth": "50", + "showPin": true, + "name": "5", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nlet controllerName= '{workloadName:value}';\r\nKubePodInventory\r\n| where TimeGenerated >= startDateTime\r\n| where TimeGenerated < endDateTime\r\n{clusterIdWhereClause}\r\n| where isnotempty(ClusterName)\r\n| where isnotempty(Namespace)\r\n| where ControllerName == controllerName\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podTileStatusWhereClause}\r\n{podNameWhereClause}\r\n| extend ContainerName=tostring(split(ContainerName, '/')[1])\r\n| where isempty(ContainerName) == false\r\n| summarize ContainerRestartCount=sum(ContainerRestartCount) by ContainerName, bin(TimeGenerated, 1tick)\r\n| order by ContainerName asc nulls last, TimeGenerated asc\r\n| serialize \r\n| extend prevValue=iif(prev(ContainerName) == ContainerName, prev(ContainerRestartCount), ContainerRestartCount)\r\n| extend RestartCount=ContainerRestartCount - prevValue\r\n| extend RestartCount=iif(RestartCount < 0, 0, RestartCount) \r\n| project TimeGenerated, ContainerName, RestartCount\r\n| summarize RestartCount=sum(RestartCount) by ContainerName, bin(TimeGenerated, trendBinSize)", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Container restart trend", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "5 - Copy", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nlet controllerName= '{workloadName:value}';\r\nKubePodInventory\r\n| where TimeGenerated >= startDateTime\r\n| where TimeGenerated < endDateTime\r\n{clusterIdWhereClause}\r\n| where isnotempty(ClusterName)\r\n| where isnotempty(Namespace)\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podTileStatusWhereClause}\r\n{podNameWhereClause}\r\n| where ControllerName == controllerName\r\n| extend InstanceName = strcat(ClusterId, '/', ContainerName),\r\n ContainerName = strcat(Name, '/', tostring(split(ContainerName, '/')[1]))\r\n| summarize arg_max(TimeGenerated, *) by ContainerName, Name| extend ContainerLastStatus = todynamic(ContainerLastStatus) \r\n| project TimeGenerated, ContainerName, PodStatus, ContainerStatus, LastState=ContainerLastStatus.lastState, LastStateReason=ContainerLastStatus.reason, LastStateStartTime=ContainerLastStatus.startedAt,\r\nLastStateFinishTime=ContainerLastStatus.finishedAt\r\n", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Latest container status for PODs", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "gridSettings": { + "formatters": [ + { + "columnMatch": "TimeGenerated", + "formatter": 6, + "formatOptions": {}, + "dateFormat": { + "showUtcTime": null, + "formatName": "shortDateTimePattern" + } + }, + { + "columnMatch": "PodStatus", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Running", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Pending", + "representation": "pending", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Failed", + "representation": "failed", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Blank", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ContainerStatus", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Running", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "waiting", + "representation": "pending", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "LastState", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "LastStateReason", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "LastStateStartTime", + "formatter": 6, + "formatOptions": {}, + "dateFormat": { + "showUtcTime": null, + "formatName": "shortDateTimePattern" + } + }, + { + "columnMatch": "LastStateFinishTime", + "formatter": 6, + "formatOptions": {}, + "dateFormat": { + "showUtcTime": null, + "formatName": "shortDateTimePattern" + } + } + ] + }, + "sortBy": [] + }, + "showPin": true, + "name": "query - 2 - Copy - Copy - Copy - Copy" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Status" + }, + "name": "POD/Container Status" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let controllerName= '{workloadName:value}';\r\nlet trendBinSize = {timeRange:grain};\r\nKubePodInventory\r\n{clusterIdWhereClause}\r\n| where ControllerName == controllerName\r\n| join KubeEvents\r\non Name, $left.Name == $right.Name\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podNameWhereClause}\r\n| summarize count() by KubeEventType \r\n\r\n", + "size": 4, + "showAnalytics": true, + "title": "Kube Events Types", + "noDataMessage": "There are no Kube events for the selected criteria", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "exportFieldName": "KubeEventType", + "exportParameterName": "kubeEventType", + "exportDefaultValue": "All", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "KubeEventType", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Error", + "representation": "redBright", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Warning", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Normal", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "gray", + "text": "{0}{1}" + } + ] + } + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false + } + }, + "customWidth": "30", + "showPin": true, + "name": "4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a6b031e3-3d7a-42f2-8cb5-07e8b0f8158c", + "version": "KqlParameterItem/1.0", + "name": "kubeEventWhereClause", + "type": 1, + "value": "| where KubeEventType == 'Warning'", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (kubeEventType != 'All'), result = '| where KubeEventType == '{kubeEventType}''", + "criteriaContext": { + "leftOperand": "kubeEventType", + "operator": "!=", + "rightValType": "static", + "rightVal": "All", + "resultValType": "static", + "resultVal": "| where KubeEventType == '{kubeEventType}'" + } + }, + { + "condition": "else result = '| where \"a\" == \"a\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where \"a\" == \"a\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters" + }, + "customWidth": "1", + "name": "parameters - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let controllerName= '{workloadName:value}';\r\nlet trendBinSize = {timeRange:grain};\r\nKubePodInventory\r\n{clusterIdWhereClause}\r\n| where ControllerName == controllerName\r\n| join KubeEvents\r\non Name, $left.Name == $right.Name\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podNameWhereClause}\r\n{kubeEventWhereClause}\r\n| summarize count() by Reason \r\n\r\n", + "size": 4, + "showAnalytics": true, + "title": "Kube Event Reasons", + "noDataMessage": "There are no Kube events for the selected criteria", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "timeRange", + "exportFieldName": "Reason", + "exportParameterName": "kubeEventReason", + "exportDefaultValue": "All", + "exportToExcelOptions": "all", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "piechart", + "tileSettings": { + "titleContent": { + "columnMatch": "KubeEventType", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Error", + "representation": "redBright", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Warning", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Normal", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "gray", + "text": "{0}{1}" + } + ] + } + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false + } + }, + "customWidth": "60", + "showPin": true, + "name": "4 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let endDateTime = {timeRange:end};\r\nlet startDateTime = {timeRange:start};\r\nlet trendBinSize = {timeRange:grain};\r\nlet controllerName= '{workloadName:value}';\r\nKubePodInventory\r\n| where TimeGenerated >= startDateTime\r\n| where TimeGenerated < endDateTime\r\n{clusterIdWhereClause}\r\n| where isnotempty(ClusterName)\r\n| where isnotempty(Namespace)\r\n| extend PodName = Name\r\n{podStatusWhereClause}\r\n{podNameWhereClause}\r\n| join (KubeEvents\r\n{kubeEventWhereClause}\r\n| where TimeGenerated >= startDateTime\r\n| where TimeGenerated < endDateTime)\r\non Name, $left.Name == $right.Name\r\n| where ControllerName == controllerName\r\n| extend Priority = iif(isempty(Computer), 1, 0)\r\n| order by Priority desc, TimeGenerated desc\r\n| project TimeGenerated, KubeEventType, PodName=Name,Reason, EventMessage=Message, NodeName=Computer\r\n", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Kube Events for the controller", + "noDataMessage": "There are no kube events for the selected criteria", + "queryType": 0, + "resourceType": "microsoft.containerservice/managedclusters", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "TimeGenerated", + "formatter": 6, + "formatOptions": {}, + "dateFormat": { + "showUtcTime": null, + "formatName": "shortDateTimePattern" + } + }, + { + "columnMatch": "KubeEventType", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Warning", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Normal", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Error", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "NodeName", + "formatter": 5, + "formatOptions": {} + } + ], + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "NodeName" + ], + "expandTopLevel": true + } + } + }, + "showPin": true, + "name": "7" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Events" + }, + "name": "Kubernetes Events" + } + ], + "fallbackResourceIds": [], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/AKS/Workbooks/Workload Details AKS/settings.json b/AKS/Workbooks/Workload Details AKS/settings.json new file mode 100644 index 0000000..cf780fd --- /dev/null +++ b/AKS/Workbooks/Workload Details AKS/settings.json @@ -0,0 +1,10 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Workload Details", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "container-insights", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 700 }, + { "type": "workbook", "resourceType": "Microsoft.ContainerService/managedClusters", "order": 700 } + ] +} diff --git a/AKS/Workbooks/categoryResources.json b/AKS/Workbooks/categoryResources.json new file mode 100644 index 0000000..d3b2ef7 --- /dev/null +++ b/AKS/Workbooks/categoryResources.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": { + "name": "AKS", + "description": "Workbooks related to AKS", + "order": 100 + } +} \ No newline at end of file diff --git a/App Hub/Alerts/README b/App Hub/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/App Hub/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/App Hub/Queries/README b/App Hub/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/App Hub/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/App Hub/Workbooks/App summary/App summary.workbook b/App Hub/Workbooks/App summary/App summary.workbook new file mode 100644 index 0000000..59869de --- /dev/null +++ b/App Hub/Workbooks/App summary/App summary.workbook @@ -0,0 +1,273 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "f3c4a813-95b0-4bfd-bedd-154609834857", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "fb0838e9-2e2e-4c9d-90ed-9e3d9b639b62", + "version": "KqlParameterItem/1.0", + "name": "Application", + "type": 5, + "isRequired": true, + "value": "value::1", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.insights/components": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "### {Application:name}" + }, + "name": "text - 4" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "nav", + "links": [ + { + "cellValue": "{Application}", + "linkTarget": "Resource", + "linkLabel": "Failures", + "subTarget": "failures", + "preText": "", + "style": "link" + }, + { + "cellValue": "{Application}", + "linkTarget": "Resource", + "linkLabel": "Performance", + "subTarget": "performance", + "style": "link" + }, + { + "cellValue": "{Application}", + "linkTarget": "Resource", + "linkLabel": "Availability", + "subTarget": "availability", + "style": "link" + }, + { + "cellValue": "{Application}", + "linkTarget": "Resource", + "linkLabel": "Usage", + "subTarget": "segmentationUsers", + "style": "link" + } + ] + }, + "name": "Unknown - 5" + }, + { + "type": 1, + "content": { + "json": "
" + }, + "name": "text - 6" + }, + { + "type": 10, + "content": { + "chartId": "workbook3a7e6bfb-1f43-4376-add5-3cb3fc80f3b8", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 3, + "color": "orange", + "resourceIds": [ + "{Application}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Application", + "metrics": [ + { + "namespace": "microsoft.insights/components/kusto", + "metric": "microsoft.insights/components/kusto-Failure-requests/failed", + "aggregation": 1, + "splitBy": null + } + ], + "title": "Failed requests" + }, + "showPin": true, + "name": "Failed requests" + }, + { + "type": 10, + "content": { + "chartId": "workbook3a7e6bfb-1f43-4376-add5-3cb3fc80f3b8", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 3, + "color": "blue", + "resourceIds": [ + "{Application}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Application", + "metrics": [ + { + "namespace": "microsoft.insights/components/kusto", + "metric": "microsoft.insights/components/kusto-Server-requests/duration", + "aggregation": 4, + "splitBy": null + } + ], + "title": "Server response time" + }, + "showPin": true, + "name": "Server response time" + }, + { + "type": 10, + "content": { + "chartId": "workbook3a7e6bfb-1f43-4376-add5-3cb3fc80f3b8", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 3, + "color": "green", + "resourceIds": [ + "{Application}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Application", + "metrics": [ + { + "namespace": "microsoft.insights/components/kusto", + "metric": "microsoft.insights/components/kusto-Availability-availabilityResults/availabilityPercentage", + "aggregation": 4, + "splitBy": null + } + ], + "title": "Availability" + }, + "showPin": true, + "name": "Availability" + }, + { + "type": 10, + "content": { + "chartId": "workbook3a7e6bfb-1f43-4376-add5-3cb3fc80f3b8", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 3, + "color": "yellow", + "resourceIds": [ + "{Application}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Application", + "metrics": [ + { + "namespace": "microsoft.insights/components/kusto", + "metric": "microsoft.insights/components/kusto-Usage-users/count", + "aggregation": 5, + "splitBy": null + } + ], + "title": "Users" + }, + "showPin": true, + "name": "Users" + } + ], + "defaultResourceIds": [], + "fallbackResourceIds": [], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/App Hub/Workbooks/App summary/settings.json b/App Hub/Workbooks/App summary/settings.json new file mode 100644 index 0000000..e157883 --- /dev/null +++ b/App Hub/Workbooks/App summary/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Application summary", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.resourcegraph/queries", "order": 100 }] +} \ No newline at end of file diff --git a/App Hub/Workbooks/Cosmos Databases/Cosmos Databases.workbook b/App Hub/Workbooks/Cosmos Databases/Cosmos Databases.workbook new file mode 100644 index 0000000..eba2505 --- /dev/null +++ b/App Hub/Workbooks/Cosmos Databases/Cosmos Databases.workbook @@ -0,0 +1,1256 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::selected" + ], + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "InputContext", + "label": "Input context", + "type": 5, + "description": "All subscriptions with Storage accounts", + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ], + "showDefault": false + } + }, + { + "id": "102e5ff4-5a4b-4186-87ea-e4ccb0392e2c", + "version": "KqlParameterItem/1.0", + "name": "ResourceGraphQuery", + "label": "Resource graph query snippet", + "type": 1, + "query": "Resources\r\n| take 1\r\n| project InputContext = tolower('{InputContext}')\r\n| extend ResourceQueryId = extract(@'(/subscriptions/.+/resourcegroups/.+/providers/microsoft.resourcegraph/queries/.+)', 1, InputContext)\r\n| project QuerySnippet = iff(ResourceQueryId == '', 'Resources | where id startswith \"{InputContext}\"', strcat('{', '{','{InputContext}', '}', '}'))", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "138881c1-d041-4acd-acc9-e7a7af02d2ef", + "version": "KqlParameterItem/1.0", + "name": "CosmosDB", + "label": "Cosmos Databases", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "{ResourceGraphQuery}\r\n| where type =~ 'Microsoft.DocumentDB/databaseAccounts'\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = id, selected = Rank <= 25", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "type": 4, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "9b48988f-dcd2-48cc-b233-5999ed32149f", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "{ResourceGraphQuery}\n| where type =~ 'Microsoft.DocumentDB/databaseAccounts'\n| summarize Selected = countif(id in ({CosmosDB:value})), Total = count()\n| extend Selected = iff(Selected > 200, 200, Selected)\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "cosmosDB account parameters", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "{Message}\r\n_Cosmos DB accounts_\r\n" + }, + "name": "CosmosDBAccounts", + "styleSettings": { + "margin": "15px 0 10px 10px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Failures", + "subTarget": "Failures", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Capacity", + "subTarget": "Capacity", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Operations", + "subTarget": "Operation", + "style": "link" + } + ] + }, + "name": "links-tabs", + "styleSettings": { + "margin": "10px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "### Start editing the Overview section here" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "OverviewSectionEditStart" + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{CosmosDB}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.documentdb/databaseaccounts", + "resourceParameter": "CosmosDB", + "metrics": [ + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "aggregation": 7, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount", + "aggregation": 4, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-DataUsage", + "aggregation": 4, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-ProvisionedThroughput", + "aggregation": 3, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "gridFormatType": 2, + "filters": [ + { + "id": "1", + "key": "CollectionName", + "operator": 1, + "values": [ + "" + ], + "valueParam": null + } + ], + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests$|microsoft.documentdb/databaseaccounts-Requests-MetadataRequests$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "Request failures", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Request failures Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DataUsage", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DataUsage Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-ProvisionedThroughput", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "gray", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-ProvisionedThroughput Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequestUnits", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequestUnits Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": ".*\\/Total Requests$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "429/Total Requests", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "3", + "text": "{0}{1}" + } + ] + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-TotalRequests$|microsoft.documentdb/databaseaccounts-Requests-MetadataRequests$_4", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "Name", + "label": "Name" + }, + { + "columnId": "Segment", + "label": "CollectionName" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "label": "Requests" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests Timeline", + "label": "Requests Timeline" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount", + "label": "Documents" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount Timeline", + "label": "Document Count (Average) Timeline" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DataUsage", + "label": "Data Usage" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DataUsage Timeline", + "label": "Data Usage (Average) Timeline" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-ProvisionedThroughput", + "label": "Provisioned throughput (RUs/5m)" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-ProvisionedThroughput Timeline", + "label": "Provisioned Throughput (Max) Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-TotalRequests$|microsoft.documentdb/databaseaccounts-Requests-MetadataRequests$_4", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "showPin": true, + "name": "cosmosDB account metrics" + }, + { + "type": 1, + "content": { + "json": "### Start editing the Failures section here" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "FailureSectionEditStart" + }, + { + "type": 10, + "content": { + "chartId": "workbook0efdd8cd-3252-4cee-9fc3-948f48df25af", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{CosmosDB}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.documentdb/databaseaccounts", + "resourceParameter": "CosmosDB", + "metrics": [ + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "aggregation": 7, + "splitBy": null + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "aggregation": 7, + "splitBy": "StatusCode", + "splitBySortOrder": -1, + "splitByLimit": 10, + "columnName": "response" + } + ], + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "(20|30).*\\/response", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "(401|404)/response", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "gray", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": ".*\\/response$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-TotalRequests_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "Name", + "label": "Name" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "label": "Total Requests (Count)" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests Timeline", + "label": "Total Requests Timeline" + }, + { + "columnId": "200/response", + "label": "200/response" + }, + { + "columnId": "304/response", + "label": "304/response" + }, + { + "columnId": "404/response", + "label": "404/response" + }, + { + "columnId": "201/response", + "label": "201/response" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-TotalRequests_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Failures" + }, + "showPin": true, + "name": "cosmosDB account failures" + }, + { + "type": 1, + "content": { + "json": "### Start editing the Capacity section here\r\n" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "CapacitySectionEditStart" + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{CosmosDB}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.documentdb/databaseaccounts", + "resourceParameter": "CosmosDB", + "metrics": [ + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount", + "aggregation": 4, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-DataUsage", + "aggregation": 4, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-IndexUsage", + "aggregation": 4, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-AvailableStorage", + "aggregation": 4, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "gridFormatType": 2, + "filters": [ + { + "id": "1", + "key": "CollectionName", + "operator": 1, + "values": [ + "" + ], + "valueParam": null + } + ], + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DataUsage|microsoft.documentdb/databaseaccounts-Requests-IndexUsage", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DataUsage Timeline", + "formatter": 5, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-IndexUsage Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-AvailableStorage", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "gray", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-AvailableStorage Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-DocumentCount_4", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "Segment", + "label": "CollectionName" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount", + "label": "Documents" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount Timeline", + "label": "Documents Timeline" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DataUsage", + "label": "Data Usage" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DataUsage Timeline", + "label": "Data Usage (Sum) Timeline" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-IndexUsage", + "label": "Index Usage" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-IndexUsage Timeline", + "label": "Index Usage (Sum) Timeline" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-AvailableStorage", + "label": "Available Storage" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-AvailableStorage Timeline", + "label": "Available Storage (Sum) Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-DocumentCount_4", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Capacity" + }, + "showPin": true, + "name": "cosmosDB account capacity" + }, + { + "type": 1, + "content": { + "json": "### Start editing the Operations section here\r\n" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "OperationSectionEditStarts" + }, + { + "type": 10, + "content": { + "chartId": "workbook31d87d8f-2f6e-4f40-b780-a06fbf7c2967", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{CosmosDB}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.documentdb/databaseaccounts", + "resourceParameter": "CosmosDB", + "metrics": [ + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "aggregation": 7, + "splitBy": null + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "aggregation": 7, + "splitBy": "OperationType", + "splitBySortOrder": -1, + "splitByLimit": 3, + "columnName": "operation" + } + ], + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": ".*\\/operation", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-TotalRequests_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "Name", + "label": "Name" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "label": "Requests" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests Timeline", + "label": "Requests Timeline" + }, + { + "columnId": "read/operation", + "label": "read/operation" + }, + { + "columnId": "upsert/operation", + "label": "upsert/operation" + }, + { + "columnId": "ReadFeed/operation", + "label": "ReadFeed/operation" + }, + { + "columnId": "Other/operation", + "label": "Other/operation" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-TotalRequests_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Operation" + }, + "showPin": true, + "name": "cosmosDB account operations" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/App Hub/Workbooks/Cosmos Databases/settings.json b/App Hub/Workbooks/Cosmos Databases/settings.json new file mode 100644 index 0000000..42f4952 --- /dev/null +++ b/App Hub/Workbooks/Cosmos Databases/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Cosmos Databases", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "Monitoring Groups", "order": 300 }, + { "type": "cosmosdb-insights", "resourceType": "Monitoring Groups", "order": 100 } + ] +} \ No newline at end of file diff --git a/App Hub/Workbooks/Storage Accounts/Storage Accounts.workbook b/App Hub/Workbooks/Storage Accounts/Storage Accounts.workbook new file mode 100644 index 0000000..2aa34e9 --- /dev/null +++ b/App Hub/Workbooks/Storage Accounts/Storage Accounts.workbook @@ -0,0 +1,736 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "InputContext", + "label": "Input context", + "type": 5, + "description": "All subscriptions with Storage accounts", + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ], + "showDefault": false + } + }, + { + "id": "102e5ff4-5a4b-4186-87ea-e4ccb0392e2c", + "version": "KqlParameterItem/1.0", + "name": "ResourceGraphQuery", + "label": "Resource graph query snippet", + "type": 1, + "query": "Resources\r\n| take 1\r\n| project InputContext = tolower('{InputContext}')\r\n| extend ResourceQueryId = extract(@'(/subscriptions/.+/resourcegroups/.+/providers/microsoft.resourcegraph/queries/.+)', 1, InputContext)\r\n| project QuerySnippet = iff(ResourceQueryId == '', 'Resources | where id startswith \"{InputContext}\"', strcat('{', '{','{InputContext}', '}', '}'))", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", + "version": "KqlParameterItem/1.0", + "name": "StorageAccounts", + "label": "Storage Accounts", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "{ResourceGraphQuery}\n| where type =~ 'microsoft.storage/storageaccounts'\n| order by name asc\n| extend Rank = row_number()\n| project value = id, label = id, selected = Rank <= 25", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "value": { + "durationMs": 14400000 + }, + "label": "Time Range" + }, + { + "id": "63640264-0edc-4e98-bba7-d8056705e70e", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "{ResourceGraphQuery}\r\n| where type == 'microsoft.storage/storageaccounts' \r\n| summarize Selected = countif(id in ({StorageAccounts:value})), Total = count()\r\n| extend Selected = iff(Selected > 200, 200, Selected)\r\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 1", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "{Message}\r\n_Storage accounts_" + }, + "name": "text - 6", + "styleSettings": { + "margin": "15px 0 10px 10px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Capacity", + "subTarget": "Capacity" + } + ] + }, + "name": "Navigation links", + "styleSettings": { + "margin": "10px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "### Overview section" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "text - 4" + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{StorageAccounts}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccounts", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Transactions", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency", + "aggregation": 4 + }, + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-SuccessServerLatency", + "aggregation": 4 + }, + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Transactions", + "aggregation": 1, + "splitBy": "ResponseType", + "splitBySortOrder": -1, + "splitByLimit": 4, + "columnName": "Errors" + } + ], + "resourceLimit": 200, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "insights", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-Transactions$|Transactions$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-Transactions Timeline$|Transactions Timeline$", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency$|microsoft.storage/storageaccounts-Transaction-SuccessServerLatency$|E2E Latency$|Server Latency$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "linkTarget": "WorkbookTemplate", + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Performance", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.storage/storageaccounts" + } + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency Timeline$|E2E Latency Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-SuccessServerLatency Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Success/Errors", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "success/Errors", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": ".*\\/Errors", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "linkTarget": "WorkbookTemplate", + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Failures", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.storage/storageaccounts" + } + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Server Latency Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.storage/storageaccounts-Transaction-Transactions$|Transactions$_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name", + "label": "" + }, + { + "columnId": "microsoft.storage/storageaccounts-Transaction-Transactions", + "label": "Transactions" + }, + { + "columnId": "microsoft.storage/storageaccounts-Transaction-Transactions Timeline", + "label": "Transactions Timeline" + }, + { + "columnId": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency", + "label": "E2E Latency" + }, + { + "columnId": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency Timeline", + "label": "E2E Latency Timeline" + }, + { + "columnId": "microsoft.storage/storageaccounts-Transaction-SuccessServerLatency", + "label": "Server Latency" + }, + { + "columnId": "microsoft.storage/storageaccounts-Transaction-SuccessServerLatency Timeline", + "label": "Server Latency Timeline" + }, + { + "columnId": "Success/Errors" + }, + { + "columnId": "AuthenticationError/Errors", + "label": "AuthenticationError/Errors" + }, + { + "columnId": "ClientOtherError/Errors", + "label": "ClientOtherError/Errors" + }, + { + "columnId": "ClientTimeoutError/Errors", + "label": "ClientTimeoutError/Errors" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.storage/storageaccounts-Transaction-Transactions$|Transactions$_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "showPin": true, + "name": "storage account metrics", + "styleSettings": { + "margin": "0 10px 0 10px" + } + }, + { + "type": 1, + "content": { + "json": "## Capacity section" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "text - 6" + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 3, + "chartType": 0, + "resourceIds": [ + "{StorageAccounts}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccounts", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Capacity-UsedCapacity", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity", + "aggregation": 4, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "insights", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Capacity-UsedCapacity$|microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity$|microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity$|microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity$|microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "linkTarget": "WorkbookTemplate", + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Capacity", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.storage/storageaccounts" + } + }, + "numberFormat": { + "unit": 36, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Capacity-UsedCapacity Timeline$|Account used capacity Timeline$", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity Timeline$|Blob capacity Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity Timeline$|File capacity Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity Timeline$|Queue capacity Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity Timeline$|Table capacity Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.storage/storageaccounts-Capacity-UsedCapacity$|microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity$|microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity$|microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity$|microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity$_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "microsoft.storage/storageaccounts-Capacity-UsedCapacity", + "label": "Account used capacity" + }, + { + "columnId": "microsoft.storage/storageaccounts-Capacity-UsedCapacity Timeline", + "label": "Account used capacity timeline" + }, + { + "columnId": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity", + "label": "Blob capacity" + }, + { + "columnId": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity Timeline", + "label": "Blob capacity Timeline" + }, + { + "columnId": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity", + "label": "File capacity" + }, + { + "columnId": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity Timeline", + "label": "File capacity Timeline" + }, + { + "columnId": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity", + "label": "Queue capacity" + }, + { + "columnId": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity Timeline", + "label": "Queue capacity Timeline" + }, + { + "columnId": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity", + "label": "Table capacity" + }, + { + "columnId": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity Timeline", + "label": "Table capacity Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.storage/storageaccounts-Capacity-UsedCapacity$|microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity$|microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity$|microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity$|microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity$_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Capacity" + }, + "showPin": true, + "name": "storage account capacity metrics", + "styleSettings": { + "margin": "0 10px 0 10px" + } + } + ], + "styleSettings": { + "paddingStyle": "narrow" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/App Hub/Workbooks/Storage Accounts/settings.json b/App Hub/Workbooks/Storage Accounts/settings.json new file mode 100644 index 0000000..3f8e947 --- /dev/null +++ b/App Hub/Workbooks/Storage Accounts/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Storage Accounts", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "Monitoring Groups", "order": 200 }, + { "type": "storage-insights", "resourceType": "Monitoring Groups", "order": 100 } + ] +} \ No newline at end of file diff --git a/App Hub/Workbooks/categoryResources.json b/App Hub/Workbooks/categoryResources.json new file mode 100644 index 0000000..43f0f7a --- /dev/null +++ b/App Hub/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Insights", "description": "", "order": 200} +} \ No newline at end of file diff --git a/App Services - App Metrics/Alerts/README b/App Services - App Metrics/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/App Services - App Metrics/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/App Services - App Metrics/Queries/README b/App Services - App Metrics/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/App Services - App Metrics/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/App Failures/App Failures.workbook b/App Services - App Metrics/Workbooks/App Failures/App Failures.workbook new file mode 100644 index 0000000..8cf7377 --- /dev/null +++ b/App Services - App Metrics/Workbooks/App Failures/App Failures.workbook @@ -0,0 +1,290 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Application Failures\n" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "9cf8c4a4-d4ec-4582-8894-811c9bd83fd4", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": false, + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.insights/components": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "value": "value::1" + }, + { + "id": "bf7831d3-30cd-4d55-a14c-f67a2b608837", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000, + "createdTime": "2018-08-03T18:14:36.255Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-08-03T18:14:36.259Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 86400000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Request Failures" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Dependency Failures" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T21:26:56.052Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Failure-requests/failed", + "aggregation": 7, + "chartType": 3, + "splitBy": "request/resultCode", + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T21:26:56.066Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Failure-dependencies/failed", + "aggregation": 7, + "chartType": 3, + "splitBy": "dependency/type", + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Server Exceptions" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Browser Exceptions" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T21:26:56.096Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Failure-exceptions/server", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T21:26:56.107Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Failure-exceptions/browser", + "aggregation": 1, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ] +} \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/App Failures/settings.json b/App Services - App Metrics/Workbooks/App Failures/settings.json new file mode 100644 index 0000000..9a9106f --- /dev/null +++ b/App Services - App Metrics/Workbooks/App Failures/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Failure Metrics", + "author": "Microsoft", + "galleries": [ + { "type": "failure-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 } + ] +} \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/App Performance/App Performance.workbook b/App Services - App Metrics/Workbooks/App Performance/App Performance.workbook new file mode 100644 index 0000000..c2c0d05 --- /dev/null +++ b/App Services - App Metrics/Workbooks/App Performance/App Performance.workbook @@ -0,0 +1,376 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Application Performance\n" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "9cf8c4a4-d4ec-4582-8894-811c9bd83fd4", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": false, + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.insights/components": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "value": "value::1" + }, + { + "id": "bf7831d3-30cd-4d55-a14c-f67a2b608837", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000, + "createdTime": "2018-08-03T18:14:36.255Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-08-03T18:14:36.259Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Server Response Time" + }, + "conditionalVisibility": null, + "customWidth": "65" + }, + { + "type": 1, + "content": { + "json": "## Server Requests" + }, + "conditionalVisibility": null, + "customWidth": "35" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T21:28:33.156Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Server-requests/duration", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "65" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T21:28:33.173Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Server-requests/count", + "aggregation": 7, + "chartType": 3, + "splitBy": null, + "color": "green" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "35" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Dependency Duration" + }, + "conditionalVisibility": null, + "customWidth": "65" + }, + { + "type": 1, + "content": { + "json": "## Dependency Calls" + }, + "conditionalVisibility": null, + "customWidth": "35" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T21:28:33.206Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Server-dependencies/duration", + "aggregation": 4, + "chartType": 3, + "splitBy": "dependency/type", + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "65" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T21:28:33.221Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Server-dependencies/count", + "aggregation": 7, + "chartType": 3, + "splitBy": null, + "color": "green" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "35" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Page View Load Time" + }, + "conditionalVisibility": null, + "customWidth": "65" + }, + { + "type": 1, + "content": { + "json": "## Page Views" + }, + "conditionalVisibility": null, + "customWidth": "35" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T21:28:33.243Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Usage-pageViews/duration", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "65" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T21:28:33.257Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Usage-pageViews/count", + "aggregation": 7, + "chartType": 3, + "splitBy": null, + "color": "green" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "35" + } + ] +} \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/App Performance/settings.json b/App Services - App Metrics/Workbooks/App Performance/settings.json new file mode 100644 index 0000000..4367233 --- /dev/null +++ b/App Services - App Metrics/Workbooks/App Performance/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance Metrics", + "author": "Microsoft", + "galleries": [ + { "type": "performance-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 300 } + ] +} \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/App Usage/App Usage.workbook b/App Services - App Metrics/Workbooks/App Usage/App Usage.workbook new file mode 100644 index 0000000..f1d7db4 --- /dev/null +++ b/App Services - App Metrics/Workbooks/App Usage/App Usage.workbook @@ -0,0 +1,407 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# App Usage\nUse this report to find out when people use your app, what pages they're most interested in, where your users are located, and what browsers and operating systems they use. \n" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "68b43bee-13ac-4083-9020-7019d349f255", + "version": "KqlParameterItem/1.0", + "name": "App", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.insights/components": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "d02df8ec-0b88-4452-a286-d0439a578ff2", + "version": "KqlParameterItem/1.0", + "name": "Operations", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union pageViews, customEvents\r\n| where timestamp >= ago(1d)\r\n| where appName == '{App:name}'\r\n| summarize by name, itemType\r\n| extend itemType = iff(itemType == 'customEvent', strcat('⚡ ', name), strcat('🌐 ', name))\r\n| order by name asc\r\n| extend selected = false\r\n| union (datatable(name:string, itemType:string, selected:boolean)[\r\n'*', '🔸 All Page Views and Custom Events', true\r\n])", + "value": [ + "*" + ], + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "41867d59-e434-4665-86e3-356a2b0c97d3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 2592000000, + "createdTime": "2018-08-27T18:07:21.479Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000, + "createdTime": "2018-08-27T18:07:21.476Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-27T18:07:21.477Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-27T18:07:21.477Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-27T18:07:21.477Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-27T18:07:21.477Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-27T18:07:21.477Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-27T18:07:21.477Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-08-27T18:07:21.477Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-08-27T18:07:21.479Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-08-27T18:07:21.480Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2018-08-27T18:07:21.480Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "9c0139a8-d6dd-4091-aa06-09766dff04e1", + "version": "KqlParameterItem/1.0", + "name": "SelectedOperation", + "type": 1, + "isRequired": false, + "value": null, + "isHiddenWhenLocked": true + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = union pageViews, customEvents\r\n| where timestamp {TimeRange}\r\n| where name in ({Operations}) or '*' in ({Operations});\r\ndata\r\n| summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Activities = count() by name, itemType\r\n| extend name2 = iff(itemType == 'customEvent', strcat('⚡ ', name), strcat('🌐 ', name))\r\n| extend rank = 2\r\n| union (data\r\n | summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Activities = count()\r\n | extend name = '', name2 = '🔸🔸 Overall', rank = 1)\r\n| order by rank asc, Users desc, Activities desc\r\n| project Activity = name2, ['Unique Users'] = Users, ['Unique Sessions'] = Sessions, ['Activity Count'] = Activities, name\r\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "exportFieldName": "name", + "exportParameterName": "SelectedOperation", + "showAnalytics": false, + "title": "Usage Summary", + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{App}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Unique Users", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Unique Sessions", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + }, + { + "columnMatch": "Activity Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "yellow" + } + }, + { + "columnMatch": "name", + "formatter": 5, + "formatOptions": {} + } + ] + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "💡 *Select an operation in the table to see its usage details*" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "a4da1f8a-f0e5-404d-822e-e48a412b9cbc", + "version": "KqlParameterItem/1.0", + "name": "SelectedOperationName", + "type": 1, + "isRequired": true, + "query": "range i from 1 to 1 step 1\r\n| project text = iff('{SelectedOperation}' == '', 'all operations', '{SelectedOperation}')", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Details - {SelectedOperationName}\n" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union pageViews, customEvents\r\n| where timestamp {TimeRange}\r\n| where name in ({Operations}) or '*' in ({Operations})\r\n| where name == '{SelectedOperation}' or '' == '{SelectedOperation}'\r\n| make-series Users = dcount(user_Id) default = 0 on timestamp in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain})\r\n| mvexpand timestamp to typeof(datetime), Users to typeof(long)\r\n", + "showQuery": false, + "size": 0, + "aggregation": 3, + "showAnnotations": false, + "showAnalytics": false, + "title": "Unique Users", + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{App}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union pageViews, customEvents\r\n| where timestamp {TimeRange}\r\n| where name in ({Operations}) or '*' in ({Operations})\r\n| where name == '{SelectedOperation}' or '' == '{SelectedOperation}'\r\n| make-series Activities = count() default = 0 on timestamp in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain})\r\n| mvexpand timestamp to typeof(datetime), Activities to typeof(long)", + "showQuery": false, + "size": 0, + "aggregation": 3, + "showAnnotations": false, + "showAnalytics": false, + "title": "Activities Trend", + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{App}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "080b990e-e902-43ad-9587-ddbefe49f224", + "version": "KqlParameterItem/1.0", + "name": "Metric", + "type": 2, + "isRequired": true, + "query": "datatable(value:string, label:string)[\r\n'dcount(user_Id)', 'Unique Users',\r\n'dcount(session_Id)', 'Unique Sessions',\r\n'count()', 'Count of Activities',\r\n]", + "value": "dcount(user_Id)", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union pageViews, customEvents\r\n| where timestamp {TimeRange}\r\n| where name in ({Operations}) or '*' in ({Operations})\r\n| where name == '{SelectedOperation}' or '' == '{SelectedOperation}'\r\n| summarize Metric = {Metric} by client_CountryOrRegion\r\n| extend client_CountryOrRegion = iff(client_CountryOrRegion == '', 'Unknown', client_CountryOrRegion)\r\n| order by Metric desc\r\n", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "title": "Country", + "resourceType": "microsoft.insights/components", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Metric", + "formatter": 3, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union pageViews, customEvents\r\n| where timestamp {TimeRange}\r\n| where name in ({Operations}) or '*' in ({Operations})\r\n| where name == '{SelectedOperation}' or '' == '{SelectedOperation}'\r\n| summarize Metric = {Metric} by client_Browser\r\n| extend client_Browser = iff(client_Browser == '', 'Unknown', client_Browser)\r\n| order by Metric desc\r\n", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "title": "Country", + "resourceType": "microsoft.insights/components", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Metric", + "formatter": 3, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union pageViews, customEvents\r\n| where timestamp {TimeRange}\r\n| where name in ({Operations}) or '*' in ({Operations})\r\n| where name == '{SelectedOperation}' or '' == '{SelectedOperation}'\r\n| summarize Metric = {Metric} by client_OS\r\n| extend client_OS = iff(client_OS == '', 'Unknown', client_OS)\r\n| order by Metric desc\r\n", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "title": "Country", + "resourceType": "microsoft.insights/components", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Metric", + "formatter": 3, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "33" + } + ] +} \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/App Usage/settings.json b/App Services - App Metrics/Workbooks/App Usage/settings.json new file mode 100644 index 0000000..32e50aa --- /dev/null +++ b/App Services - App Metrics/Workbooks/App Usage/settings.json @@ -0,0 +1,11 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"App Usage", + "author": "Microsoft", + "galleries": [ + { "type": "performance-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 400 }, + { "type": "performance-appinsights", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 400 }, + { "type": "failure-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 400 }, + { "type": "failure-appinsights", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 400 } + ] +} \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/Failure Insights/Failure Insights.workbook b/App Services - App Metrics/Workbooks/Failure Insights/Failure Insights.workbook new file mode 100644 index 0000000..604fe15 --- /dev/null +++ b/App Services - App Metrics/Workbooks/Failure Insights/Failure Insights.workbook @@ -0,0 +1,423 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Application Failures Insights\n" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.insights/components": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + }, + "value": [ + "value::3" + ] + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": false, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + }, + { + "id": "1014e6d9-72b9-4729-a3a0-f5704768854e", + "version": "KqlParameterItem/1.0", + "name": "Operation", + "type": 1, + "isRequired": false, + "isHiddenWhenLocked": true, + "value": "{\"App\":\"\",\"Operation\":\"\"}" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = requests\n| where timestamp {TimeRange};\ndata\n| summarize Users = dcount(user_Id), CountFailed = countif(success == false), Count = count() by name, appName\n| project App = appName, Operation = name, ['Count (Failed)'] = CountFailed, Count, ['Success %'] = round(100.0 * (Count - CountFailed) / Count, 2), Users\n| union (data\n | summarize Users = dcount(user_Id), CountFailed = countif(success == false), Count = count()\n | project App = '🔸 All Apps', Operation = '🔸 All operations', Users, ['Count (Failed)'] = CountFailed, Count, ['Success %'] = round(100.0 * (Count - CountFailed) / Count, 2))\n| order by ['Count (Failed)'] desc\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "exportParameterName": "Operation", + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Count (Failed)", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Success %", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "redGreen" + } + }, + { + "columnMatch": "Users", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blueDark" + } + } + ] + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "💡 *Click on the rows of the table above to see details for other operations*" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "66e58e14-2fcf-469f-9936-d05ed2622954", + "version": "KqlParameterItem/1.0", + "name": "SelectedOperation", + "type": 1, + "isRequired": true, + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nrange i from 1 to 1 step 1\n| project Operation = iff((operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps'), 'all operations', operation)", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Details -- {SelectedOperation}\n" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Failed Operations" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### All Operations" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nrequests\n| where timestamp {TimeRange}\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\n| make-series FailedRequest = countif(success == false) default = 0 on timestamp in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain})\n| mvexpand timestamp to typeof(datetime), FailedRequest to typeof(long)\n", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nrequests\n| where timestamp {TimeRange}\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\n| make-series Requests = count() default = 0 on timestamp in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain})\n| mvexpand timestamp to typeof(datetime), Requests to typeof(long)\n", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Top Failure Codes" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Top Exceptions" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nrequests\n| where timestamp {TimeRange}\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\n| where success == false\n| summarize ['Failing Requests'] = count() by ['Result Code'] = tostring(resultCode)\n| top 4 by ['Failing Requests'] desc\n", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Failing Requests", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nlet operations = toscalar(requests\n| where timestamp {TimeRange}\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\n| summarize by operation_Id\n| summarize makelist(operation_Id, 1000000));\nexceptions\n| where timestamp {TimeRange}\n| where operation_Id in (operations)\n| summarize ['Failing Requests'] = count() by ['Exception'] = type\n| top 4 by ['Failing Requests'] desc\n", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Failing Requests", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + }, + { + "columnMatch": "Impacted Users", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "orange" + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Top Failing Dependencies" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\r\nlet operation = tostring(row.Operation);\r\nlet app = tostring(row.App);\r\nlet operations = toscalar(requests\r\n| where timestamp {TimeRange}\r\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\r\n| summarize by operation_Id\r\n| summarize makelist(operation_Id, 1000000));\r\ndependencies\r\n| where timestamp {TimeRange}\r\n| where operation_Id in (operations)\r\n| where success == false\r\n| summarize ['Failing Dependencies'] = count() by ['Dependency'] = name\r\n| top 4 by ['Failing Dependencies'] desc\r\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Failing Dependencies", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ] +} \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/Failure Insights/settings.json b/App Services - App Metrics/Workbooks/Failure Insights/settings.json new file mode 100644 index 0000000..a303895 --- /dev/null +++ b/App Services - App Metrics/Workbooks/Failure Insights/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Failure Analysis", + "author": "Microsoft", + "galleries": [ + { "type": "failure-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 100 }, + { "type": "failure-appinsights", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 100 } + ] +} \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/Performance Counters/Performance Counters.workbook b/App Services - App Metrics/Workbooks/Performance Counters/Performance Counters.workbook new file mode 100644 index 0000000..4775287 --- /dev/null +++ b/App Services - App Metrics/Workbooks/Performance Counters/Performance Counters.workbook @@ -0,0 +1,362 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Application Performance Counters\n" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "9cf8c4a4-d4ec-4582-8894-811c9bd83fd4", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": false, + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.insights/components": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "value": "value::1" + }, + { + "id": "bf7831d3-30cd-4d55-a14c-f67a2b608837", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000, + "createdTime": "2018-08-03T18:14:36.255Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-08-03T18:14:36.259Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-08-03T18:14:36.256Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Http Request Rate" + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 1, + "content": { + "json": "### Exception Rate" + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 1, + "content": { + "json": "### Http Execution Time" + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T19:22:14.342Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Performance Counter-performanceCounters/requestsPerSecond", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T19:22:14.358Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Performance Counter-performanceCounters/exceptionsPerSecond", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "yellow" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T19:22:14.377Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Performance Counter-performanceCounters/requestExecutionTime", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "orange" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 1, + "content": { + "json": "### Process CPU" + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 1, + "content": { + "json": "### Process Private Bytes" + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 1, + "content": { + "json": "### Process IO Rate" + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T19:22:14.401Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Performance Counter-performanceCounters/processCpuPercentage", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "pink" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T19:22:14.419Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Performance Counter-performanceCounters/processPrivateBytes", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "green" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 10, + "content": { + "chartId": "workbooka1352c64-b098-47f8-8e2e-2ad4720c8bde", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T19:22:14.433Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components", + "resourceParameter": "Apps", + "metrics": [ + { + "namespace": "microsoft.insights/components", + "metric": "microsoft.insights/components-Performance Counter-performanceCounters/processIOBytesPerSecond", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "33" + } + ] +} \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/Performance Counters/settings.json b/App Services - App Metrics/Workbooks/Performance Counters/settings.json new file mode 100644 index 0000000..dca8223 --- /dev/null +++ b/App Services - App Metrics/Workbooks/Performance Counters/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Resource Metrics", + "author": "Microsoft", + "galleries": [ + { "type": "performance-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 300 }, + { "type": "failure-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 300 } + ] +} \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/Performance Insights/Performance Insights.workbook b/App Services - App Metrics/Workbooks/Performance Insights/Performance Insights.workbook new file mode 100644 index 0000000..d37ed3e --- /dev/null +++ b/App Services - App Metrics/Workbooks/Performance Insights/Performance Insights.workbook @@ -0,0 +1,475 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Application Performance Insights\nUse this report to identify the slowest operations in your applications. This information can be used to diagnose potential problems or help focus your ongoing development to improve the overall performance of the application." + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.insights/components": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + }, + "value": [ + "value::3" + ] + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": false, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + }, + { + "id": "1014e6d9-72b9-4729-a3a0-f5704768854e", + "version": "KqlParameterItem/1.0", + "name": "Operation", + "type": 1, + "isRequired": false, + "isHiddenWhenLocked": true, + "value": "{\"App\":\"\",\"Operation\":\"\"}" + }, + { + "id": "9fb8e529-2818-4000-bdf0-48808de48eb7", + "version": "KqlParameterItem/1.0", + "name": "Columns", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "isHiddenWhenLocked": false, + "jsonData": "[\"Mean\", \"Median\", \"p80\", \"p95\", \"p99\", \"Count\", \"Users\"]", + "value": [ + "Mean", + "Median", + "p95", + "Count" + ] + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = requests\n| where timestamp {TimeRange};\ndata\n| summarize Mean = avg(duration), (Median, p80, p95, p99) = percentiles(duration, 50, 80, 95, 99), Count = count(), Users = dcount(user_Id) by name, appName\n| project App = appName, Operation = name, Mean, Median, p80, p95, p99, Count, Users, rank = 2\n| union (data\n | summarize Mean = avg(duration), (Median, p80, p95, p99) = percentiles(duration, 50, 80, 95, 99), Count = count(), Users = dcount(user_Id)\n | project App = '🔸 All Apps', Operation = '🔸 All operations', Mean, Median, p80, p95, p99, Count, Users, rank = 1)\n| extend Relevance = Mean * Count\n| order by rank asc, Relevance desc\n| project-away Relevance, rank\n| extend Mean = round(Mean, 2), Median = round(Median, 1), p80 = round(p80, 2), p95 = round(p95, 2), p99 = round(p99, 2)\n| project App, Operation, {Columns}\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "exportParameterName": "Operation", + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Mean|Median|p80|p95|p99", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Users", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blueDark" + } + } + ] + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "💡 *Click on the rows of the table above to see details for other operations*" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "b09bfb5a-093f-4099-a5fb-e0fca139cc3d", + "version": "KqlParameterItem/1.0", + "name": "SelectedOperation", + "type": 1, + "isRequired": true, + "query": "let row = dynamic({Operation});\r\nlet operation = tostring(row.Operation);\r\nlet app = tostring(row.App);\r\nrange i from 1 to 1 step 1\r\n| project Operation = iff((operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps'), 'all operations', operation)", + "isHiddenWhenLocked": true, + "jsonData": "", + "resourceType": "microsoft.insights/components" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Operation Details -- {SelectedOperation}\n" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Operation Duration (ms)\n" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### All Operations" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "1bbd1900-9445-4ac0-bb5d-f15dbe5f4485", + "version": "KqlParameterItem/1.0", + "name": "Show", + "type": 2, + "isRequired": true, + "query": "datatable(value:string, label:string)[\n\"avg(duration)\", \"Mean\",\n\"percentile(duration, 50)\", \"Median\",\n\"percentile(duration, 80)\", \"p80\",\n\"percentile(duration, 95)\", \"p95\",\n\"percentile(duration, 99)\", \"p99\"\n]", + "value": "percentile(duration, 95)", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nrequests\n| where timestamp {TimeRange}\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\n| make-series Duration = {Show} default = 0 on timestamp in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain})\n| mvexpand timestamp to typeof(datetime), Duration to typeof(long)\n", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nrequests\n| where timestamp {TimeRange}\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\n| make-series Requests = count() default = 0 on timestamp in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain})\n| mvexpand timestamp to typeof(datetime), Requests to typeof(long)\n", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Dependency Performance\n" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "Select an operation in the table above to see the performance of its dependencies. " + }, + "conditionalVisibility": { + "parameterName": "SelectedOperation", + "comparison": "isEqualTo", + "value": "all operations" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "a5b7de6f-eb50-49c6-8aaa-556d84ca9e3f", + "version": "KqlParameterItem/1.0", + "name": "AnalysisSet", + "type": 2, + "isRequired": true, + "query": "datatable(value:string, label:string)[\r\n'{\"from\":93, \"to\":97}', \"p95\",\r\n'{\"from\":77, \"to\":83}', \"p80\",\r\n'{\"from\":45, \"to\":55}', \"p50\",\r\n]", + "value": "{\"from\":93, \"to\":97}", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "be711374-a833-44a2-b9a4-5307ebc58253", + "version": "KqlParameterItem/1.0", + "name": "StartPercentile", + "type": 1, + "isRequired": true, + "query": "let analysisSet = dynamic({AnalysisSet});\r\nlet analysisStart = toreal(analysisSet.from);\r\nrange i from 1 to 1 step 1\r\n| project Start = analysisStart", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "fbca7275-4f5a-407e-84c2-e350f385eb53", + "version": "KqlParameterItem/1.0", + "name": "EndPercentile", + "type": 1, + "isRequired": true, + "query": "let analysisSet = dynamic({AnalysisSet});\r\nlet analysisStart = toreal(analysisSet[\"to\"]);\r\nrange i from 1 to 1 step 1\r\n| project Start = analysisStart", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "SelectedOperation", + "comparison": "isNotEqualTo", + "value": "all operations" + } + }, + { + "type": 1, + "content": { + "json": "The charts below show performance of the dependencies of *{SelectedOperation}*. The data is filtered only to those operations whose durations fall between p{StartPercentile} and p{EndPercentile} of the entire distribution. Change parameters `AnalysisSet`, `StartPercentile` or `EndPercentile` to tweak the percentile window of analysis" + }, + "conditionalVisibility": { + "parameterName": "SelectedOperation", + "comparison": "isNotEqualTo", + "value": "all operations" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\r\nlet operation = tostring(row.Operation);\r\nlet app = tostring(row.App);\r\nlet data = requests\r\n| where timestamp {TimeRange}\r\n| where (name == operation and appName == app);\r\nlet minDuration = toscalar(data\r\n| summarize Start = percentile(duration, {StartPercentile}));\r\nlet maxDuration = toscalar(data\r\n| summarize End = percentile(duration, {EndPercentile}));\r\nlet operations = data\r\n| where duration >= minDuration and duration <= maxDuration\r\n| summarize by operation_Id\r\n| take 100000; // Limit to 100K operations for perf\r\ndependencies\r\n| where timestamp {TimeRange}\r\n| where operation_Id in (operations)\r\n| summarize Duration = avg(duration) by name, bin(timestamp, {TimeRange:grain})", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "title": "Dependency Performance Trend (ms)", + "resourceType": "microsoft.insights/components", + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "SelectedOperation", + "comparison": "isNotEqualTo", + "value": "all operations" + }, + "customWidth": "55" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\r\nlet operation = tostring(row.Operation);\r\nlet app = tostring(row.App);\r\nlet data = requests\r\n| where timestamp {TimeRange}\r\n| where (name == operation and appName == app);\r\nlet minDuration = toscalar(data\r\n| summarize Start = percentile(duration, {StartPercentile}));\r\nlet maxDuration = toscalar(data\r\n| summarize End = percentile(duration, {EndPercentile}));\r\nlet operations = data\r\n| where duration >= minDuration and duration <= maxDuration\r\n| summarize by operation_Id\r\n| take 100000; // Limit to 100K operations for perf\r\ndependencies\r\n| where timestamp {TimeRange}\r\n| where operation_Id in (operations)\r\n| summarize Duration = avg(duration), Item = any(itemId) by name\r\n| extend Duration = round(Duration, 2)\r\n| order by Duration desc\r\n| project-rename [\"Mean Duration (ms)\"] = Duration", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "title": "Dependency Performance - Summary", + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Mean Duration (ms)", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + }, + { + "columnMatch": "Item", + "formatter": 7, + "formatOptions": { + "linkTarget": "DependencyDetails", + "linkLabel": "Sample" + } + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "SelectedOperation", + "comparison": "isNotEqualTo", + "value": "all operations" + }, + "customWidth": "45" + } + ] +} \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/Performance Insights/settings.json b/App Services - App Metrics/Workbooks/Performance Insights/settings.json new file mode 100644 index 0000000..d61944c --- /dev/null +++ b/App Services - App Metrics/Workbooks/Performance Insights/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance Analysis", + "author": "Microsoft", + "galleries": [ + { "type": "performance-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 100 }, + { "type": "performance-appinsights", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 100 } + ] +} \ No newline at end of file diff --git a/App Services - App Metrics/Workbooks/categoryResources.json b/App Services - App Metrics/Workbooks/categoryResources.json new file mode 100644 index 0000000..564f63d --- /dev/null +++ b/App Services - App Metrics/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Application", "description": "Investigate issues your application", "order": 200} +} \ No newline at end of file diff --git a/App Services - Infrastructure/Alerts/README b/App Services - Infrastructure/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/App Services - Infrastructure/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/App Services - Infrastructure/Queries/README b/App Services - Infrastructure/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/App Services - Infrastructure/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/App Services - Infrastructure/Workbooks/App Service Http Errors/App Service Http Errors.workbook b/App Services - Infrastructure/Workbooks/App Service Http Errors/App Service Http Errors.workbook new file mode 100644 index 0000000..0fea2e1 --- /dev/null +++ b/App Services - Infrastructure/Workbooks/App Service Http Errors/App Service Http Errors.workbook @@ -0,0 +1,357 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# App Services Http Errors\n" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "71badead-933c-4f0a-8468-e2458d2ea872", + "version": "KqlParameterItem/1.0", + "name": "AppServices", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.web/sites": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + }, + "value": [ + "value::3" + ] + }, + { + "id": "f5d8750b-37d8-4e06-9e3f-fdef414c275f", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000, + "createdTime": "2018-08-02T19:21:14.551Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-02T19:21:14.553Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-08-02T19:21:14.553Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 86400000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resourcegroup/resourcegroups" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Http Server Errors (5xxx)" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Http Client Errors (4xxx)" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T18:00:30.636Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--Http5xx", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T18:00:30.650Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--Http4xx", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Http Redirection (3xx)" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Http Success (2xxx)" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T18:00:30.678Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--Http3xx", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T18:00:30.707Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--Http2xx", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Http 101" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T18:00:30.734Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--Http101", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ] +} \ No newline at end of file diff --git a/App Services - Infrastructure/Workbooks/App Service Http Errors/settings.json b/App Services - Infrastructure/Workbooks/App Service Http Errors/settings.json new file mode 100644 index 0000000..ea62814 --- /dev/null +++ b/App Services - Infrastructure/Workbooks/App Service Http Errors/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Http Errors", + "author": "Microsoft", + "galleries": [ + { "type": "failure-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 } + ] +} \ No newline at end of file diff --git a/App Services - Infrastructure/Workbooks/App Service Key Metrics/App Service Key Metrics.workbook b/App Services - Infrastructure/Workbooks/App Service Key Metrics/App Service Key Metrics.workbook new file mode 100644 index 0000000..9485f6b --- /dev/null +++ b/App Services - Infrastructure/Workbooks/App Service Key Metrics/App Service Key Metrics.workbook @@ -0,0 +1,388 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# App Service Metrics\n" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "71badead-933c-4f0a-8468-e2458d2ea872", + "version": "KqlParameterItem/1.0", + "name": "AppServices", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.web/sites": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + }, + "value": [ + "value::3" + ] + }, + { + "id": "f5d8750b-37d8-4e06-9e3f-fdef414c275f", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000, + "createdTime": "2018-08-02T19:21:14.551Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-02T19:21:14.553Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-08-02T19:21:14.553Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 86400000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resourcegroup/resourcegroups" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Http Server Errors (5xxx)" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Requests" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T17:53:52.148Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--Http5xx", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T17:53:52.173Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--Requests", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Data In" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Data Out" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T17:53:52.196Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--BytesReceived", + "aggregation": 1, + "chartType": 3, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T17:53:52.208Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--BytesSent", + "aggregation": 1, + "chartType": 3, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Average Response Time" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Memory Working Set" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T17:53:52.229Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--AverageResponseTime", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T17:53:52.243Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--MemoryWorkingSet", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ] +} \ No newline at end of file diff --git a/App Services - Infrastructure/Workbooks/App Service Key Metrics/settings.json b/App Services - Infrastructure/Workbooks/App Service Key Metrics/settings.json new file mode 100644 index 0000000..b8d8b0f --- /dev/null +++ b/App Services - Infrastructure/Workbooks/App Service Key Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Key Metrics", + "author": "Microsoft", + "galleries": [ + { "type": "performance-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 100 }, + { "type": "failure-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 100 } + ] +} \ No newline at end of file diff --git a/App Services - Infrastructure/Workbooks/App Service Resource Metrics/App Service Resource Metrics.workbook b/App Services - Infrastructure/Workbooks/App Service Resource Metrics/App Service Resource Metrics.workbook new file mode 100644 index 0000000..9485f6b --- /dev/null +++ b/App Services - Infrastructure/Workbooks/App Service Resource Metrics/App Service Resource Metrics.workbook @@ -0,0 +1,388 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# App Service Metrics\n" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "71badead-933c-4f0a-8468-e2458d2ea872", + "version": "KqlParameterItem/1.0", + "name": "AppServices", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.web/sites": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + }, + "value": [ + "value::3" + ] + }, + { + "id": "f5d8750b-37d8-4e06-9e3f-fdef414c275f", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000, + "createdTime": "2018-08-02T19:21:14.551Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-02T19:21:14.553Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-08-02T19:21:14.553Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 86400000, + "createdTime": "2018-08-02T19:21:14.552Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resourcegroup/resourcegroups" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Http Server Errors (5xxx)" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Requests" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T17:53:52.148Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--Http5xx", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T17:53:52.173Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--Requests", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Data In" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Data Out" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T17:53:52.196Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--BytesReceived", + "aggregation": 1, + "chartType": 3, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T17:53:52.208Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--BytesSent", + "aggregation": 1, + "chartType": 3, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Average Response Time" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Memory Working Set" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T17:53:52.229Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--AverageResponseTime", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbookb153db09-be06-45f6-97f0-34cde9af9838", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-03T17:53:52.243Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.web/sites", + "resourceParameter": "AppServices", + "metrics": [ + { + "namespace": "microsoft.web/sites", + "metric": "microsoft.web/sites--MemoryWorkingSet", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ] +} \ No newline at end of file diff --git a/App Services - Infrastructure/Workbooks/App Service Resource Metrics/settings.json b/App Services - Infrastructure/Workbooks/App Service Resource Metrics/settings.json new file mode 100644 index 0000000..dca8223 --- /dev/null +++ b/App Services - Infrastructure/Workbooks/App Service Resource Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Resource Metrics", + "author": "Microsoft", + "galleries": [ + { "type": "performance-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 300 }, + { "type": "failure-websites", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 300 } + ] +} \ No newline at end of file diff --git a/App Services - Infrastructure/Workbooks/categoryResources.json b/App Services - Infrastructure/Workbooks/categoryResources.json new file mode 100644 index 0000000..c3c9fe0 --- /dev/null +++ b/App Services - Infrastructure/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Infrastructure", "description": "Investigate issues in the infrastructure your app runs in", "order": 200} +} \ No newline at end of file diff --git a/Azure Active Directory Conditional Access/Alerts/README b/Azure Active Directory Conditional Access/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Azure Active Directory Conditional Access/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Azure Active Directory Conditional Access/Queries/README b/Azure Active Directory Conditional Access/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Azure Active Directory Conditional Access/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Azure Active Directory Conditional Access/Workbooks/By conditional access status/SigninsByCAStatus.workbook b/Azure Active Directory Conditional Access/Workbooks/By conditional access status/SigninsByCAStatus.workbook new file mode 100644 index 0000000..6488685 --- /dev/null +++ b/Azure Active Directory Conditional Access/Workbooks/By conditional access status/SigninsByCAStatus.workbook @@ -0,0 +1,317 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Sign-ins using Conditional Access" + }, + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "13f56671-7604-4427-a4d8-663f3da0cbc5", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 1209600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + } + ], + "allowCustom": true + } + }, + { + "id": "3b5cc420-8ad8-4523-ba28-a54910756794", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "SigninLogs\r\n| summarize Count = count() by AppDisplayName\r\n| order by Count desc, AppDisplayName asc\r\n| project Value = AppDisplayName, Label = strcat(AppDisplayName, ' - ', Count, ' sign-ins'), Selected = false\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "limitSelectTo": 20, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "88102190-0f5c-40ea-96a7-d8f735352fab", + "version": "KqlParameterItem/1.0", + "name": "Users", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n| summarize Count = count() by UserDisplayName\r\n| order by Count desc, UserDisplayName asc\r\n| project Value = UserDisplayName, Label = strcat(UserDisplayName, ' - ', Count, ' sign-ins'), Selected = false\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "limitSelectTo": 20, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n|extend CAStatus = case(ConditionalAccessStatus ==\"success\",\"Successful\",\r\n ConditionalAccessStatus == \"failure\", \"Failed\", \r\n ConditionalAccessStatus == \"notApplied\", \"Not applied\", \r\n isempty(ConditionalAccessStatus), \"Not applied\", \r\n \"Disabled\")\r\n|mvexpand ConditionalAccessPolicies\r\n|extend CAGrantControlName = tostring(ConditionalAccessPolicies.enforcedGrantControls[0])\r\n|extend CAGrantControl = case(CAGrantControlName contains \"MFA\", \"Require MFA\", \r\n CAGrantControlName contains \"Terms of Use\", \"Require Terms of Use\", \r\n CAGrantControlName contains \"Privacy\", \"Require Privacy Statement\", \r\n CAGrantControlName contains \"Device\", \"Require Device Compliant\", \r\n CAGrantControlName contains \"Azure AD Joined\", \"Require Hybird Azure AD Joined Device\", \r\n CAGrantControlName contains \"Apps\", \"Require Approved Apps\",\r\n \"Other\");\r\ndata\r\n| summarize Count = dcount(Id) by CAStatus\r\n| join kind = inner (data\r\n | make-series Trend = dcount(Id) default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by CAStatus\r\n ) on CAStatus\r\n| project-away CAStatus1, TimeGenerated\r\n| order by Count desc\r\n\r\n", + "size": 3, + "title": "Conditional access status", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "CAStatus", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "Text", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "name": "query - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n|extend errorCode = toint(Status.errorCode)\r\n|extend Reason = tostring(Status.failureReason)\r\n|extend CAStatus = case(ConditionalAccessStatus == \"success\",\"✔️ Success\", \r\n ConditionalAccessStatus == \"failure\", \"❌ Failure\", \r\n ConditionalAccessStatus == \"notApplied\", \"⚠️ Not Applied\", \r\n ConditionalAccessStatus == \"\", \"⚠️ Not Applied\", \r\n \"🚫 Disabled\")\r\n|mvexpand ConditionalAccessPolicies\r\n|extend CAGrantControlName = tostring(ConditionalAccessPolicies.enforcedGrantControls[0])\r\n|extend CAGrantControl = case(CAGrantControlName contains \"MFA\", \"Require MFA\", \r\n CAGrantControlName contains \"Terms of Use\", \"Require Terms of Use\", \r\n CAGrantControlName contains \"Privacy\", \"Require Privacy Statement\", \r\n CAGrantControlName contains \"Device\", \"Require Device Compliant\", \r\n CAGrantControlName contains \"Azure AD Joined\", \"Require Hybird Azure AD Joined Device\", \r\n CAGrantControlName contains \"Apps\", \"Require Approved Apps\",\"Other\");\r\ndata\r\n| summarize Count = dcount(Id) by CAStatus, CAGrantControl\r\n| project Id = strcat(CAStatus, '/', CAGrantControl), Name = CAGrantControl, Parent = CAStatus, Count, Type = 'CAGrantControl'\r\n| join kind = inner (data\r\n | make-series Trend = dcount(Id) default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by CAStatus, CAGrantControl\r\n | project Id = strcat(CAStatus, '/', CAGrantControl), Trend\r\n ) on Id\r\n| project-away Id1\r\n| union (data\r\n | summarize Count = dcount(Id) by CAStatus\r\n | project Id = CAStatus, Name = CAStatus, Parent = '', Count, Type = 'CAStatus'\r\n | join kind = inner (data\r\n | make-series Trend = dcount(Id) default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by CAStatus\r\n | project Id = CAStatus, Trend\r\n ) on Id\r\n | project-away Id1)\r\n| order by Count desc", + "size": 0, + "exportParameterName": "Detail", + "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\", \"Parent\":\"*\"}", + "showAnalytics": true, + "title": "Conditional access status", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Parent", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "Parent", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": true + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "query - 7" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let details = dynamic({Detail});\r\nlet data = SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n|extend errorCode = toint(Status.errorCode)\r\n|extend Reason = tostring(Status.failureReason)\r\n|extend CAStatus = case(ConditionalAccessStatus ==\"success\",\"✔️ Success\", \r\n ConditionalAccessStatus == \"failure\", \"❌ Failure\", \r\n ConditionalAccessStatus == \"notApplied\", \"⚠️ Not Applied\", \r\n ConditionalAccessStatus == \"\", \"⚠️ Not Applied\", \r\n \"🚫 Disabled\")\r\n|mvexpand ConditionalAccessPolicies\r\n|extend CAGrantControlName = tostring(ConditionalAccessPolicies.enforcedGrantControls[0])\r\n|extend CAGrantControl = case(CAGrantControlName contains \"MFA\", \"Require MFA\", \r\n CAGrantControlName contains \"Terms of Use\", \"Require Terms of Use\", \r\n CAGrantControlName contains \"Privacy\", \"Require Privacy Statement\", \r\n CAGrantControlName contains \"Device\", \"Require Device Compliant\", \r\n CAGrantControlName contains \"Azure AD Joined\", \"Require Hybird Azure AD Joined Device\", \r\n CAGrantControlName contains \"Apps\", \"Require Approved Apps\",\r\n \"Other\")\r\n|extend CAGrantControlRank = case(CAGrantControlName contains \"MFA\", 1, \r\n CAGrantControlName contains \"Terms of Use\", 2, \r\n CAGrantControlName contains \"Privacy\", 3, \r\n CAGrantControlName contains \"Device\", 4, \r\n CAGrantControlName contains \"Azure AD Joined\", 5, \r\n CAGrantControlName contains \"Apps\", 6,\r\n 7)\r\n| where details.Type == '*' or (details.Type == 'CAStatus' and CAStatus == details.Name) or (details.Type == 'CAGrantControl' and CAGrantControl == details.Name and CAStatus == details.Parent);\r\ndata\r\n| order by CAGrantControlRank desc\r\n| summarize CAGrantControls = make_set(CAGrantControl) by AppDisplayName, CAStatus, TimeGenerated, UserDisplayName\r\n| extend CAGrantControlText = replace(@\",\", \", \", replace(@'\"', @'', replace(@\"\\]\", @\"\", replace(@\"\\[\", @\"\", tostring(CAGrantControls)))))\r\n| extend CAGrantControlSummary = case(array_length(CAGrantControls) > 1, strcat(CAGrantControls[0], ' + ', array_length(CAGrantControls) - 1, ' more'), array_length(CAGrantControls) == 1, tostring(CAGrantControls[0]), 'None')\r\n| top 200 by TimeGenerated desc\r\n| extend TimeFromNow = now() - TimeGenerated\r\n| extend TimeAgo = strcat(case(TimeFromNow < 2m, strcat(toint(TimeFromNow / 1m), ' seconds'), TimeFromNow < 2h, strcat(toint(TimeFromNow / 1m), ' minutes'), TimeFromNow < 2d, strcat(toint(TimeFromNow / 1h), ' hours'), strcat(toint(TimeFromNow / 1d), ' days')), ' ago')\r\n| project Application = AppDisplayName, ['CA Status'] = CAStatus, ['CA Grant Controls'] = CAGrantControlSummary, ['All CA Grant Controls'] = CAGrantControlText, ['Sign-in Time'] = TimeAgo, ['User'] = UserDisplayName", + "size": 0, + "showAnalytics": true, + "title": "Recent sign-ins", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "CA Grant Controls", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "showIcon": true + } + }, + { + "columnMatch": "All CA Grant Controls", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "User", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "customWidth": "50", + "showPin": true, + "name": "query - 7 - Copy" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Azure Active Directory Conditional Access/Workbooks/By conditional access status/settings.json b/Azure Active Directory Conditional Access/Workbooks/By conditional access status/settings.json new file mode 100644 index 0000000..f2453b8 --- /dev/null +++ b/Azure Active Directory Conditional Access/Workbooks/By conditional access status/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Sign-ins by Conditional Access Status", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.aadiam/tenant", "order": 100 }] +} \ No newline at end of file diff --git a/Azure Active Directory Conditional Access/Workbooks/By grant controls/SignInsByGrantControls.workbook b/Azure Active Directory Conditional Access/Workbooks/By grant controls/SignInsByGrantControls.workbook new file mode 100644 index 0000000..e6a9705 --- /dev/null +++ b/Azure Active Directory Conditional Access/Workbooks/By grant controls/SignInsByGrantControls.workbook @@ -0,0 +1,245 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Sign-ins by Grant Controls" + }, + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "13f56671-7604-4427-a4d8-663f3da0cbc5", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 1209600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + } + ], + "allowCustom": true + } + }, + { + "id": "3b5cc420-8ad8-4523-ba28-a54910756794", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "SigninLogs\r\n| summarize Count = count() by AppDisplayName\r\n| order by Count desc, AppDisplayName asc\r\n| project Value = AppDisplayName, Label = strcat(AppDisplayName, ' - ', Count, ' sign-ins'), Selected = false\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "limitSelectTo": 20, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "88102190-0f5c-40ea-96a7-d8f735352fab", + "version": "KqlParameterItem/1.0", + "name": "Users", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n| summarize Count = count() by UserDisplayName\r\n| order by Count desc, UserDisplayName asc\r\n| project Value = UserDisplayName, Label = strcat(UserDisplayName, ' - ', Count, ' sign-ins'), Selected = false\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "limitSelectTo": 20, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let caGrantControlNames = datatable(name:string, rank:int)[\r\n \"Require MFA\", 1,\r\n \"Require Terms of Use\", 2,\r\n \"Require Privacy Statement\", 3,\r\n \"Require Device Compliant\", 4,\r\n \"Require Hybird Azure AD Joined Device\", 5,\r\n \"Require Approved Apps\", 6,\r\n \"Other\", 10\r\n];\r\nlet data = SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n|extend errorCode = toint(Status.errorCode)\r\n|extend Reason = tostring(Status.failureReason)\r\n|extend CAStatus = case(ConditionalAccessStatus ==0,\"Success\", \r\n ConditionalAccessStatus == 1, \"Failure\", \r\n ConditionalAccessStatus == 2, \"Not Applied\", \r\n ConditionalAccessStatus == \"\", \"Not Applied\", \r\n \"Disabled\")\r\n|mvexpand ConditionalAccessPolicies\r\n|extend CAGrantControlName = tostring(ConditionalAccessPolicies.enforcedGrantControls[0])\r\n|extend CAGrantControl = case(CAGrantControlName contains \"MFA\", \"Require MFA\", \r\n CAGrantControlName contains \"Terms of Use\", \"Require Terms of Use\", \r\n CAGrantControlName contains \"Privacy\", \"Require Privacy Statement\", \r\n CAGrantControlName contains \"Device\", \"Require Device Compliant\", \r\n CAGrantControlName contains \"Azure AD Joined\", \"Require Hybird Azure AD Joined Device\", \r\n CAGrantControlName contains \"Apps\", \"Require Approved Apps\",\"Other\");\r\ndata\r\n| summarize Count = dcount(Id) by CAStatus, CAGrantControl\r\n| join kind = inner (data\r\n | make-series Trend = dcount(Id) default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by CAStatus, CAGrantControl\r\n | project CAStatus, CAGrantControl, Trend\r\n ) on CAGrantControl\r\n| join kind = inner (caGrantControlNames) on $left.CAGrantControl == $right.name\r\n| order by rank asc\r\n| project CAStatus, CAGrantControl, Count, Trend\r\n", + "size": 3, + "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\", \"Parent\":\"*\"}", + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "CAGrantControl", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "CAStatus", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "min": 0, + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "query - 7" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let caGrantControlNames = datatable(name:string, rank:int)[\r\n \"Require MFA\", 1,\r\n \"Require Terms of Use\", 2,\r\n \"Require Privacy Statement\", 3,\r\n \"Require Device Compliant\", 4,\r\n \"Require Hybird Azure AD Joined Device\", 5,\r\n \"Require Approved Apps\", 6,\r\n \"Other\", 10\r\n];\r\nlet data = SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n|extend errorCode = toint(Status.errorCode)\r\n|extend Reason = tostring(Status.failureReason)\r\n|extend CAStatus = case(ConditionalAccessStatus ==\"success\",\"✔️ Success\", \r\n ConditionalAccessStatus == \"failure\", \"❌ Failure\", \r\n ConditionalAccessStatus == \"notApplied\", \"⚠️ Not Applied\", \r\n ConditionalAccessStatus == \"\", \"⚠️ Not Applied\", \r\n \"🚫 Disabled\")\r\n|mvexpand ConditionalAccessPolicies\r\n|extend CAGrantControlName = tostring(ConditionalAccessPolicies.enforcedGrantControls[0])\r\n|extend CAGrantControl = case(CAGrantControlName contains \"MFA\", \"Require MFA\", \r\n CAGrantControlName contains \"Terms of Use\", \"Require Terms of Use\", \r\n CAGrantControlName contains \"Privacy\", \"Require Privacy Statement\", \r\n CAGrantControlName contains \"Device\", \"Require Device Compliant\", \r\n CAGrantControlName contains \"Azure AD Joined\", \"Require Hybird Azure AD Joined Device\", \r\n CAGrantControlName contains \"Apps\", \"Require Approved Apps\",\r\n \"Other\")\r\n|extend CAGrantControlRank = case(CAGrantControlName contains \"MFA\", 1, \r\n CAGrantControlName contains \"Terms of Use\", 2, \r\n CAGrantControlName contains \"Privacy\", 3, \r\n CAGrantControlName contains \"Device\", 4, \r\n CAGrantControlName contains \"Azure AD Joined\", 5, \r\n CAGrantControlName contains \"Apps\", 6,\r\n 7);\r\ncaGrantControlNames\r\n| extend Application = '__FilterOut__', ['Sign-in time'] = '', ['CA Status'] = '', ['---'] = ''\r\n| evaluate pivot(name, sum(rank))\r\n| union (data\r\n| order by CAGrantControlRank desc\r\n| summarize CAGrantControls = make_set(CAGrantControl) by AppDisplayName, CAStatus, TimeGenerated, UserDisplayName\r\n| top 200 by TimeGenerated desc\r\n| mv-expand CAGrantControls to typeof(string)\r\n| join kind=inner (caGrantControlNames) on $left.CAGrantControls == $right.name\r\n| order by rank asc\r\n| extend TimeFromNow = now() - TimeGenerated\r\n| extend TimeAgo = strcat(case(TimeFromNow < 2m, strcat(toint(TimeFromNow / 1m), ' seconds'), TimeFromNow < 2h, strcat(toint(TimeFromNow / 1m), ' minutes'), TimeFromNow < 2d, strcat(toint(TimeFromNow / 1h), ' hours'), strcat(toint(TimeFromNow / 1d), ' days')), ' ago')\r\n| project Application = AppDisplayName, ['Sign-in time'] = TimeAgo, ['CA Status'] = CAStatus, TimeGenerated, CAGrantControl = CAGrantControls\r\n| evaluate pivot(CAGrantControl, count())\r\n| order by TimeGenerated desc\r\n| project-away TimeGenerated)\r\n| where Application != '__FilterOut__'\r\n", + "size": 0, + "showAnalytics": true, + "title": "Recent sign-ins", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Application", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Require.*|Other", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "representation": "cancelled", + "operator": "Default", + "thresholdValue": null + }, + { + "representation": "success", + "operator": ">=", + "thresholdValue": "1" + } + ] + } + } + ] + } + }, + "showPin": true, + "name": "query - 7 - Copy" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Active Directory Conditional Access/Workbooks/By grant controls/settings.json b/Azure Active Directory Conditional Access/Workbooks/By grant controls/settings.json new file mode 100644 index 0000000..dea7eee --- /dev/null +++ b/Azure Active Directory Conditional Access/Workbooks/By grant controls/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Sign-ins by Grant Controls", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.aadiam/tenant", "order": 200 }] +} \ No newline at end of file diff --git a/Azure Active Directory Conditional Access/Workbooks/Conditional Access Insights and Reporting/ConditionalAccessInsightsAndReporting.workbook b/Azure Active Directory Conditional Access/Workbooks/Conditional Access Insights and Reporting/ConditionalAccessInsightsAndReporting.workbook new file mode 100644 index 0000000..90fa610 --- /dev/null +++ b/Azure Active Directory Conditional Access/Workbooks/Conditional Access Insights and Reporting/ConditionalAccessInsightsAndReporting.workbook @@ -0,0 +1,1151 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Conditional Access Insights and Reporting\n" + }, + "customWidth": "70", + "name": "text - 5" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "dc99b5b7-d991-4269-8694-c4f8675b03ee", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + "value::all" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "30", + "name": "parameters - 24" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "https://portal.azure.com/?reportonlypolicies=true#blade/Microsoft_AAD_IAM/ConditionalAccessBlade/Policies", + "linkTarget": "Url", + "linkLabel": "visit the Conditional Access blade.", + "preText": "View the impact of all enabled policies or select an individual policy. To modify a policy ", + "postText": "", + "style": "link" + }, + { + "cellValue": "aka.ms/cainsights", + "linkTarget": "Url", + "linkLabel": "here.", + "preText": " Learn more about using the workbook ", + "postText": "", + "style": "link" + } + ] + }, + "name": "Unknown - 11" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "9b8cc3f0-ebab-482e-be6d-903f3e066c99", + "version": "KqlParameterItem/1.0", + "name": "Policy", + "label": "Conditional Access policy", + "type": 2, + "isRequired": true, + "query": "let allPolicies = datatable(value:dynamic, label:string)\r\n[\"All\", \"All enabled policies\"];\r\nallPolicies\r\n| project Value = value, Label = label, selected = \"true\", displayOrder = \"1\", group = \"Select all enabled policies\"\r\n| union (\r\nSigninLogs\r\n| project ConditionalAccessPolicies, TimeGenerated, ClientAppUsed\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where ClientAppUsed == \"Browser\"\r\n| top 1 by TimeGenerated\r\n| project-away TimeGenerated\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"result\"] !contains \"reportOnly\" and ConditionalAccessPolicies[\"result\"] !contains \"notEnabled\"\r\n| project name = ConditionalAccessPolicies[\"displayName\"]\r\n| project Value = name, Label = strcat(name, ' - (Enabled)'), selected = true, displayOrder = \"2\", group = \"Select individual enabled policies\"\r\n)\r\n| union (\r\nSigninLogs\r\n| project ConditionalAccessPolicies, TimeGenerated, ClientAppUsed\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where ClientAppUsed == \"Browser\"\r\n| top 1 by TimeGenerated\r\n| project-away TimeGenerated\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"result\"] contains \"reportOnly\"\r\n| project name = ConditionalAccessPolicies[\"displayName\"]\r\n| project Value = name, Label = strcat(name, ' - (Report-only)'), selected = false, displayOrder = \"3\", group = \"Select individual report-only policies\"\r\n)\r\n| sort by displayOrder asc, Label asc\r\n\r\n", + "crossComponentResources": [ + "{Workspace}" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContext": { + "durationMs": 14400000 + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "17196e4b-f291-46a5-9e00-0b5e0d8943e8", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "93cfc5e1-92f3-43a3-aad5-dc7fc507eb57", + "version": "KqlParameterItem/1.0", + "name": "User", + "type": 1, + "description": "Default value is All users", + "value": "All users", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "60a4d33d-0d73-47e8-a32d-6798d0f5730e", + "version": "KqlParameterItem/1.0", + "name": "App", + "type": 1, + "description": "Default value is All apps", + "value": "All apps", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "db042271-d62d-45ee-ab7f-56fef70dc459", + "version": "KqlParameterItem/1.0", + "name": "unit", + "label": "Data view", + "type": 2, + "description": "Display results by number of users or number of sign-ins", + "isRequired": true, + "query": "let unit = datatable(label:string,units:string)\r\n[\"users\", \"|\",\r\n \"sign-ins\",\"//\"];\r\nunit \r\n| project Value = units, Label = label", + "value": "|", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "## Impact Summary" + }, + "name": "text - 5" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "https://docs.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting#impact-summary", + "linkTarget": "Url", + "linkLabel": "here.", + "preText": "Click on a tile to filter by the policy result below. Learn more about the result types ", + "style": "link" + } + ] + }, + "name": "links - 25" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Total\r\nSigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project UserDisplayName, AppDisplayName\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n{unit} summarize count() by UserDisplayName\r\n| summarize count()\r\n| extend resultName = \"Total\", unit = case(\"{unit}\" == \"//\", \"sign-ins\",\"users\"), statusCode = 1\r\n//\r\n//\r\n// Number of success/failure/user action required/not applied\r\n| union (\r\nSigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessStatus, UserDisplayName, AppDisplayName\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| extend resultName = case(ConditionalAccessStatus == \"success\", \"Success\", ConditionalAccessStatus == \"failure\", \"Failure\", \"Not applied\")\r\n| extend statusCode = case(ConditionalAccessStatus == \"success\", 2, ConditionalAccessStatus == \"failure\", 3, 4)\r\n{unit} summarize count() by resultName, UserDisplayName, statusCode\r\n| summarize count() by resultName, statusCode\r\n| extend unit = case(\"{unit}\" == \"//\", \"sign-ins\",\"users\")\r\n)\r\n//\r\n// Case if result count is 0\r\n| join kind = fullouter (\r\n datatable (resultName:string,statusCode1:string)\r\n [\"Total\", 1,\r\n \"Success\", 2,\r\n \"Failure\", 3,\r\n \"Not applied\", 4]\r\n) on resultName\r\n| extend resultName = iff(resultName == '', resultName1, resultName), count_ = iff(resultName == '', 0, count_), unit = \"{unit:label}\", statusCode1\r\n| project-away resultName1\r\n| sort by statusCode1 asc", + "size": 3, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "resultName", + "exportParameterName": "resultName", + "exportDefaultValue": "Total", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "resultName", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "secondaryContent": { + "columnMatch": "unit", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isEqualTo", + "value": "All" + }, + "name": "query - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Total\r\nSigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| project-away ConditionalAccessPolicies\r\n{unit} summarize count() by UserDisplayName\r\n| summarize count()\r\n| extend resultName = \"Total\", unit = case(\"{unit}\" == \"//\", \"sign-ins\",\"users\"), statusCode = 1\r\n//\r\n//\r\n// Number of success/failure/user action required/not applied\r\n| union (\r\nSigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend resultName = case(result == \"success\" or result == \"reportOnlySuccess\", \"Success\", result == \"failure\" or result == \"reportOnlyFailure\", \"Failure\", result == \"interrupt\" or result == \"reportOnlyInterrupted\", \"User action required\", \"Not applied\")\r\n| extend statusCode = case(result == \"success\", 2, result == \"failure\", 3, result == \"interrupt\", 4, 5)\r\n{unit} summarize count() by resultName, UserDisplayName, statusCode\r\n| summarize count() by resultName, statusCode\r\n| extend unit = case(\"{unit}\" == \"//\", \"sign-ins\",\"users\")\r\n)\r\n//\r\n// Case if result count is 0\r\n| join kind = fullouter (\r\n datatable (resultName:string,statusCode1:string)\r\n [\"Total\", 1,\r\n \"Success\", 2,\r\n \"Failure\", 3,\r\n \"User action required\", 4,\r\n \"Not applied\", 5]\r\n) on resultName\r\n| extend resultName = iff(resultName == '', resultName1, resultName), count_ = iff(resultName == '', 0, count_), unit = \"{unit:label}\", statusCode1\r\n| project-away resultName1\r\n| sort by statusCode1 asc", + "size": 3, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "resultName", + "exportParameterName": "resultName", + "exportDefaultValue": "Total", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "resultName", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "secondaryContent": { + "columnMatch": "unit", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isNotEqualTo", + "value": "All" + }, + "name": "query - 56" + }, + { + "type": 1, + "content": { + "json": "__________________________________________\r\n## Breakdown per condition and sign-in status\r\n💡 *Download results to Excel or open query in Log Analytics by clicking the icons in the upper right corner of each query.*" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "name": "text - 14" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated{TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, DeviceDetail\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n// filter by the result type selected\r\n// Total = any result type (the result type will contain the empty string \"\")\r\n// Success = result types containing \"uccess\" (includes \"success\" and \"reportOnlySuccess\")\r\n// Failure = result types containing \"ailure\" (includes \"failure\" and \"reportOnlyFailure\")\r\n// User action required = result types containing \"nterrupt\" (includes \"interrupt\" and \"reportOnlyInterrupted\")\r\n// Not applied = result types containing \"ot\" (includes \"notApplied\", \"reportOnlyNotApplied\", and \"notEnabled\")\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"uccess\", \"{resultName}\" == \"Failure\", \"ailure\", \"{resultName}\" == \"User action required\", \"nterrupted\",\"ot\")\r\n| where result contains filterResult\r\n| extend deviceState = case(DeviceDetail[\"trustType\"] == \"\", \"Unmanaged\", DeviceDetail[\"trustType\"])\r\n{unit} summarize count() by UserDisplayName, deviceState\r\n| summarize count() by deviceState\r\n\r\n", + "size": 1, + "showAnalytics": true, + "title": "Device State - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isNotEqualTo", + "value": "All" + }, + "customWidth": "33", + "name": "Device state - individual policies" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated{TimeRange:value}\r\n| project ConditionalAccessStatus, UserDisplayName, AppDisplayName, DeviceDetail\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"success\", \"{resultName}\" == \"Failure\", \"failure\", \"notApplied\")\r\n| where ConditionalAccessStatus contains filterResult\r\n| extend deviceState = case(DeviceDetail[\"trustType\"] == \"\", \"Unmanaged\", DeviceDetail[\"trustType\"])\r\n{unit} summarize count() by UserDisplayName, deviceState\r\n| summarize count() by deviceState\r\n\r\n", + "size": 1, + "showAnalytics": true, + "title": "Device State - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isEqualTo", + "value": "All" + }, + "customWidth": "33", + "name": "Device state - all enabled policies" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, DeviceDetail\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n// filter by the result type selected\r\n// Total = any result type (the result type will contain the empty string \"\")\r\n// Success = result types containing \"uccess\" (includes \"success\" and \"reportOnlySuccess\")\r\n// Failure = result types containing \"ailure\" (includes \"failure\" and \"reportOnlyFailure\")\r\n// User action required = result types containing \"nterrupt\" (includes \"interrupt\" and \"reportOnlyInterrupted\")\r\n// Not applied = result types containing \"ot\" (includes \"notApplied\", \"reportOnlyNotApplied\", and \"notEnabled\")\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"uccess\", \"{resultName}\" == \"Failure\", \"ailure\", \"{resultName}\" == \"User action required\", \"nterrupted\",\"ot\")\r\n| where result contains filterResult\r\n| extend device = tostring(DeviceDetail[\"operatingSystem\"])\r\n{unit} summarize count() by UserDisplayName, device\r\n| summarize count() by device\r\n\r\n\r\n", + "size": 1, + "showAnalytics": true, + "title": "Device platform - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isNotEqualTo", + "value": "All" + }, + "customWidth": "33", + "name": "Device platform - individual policy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessStatus, UserDisplayName, AppDisplayName, DeviceDetail\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"success\", \"{resultName}\" == \"Failure\", \"failure\", \"notApplied\")\r\n| where ConditionalAccessStatus contains filterResult\r\n| extend device = tostring(DeviceDetail[\"operatingSystem\"])\r\n{unit} summarize count() by UserDisplayName, device\r\n| summarize count() by device\r\n\r\n\r\n", + "size": 1, + "showAnalytics": true, + "title": "Device platform - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isEqualTo", + "value": "All" + }, + "customWidth": "33", + "name": "Device platform - all enabled policies" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, ClientAppUsed\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n// filter by the result type selected\r\n// Total = any result type (the result type will contain the empty string \"\")\r\n// Success = result types containing \"uccess\" (includes \"success\" and \"reportOnlySuccess\")\r\n// Failure = result types containing \"ailure\" (includes \"failure\" and \"reportOnlyFailure\")\r\n// User action required = result types containing \"nterrupt\" (includes \"interrupt\" and \"reportOnlyInterrupted\")\r\n// Not applied = result types containing \"ot\" (includes \"notApplied\", \"reportOnlyNotApplied\", and \"notEnabled\")\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"uccess\", \"{resultName}\" == \"Failure\", \"ailure\", \"{resultName}\" == \"User action required\", \"nterrupted\",\"ot\")\r\n| where result contains filterResult\r\n{unit} summarize count() by UserDisplayName, ClientAppUsed\r\n| summarize count() by ClientAppUsed", + "size": 1, + "showAnalytics": true, + "title": "Client app - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isNotEqualTo", + "value": "All" + }, + "customWidth": "33", + "name": "Client app - individual policy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessStatus, UserDisplayName, AppDisplayName, ClientAppUsed\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"success\", \"{resultName}\" == \"Failure\", \"failure\", \"notApplied\")\r\n| where ConditionalAccessStatus contains filterResult\r\n{unit} summarize count() by UserDisplayName, ClientAppUsed\r\n| summarize count() by ClientAppUsed", + "size": 1, + "showAnalytics": true, + "title": "Client app - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isEqualTo", + "value": "All" + }, + "customWidth": "33", + "name": "Client app - all enabled policies" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, RiskLevelDuringSignIn\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n// filter by the result type selected\r\n// Total = any result type (the result type will contain the empty string \"\")\r\n// Success = result types containing \"uccess\" (includes \"success\" and \"reportOnlySuccess\")\r\n// Failure = result types containing \"ailure\" (includes \"failure\" and \"reportOnlyFailure\")\r\n// User action required = result types containing \"nterrupt\" (includes \"interrupt\" and \"reportOnlyInterrupted\")\r\n// Not applied = result types containing \"ot\" (includes \"notApplied\", \"reportOnlyNotApplied\", and \"notEnabled\")\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"uccess\", \"{resultName}\" == \"Failure\", \"ailure\", \"{resultName}\" == \"User action required\", \"nterrupted\",\"ot\")\r\n| where result contains filterResult\r\n{unit} summarize count() by UserDisplayName, RiskLevelDuringSignIn\r\n| summarize count() by RiskLevelDuringSignIn", + "size": 1, + "showAnalytics": true, + "title": "Sign-in risk - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isNotEqualTo", + "value": "All" + }, + "customWidth": "33", + "name": "Sign-in risk - individual policy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessStatus, UserDisplayName, AppDisplayName, RiskLevelDuringSignIn\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"success\", \"{resultName}\" == \"Failure\", \"failure\", \"notApplied\")\r\n| where ConditionalAccessStatus contains filterResult\r\n{unit} summarize count() by UserDisplayName, RiskLevelDuringSignIn\r\n| summarize count() by RiskLevelDuringSignIn", + "size": 1, + "showAnalytics": true, + "title": "Sign-in risk - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isEqualTo", + "value": "All" + }, + "customWidth": "33", + "name": "Sign-in risk - all enabed policies" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, location = tostring(LocationDetails.city)\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n// filter by the result type selected\r\n// Total = any result type (the result type will contain the empty string \"\")\r\n// Success = result types containing \"uccess\" (includes \"success\" and \"reportOnlySuccess\")\r\n// Failure = result types containing \"ailure\" (includes \"failure\" and \"reportOnlyFailure\")\r\n// User action required = result types containing \"nterrupt\" (includes \"interrupt\" and \"reportOnlyInterrupted\")\r\n// Not applied = result types containing \"ot\" (includes \"notApplied\", \"reportOnlyNotApplied\", and \"notEnabled\")\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"uccess\", \"{resultName}\" == \"Failure\", \"ailure\", \"{resultName}\" == \"User action required\", \"nterrupted\",\"ot\")\r\n| where result contains filterResult\r\n{unit} summarize count() by UserDisplayName, location\r\n| summarize Count = count() by location\r\n| sort by Count desc", + "size": 1, + "showAnalytics": true, + "title": "Location - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "location", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Max" + } + }, + { + "columnMatch": "-- Group By --", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isNotEqualTo", + "value": "All" + }, + "customWidth": "33", + "name": "Location - individual policies" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessStatus, UserDisplayName, AppDisplayName, location = tostring(LocationDetails.city)\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"success\", \"{resultName}\" == \"Failure\", \"failure\", \"notApplied\")\r\n| where ConditionalAccessStatus contains filterResult\r\n{unit} summarize count() by UserDisplayName, location\r\n| summarize Count = count() by location\r\n| sort by Count desc", + "size": 1, + "showAnalytics": true, + "title": "Location - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "location", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Max" + } + }, + { + "columnMatch": "-- Group By --", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isEqualTo", + "value": "All" + }, + "customWidth": "33", + "name": "Location - all enabled policies" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, ResourceDisplayName\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n// filter by the result type selected\r\n// Total = any result type (the result type will contain the empty string \"\")\r\n// Success = result types containing \"uccess\" (includes \"success\" and \"reportOnlySuccess\")\r\n// Failure = result types containing \"ailure\" (includes \"failure\" and \"reportOnlyFailure\")\r\n// User action required = result types containing \"nterrupt\" (includes \"interrupt\" and \"reportOnlyInterrupted\")\r\n// Not applied = result types containing \"ot\" (includes \"notApplied\", \"reportOnlyNotApplied\", and \"notEnabled\")\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"uccess\", \"{resultName}\" == \"Failure\", \"ailure\", \"{resultName}\" == \"User action required\", \"nterrupted\",\"ot\")\r\n| where result contains filterResult\r\n{unit} summarize count() by UserDisplayName, AppDisplayName, ResourceDisplayName\r\n| summarize Count = count() by AppDisplayName, ResourceDisplayName\r\n| sort by Count desc", + "size": 1, + "showAnalytics": true, + "title": "Applications - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "location", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Max" + } + }, + { + "columnMatch": "-- Group By --", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isNotEqualTo", + "value": "All" + }, + "customWidth": "33", + "name": "Application - individual policies" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessStatus, UserDisplayName, AppDisplayName, ResourceDisplayName\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"success\", \"{resultName}\" == \"Failure\", \"failure\", \"notApplied\")\r\n| where ConditionalAccessStatus contains filterResult\r\n{unit} summarize count() by UserDisplayName, AppDisplayName, ResourceDisplayName\r\n| summarize Count = count() by AppDisplayName, ResourceDisplayName\r\n| sort by Count desc", + "size": 1, + "showAnalytics": true, + "title": "Applications - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "location", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Max" + } + }, + { + "columnMatch": "-- Group By --", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isEqualTo", + "value": "All" + }, + "customWidth": "33", + "name": "Applications - all enabled policies" + }, + { + "type": 1, + "content": { + "json": "____________________________________________\r\n## Sign-in Details\r\n💡 _To investigate sign-in details of a specific user, filter by username at the top of the workbook_" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "name": "text - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n// filter by the result type selected\r\n// Total = any result type (the result type will contain the empty string \"\")\r\n// Success = result types containing \"uccess\" (includes \"success\" and \"reportOnlySuccess\")\r\n// Failure = result types containing \"ailure\" (includes \"failure\" and \"reportOnlyFailure\")\r\n// User action required = result types containing \"nterrupt\" (includes \"interrupt\" and \"reportOnlyInterrupted\")\r\n// Not applied = result types containing \"ot\" (includes \"notApplied\", \"reportOnlyNotApplied\", and \"notEnabled\")\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"uccess\", \"{resultName}\" == \"Failure\", \"ailure\", \"{resultName}\" == \"User action required\", \"nterrupted\",\"ot\")\r\n| where result contains filterResult\r\n| summarize Count = count() by UserDisplayName\r\n| sort by Count desc", + "size": 0, + "showAnalytics": true, + "title": "User sign-in count - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "UserDisplayName", + "exportParameterName": "user", + "exportDefaultValue": "*", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Signins", + "formatter": 8, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isNotEqualTo", + "value": "All" + }, + "customWidth": "30", + "name": "User sign-in - individual policies" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessStatus, UserDisplayName, AppDisplayName\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"success\", \"{resultName}\" == \"Failure\", \"failure\", \"notApplied\")\r\n| where ConditionalAccessStatus contains filterResult\r\n| summarize Count = count() by UserDisplayName\r\n| sort by Count desc", + "size": 0, + "showAnalytics": true, + "title": "User sign-in count - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "UserDisplayName", + "exportParameterName": "user", + "exportDefaultValue": "*", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Signins", + "formatter": 8, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isEqualTo", + "value": "All" + }, + "customWidth": "30", + "name": "User sign-in count - all enabled policies" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessPolicies, TimeGenerated, UserDisplayName, AppDisplayName, ResourceDisplayName, CorrelationId, Status\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where '{user:escape}' == '*' or '{user:escape}' == UserDisplayName\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"], failureReason = tostring(Status[\"failureReason\"])\r\n| project-away ConditionalAccessPolicies\r\n// filter by the result type selected\r\n// Total = any result type (the result type will contain the empty string \"\")\r\n// Success = result types containing \"uccess\" (includes \"success\" and \"reportOnlySuccess\")\r\n// Failure = result types containing \"ailure\" (includes \"failure\" and \"reportOnlyFailure\")\r\n// User action required = result types containing \"nterrupt\" (includes \"interrupt\" and \"reportOnlyInterrupted\")\r\n// Not applied = result types containing \"ot\" (includes \"notApplied\", \"reportOnlyNotApplied\", and \"notEnabled\")\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"uccess\", \"{resultName}\" == \"Failure\", \"ailure\", \"{resultName}\" == \"User action required\", \"nterrupted\",\"ot\")\r\n| where result contains filterResult\r\n| project TimeGenerated, UserDisplayName, AppDisplayName, ResourceDisplayName, result, CorrelationId\r\n| sort by TimeGenerated desc", + "size": 0, + "showAnalytics": true, + "title": "Sign-in events - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Signins", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "combinedResult", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Count" + } + } + ], + "rowLimit": 1000, + "filter": true + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isNotEqualTo", + "value": "All" + }, + "customWidth": "70", + "name": "Sign-in details - individual policies" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where TimeGenerated {TimeRange:value}\r\n| project ConditionalAccessStatus, TimeGenerated, UserDisplayName, AppDisplayName, ResourceDisplayName, CorrelationId, Status\r\n| where '{user:escape}' == '*' or '{user:escape}' == UserDisplayName\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"\", \"{resultName}\" == \"Success\", \"success\", \"{resultName}\" == \"Failure\", \"failure\", \"notApplied\")\r\n| where ConditionalAccessStatus contains filterResult\r\n| project TimeGenerated, UserDisplayName, AppDisplayName, ResourceDisplayName, ConditionalAccessStatus, CorrelationId\r\n| sort by TimeGenerated desc", + "size": 0, + "showAnalytics": true, + "title": "Sign-in events - {resultName}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Signins", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "combinedResult", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Count" + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "conditionalVisibility": { + "parameterName": "Policy", + "comparison": "isEqualTo", + "value": "All" + }, + "customWidth": "70", + "name": "Sign-in details - all enabled policies" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Active Directory Conditional Access/Workbooks/Conditional Access Insights and Reporting/settings.json b/Azure Active Directory Conditional Access/Workbooks/Conditional Access Insights and Reporting/settings.json new file mode 100644 index 0000000..95f86b3 --- /dev/null +++ b/Azure Active Directory Conditional Access/Workbooks/Conditional Access Insights and Reporting/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Conditional Access Insights and Reporting", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.aadiam/tenant", "order": 49 }] +} \ No newline at end of file diff --git a/Azure Active Directory Conditional Access/Workbooks/Single Policy Insights (Preview)/settings.json b/Azure Active Directory Conditional Access/Workbooks/Single Policy Insights (Preview)/settings.json new file mode 100644 index 0000000..faf7f55 --- /dev/null +++ b/Azure Active Directory Conditional Access/Workbooks/Single Policy Insights (Preview)/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Single Policy Insights (Preview)", + "author": "Microsoft", + "isPreview": true, + "galleries": [{ "type": "workbook", "resourceType": "microsoft.aadiam/tenant", "order": 50 }] +} \ No newline at end of file diff --git a/Azure Active Directory Conditional Access/Workbooks/Single Policy Insights (Preview)/singlepolicy.txt b/Azure Active Directory Conditional Access/Workbooks/Single Policy Insights (Preview)/singlepolicy.txt new file mode 100644 index 0000000..d0c0445 --- /dev/null +++ b/Azure Active Directory Conditional Access/Workbooks/Single Policy Insights (Preview)/singlepolicy.txt @@ -0,0 +1,806 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Conditional Access Insights\n" + }, + "name": "text - 5" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "https://portal.azure.com/?reportonlypolicies=true#blade/Microsoft_AAD_IAM/ConditionalAccessBlade/Policies", + "linkTarget": "Url", + "linkLabel": "visit the Conditional Access blade.", + "preText": "Select a conditional access policy to evaluate its impact. To modify or enforce a policy", + "postText": "", + "style": "link" + }, + { + "cellValue": "https://forms.office.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR-yNf4bujCxMnnpOaB92Gr5UN0Y2TjAxSE1CODY3QzE1OEg2Q0lEQkdPSi4u", + "linkTarget": "Url", + "linkLabel": "here.", + "preText": "Submit private preview feedback ", + "postText": "", + "style": "link" + } + ] + }, + "name": "Unknown - 11" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "9b8cc3f0-ebab-482e-be6d-903f3e066c99", + "version": "KqlParameterItem/1.0", + "name": "Policy", + "label": "Conditional Access Policy", + "type": 2, + "isRequired": true, + "query": "SigninLogs\r\n| project ConditionalAccessPolicies, CreatedDateTime, ClientAppUsed\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where ClientAppUsed == \"Browser\"\r\n| top 1 by CreatedDateTime\r\n| project-away CreatedDateTime\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"result\"] !contains \"reportOnly\" and ConditionalAccessPolicies[\"result\"] !contains \"notEnabled\"\r\n| project name = ConditionalAccessPolicies[\"displayName\"]\r\n| project Value = name, Label = strcat(name, ' - (Enabled)'), selected = true, displayOrder = \"1\", group = \"Enabled policies\"\r\n| union (\r\nSigninLogs\r\n| project ConditionalAccessPolicies, CreatedDateTime, ClientAppUsed\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where ClientAppUsed == \"Browser\"\r\n| top 1 by CreatedDateTime\r\n| project-away CreatedDateTime\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"result\"] contains \"reportOnly\"\r\n| project name = ConditionalAccessPolicies[\"displayName\"]\r\n| project Value = name, Label = strcat(name, ' - (Report-only)'), selected = false, displayOrder = \"2\", group = \"Report-only policies\"\r\n)\r\n| sort by displayOrder asc, Label asc\r\n\r\n", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContext": { + "durationMs": 1800000 + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "17196e4b-f291-46a5-9e00-0b5e0d8943e8", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + } + }, + { + "id": "93cfc5e1-92f3-43a3-aad5-dc7fc507eb57", + "version": "KqlParameterItem/1.0", + "name": "User", + "type": 1, + "description": "Default value is All users", + "isRequired": true, + "value": "All users", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "60a4d33d-0d73-47e8-a32d-6798d0f5730e", + "version": "KqlParameterItem/1.0", + "name": "App", + "type": 1, + "description": "Default value is All apps", + "isRequired": true, + "value": "All apps", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "db042271-d62d-45ee-ab7f-56fef70dc459", + "version": "KqlParameterItem/1.0", + "name": "unit", + "label": "Data view", + "type": 2, + "description": "Display results by number of users or number of sign-ins", + "isRequired": true, + "query": "let unit = datatable(label:string,units:string)\r\n[\"users\", \"|\",\r\n \"sign-ins\",\"//\"];\r\nunit \r\n| project Value = units, Label = label", + "value": "|", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "## Impact Summary\nHere is the impact of the selected policy in your tenant over the {TimeRange}. \n\n💡 _View summary by number of users or number of sign-ins. Click on a tile to view details below._" + }, + "name": "text - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Total\r\nSigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| project-away ConditionalAccessPolicies\r\n{unit} summarize count() by UserDisplayName\r\n| summarize count()\r\n| extend resultName = \"Total\", unit = case(\"{unit}\" == \"//\", \"sign-ins\",\"users\"), statusCode = 1\r\n//\r\n//\r\n// Number of success/failure/user action required/not applied\r\n| union (\r\nSigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend resultName = case(result == \"success\" or result == \"reportOnlySuccess\", \"Success\", result == \"failure\" or result == \"reportOnlyFailure\", \"Failure\", result == \"interrupt\" or result == \"reportOnlyInterrupted\", \"User action required\", \"Not applied\")\r\n| extend statusCode = case(result == \"success\", 2, result == \"failure\", 3, result == \"interrupt\", 4, 5)\r\n{unit} summarize count() by resultName, UserDisplayName, statusCode\r\n| summarize count() by resultName, statusCode\r\n| extend unit = case(\"{unit}\" == \"//\", \"sign-ins\",\"users\")\r\n)\r\n//\r\n// Case if result count is 0\r\n| join kind = fullouter (\r\n datatable (resultName:string,statusCode1:string)\r\n [\"Total\", 1,\r\n \"Success\", 2,\r\n \"Failure\", 3,\r\n \"User action required\", 4,\r\n \"Not applied\", 5]\r\n) on resultName\r\n| extend resultName = iff(resultName == '', resultName1, resultName), count_ = iff(resultName == '', 0, count_), unit = \"{unit:label}\", statusCode1\r\n| project-away resultName1\r\n| sort by statusCode1 asc", + "size": 3, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "resultName", + "exportParameterName": "resultName", + "exportDefaultValue": "Total", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "resultName", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "secondaryContent": { + "columnMatch": "unit", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + } + }, + "name": "query - 56" + }, + { + "type": 1, + "content": { + "json": "__________________________________________\r\n## Breakdown per condition and sign-in status\r\n💡 _Click the LogAnalytics icon in the corner of each query to run in a new window._" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "name": "text - 14" + }, + { + "type": 1, + "content": { + "json": "### Device State \r\n{resultName} ({unit:label})" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "customWidth": "33", + "name": "text - 13" + }, + { + "type": 1, + "content": { + "json": "### Device Platform\r\n{resultName} ({unit:label})" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "customWidth": "33", + "name": "text - 15" + }, + { + "type": 1, + "content": { + "json": "### Client App\r\n{resultName} ({unit:label})" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "customWidth": "33", + "name": "text - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime{TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, DeviceDetail\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n| extend deviceState = case(DeviceDetail[\"trustType\"] == \"\", \"Unmanaged\", DeviceDetail[\"trustType\"])\r\n{unit} summarize count() by UserDisplayName, deviceState\r\n| summarize count() by deviceState\r\n\r\n", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "33", + "name": "success users device state" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, DeviceDetail\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n| extend device = tostring(DeviceDetail[\"operatingSystem\"])\r\n{unit} summarize count() by UserDisplayName, device\r\n| summarize count() by device\r\n\r\n\r\n", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "33", + "name": "success users device state - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, ClientAppUsed\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n{unit} summarize count() by UserDisplayName, ClientAppUsed\r\n| summarize count() by ClientAppUsed", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "33", + "name": "success users device state - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Sign-in Risk\r\n{resultName} ({unit:label})" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "customWidth": "33", + "name": "text - 23" + }, + { + "type": 1, + "content": { + "json": "### Location\r\n{resultName} ({unit:label})" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "customWidth": "33", + "name": "text - 16" + }, + { + "type": 1, + "content": { + "json": "### Applications\n{resultName} ({unit:label})\n" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "customWidth": "33", + "name": "text - 6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, RiskLevelDuringSignIn\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n{unit} summarize count() by UserDisplayName, RiskLevelDuringSignIn\r\n| summarize count() by RiskLevelDuringSignIn", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "33", + "name": "success users device state - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, location = tostring(LocationDetails.city)\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n{unit} summarize count() by UserDisplayName, location\r\n| summarize Count = count() by location\r\n| sort by Count desc", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "location", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Max" + } + }, + { + "columnMatch": "-- Group By --", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "TimeGenerated", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "UserDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "AppDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "rowNumber", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "combinedResult", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ConditionalAccessPolicies", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "rowNumber1", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "customWidth": "33", + "name": "success users location" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n{unit} summarize count() by UserDisplayName, AppDisplayName\r\n| summarize Count = count() by AppDisplayName\r\n| sort by Count desc", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "location", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Max" + } + }, + { + "columnMatch": "-- Group By --", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "TimeGenerated", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "UserDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "AppDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "rowNumber", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "combinedResult", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ConditionalAccessPolicies", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "rowNumber1", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "customWidth": "33", + "name": "success users location - Copy" + }, + { + "type": 1, + "content": { + "json": "____________________________________________\r\n## Sign-in Details\r\n💡 _To investigate sign-in details of a specific user, filter by username at the top of the workbook_" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "name": "text - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n| summarize Count = count() by UserDisplayName\r\n| sort by Count desc", + "size": 0, + "showAnalytics": true, + "title": "User sign-in count", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "UserDisplayName", + "exportParameterName": "user", + "exportDefaultValue": "*", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "UserDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Signins", + "formatter": 8, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "customWidth": "30", + "name": "query - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, CreatedDateTime, UserDisplayName, AppDisplayName, CorrelationId, Status\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where '{user:escape}' == '*' or '{user:escape}' == UserDisplayName\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"], failureReason = tostring(Status[\"failureReason\"])\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n| project CreatedDateTime, UserDisplayName, AppDisplayName, result, CorrelationId", + "size": 0, + "showAnalytics": true, + "title": "Sign-in events", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "UserDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "count_", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TimeGenerated", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "AppDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Signins", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "CorrelationId", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "combinedResult", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "-- Group By --", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 1000, + "filter": true + } + }, + "customWidth": "70", + "name": "query - 22" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Active Directory Conditional Access/Workbooks/Single Policy Insights (Preview)/singlepolicyinsights.workbook b/Azure Active Directory Conditional Access/Workbooks/Single Policy Insights (Preview)/singlepolicyinsights.workbook new file mode 100644 index 0000000..d0c0445 --- /dev/null +++ b/Azure Active Directory Conditional Access/Workbooks/Single Policy Insights (Preview)/singlepolicyinsights.workbook @@ -0,0 +1,806 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Conditional Access Insights\n" + }, + "name": "text - 5" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "https://portal.azure.com/?reportonlypolicies=true#blade/Microsoft_AAD_IAM/ConditionalAccessBlade/Policies", + "linkTarget": "Url", + "linkLabel": "visit the Conditional Access blade.", + "preText": "Select a conditional access policy to evaluate its impact. To modify or enforce a policy", + "postText": "", + "style": "link" + }, + { + "cellValue": "https://forms.office.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR-yNf4bujCxMnnpOaB92Gr5UN0Y2TjAxSE1CODY3QzE1OEg2Q0lEQkdPSi4u", + "linkTarget": "Url", + "linkLabel": "here.", + "preText": "Submit private preview feedback ", + "postText": "", + "style": "link" + } + ] + }, + "name": "Unknown - 11" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "9b8cc3f0-ebab-482e-be6d-903f3e066c99", + "version": "KqlParameterItem/1.0", + "name": "Policy", + "label": "Conditional Access Policy", + "type": 2, + "isRequired": true, + "query": "SigninLogs\r\n| project ConditionalAccessPolicies, CreatedDateTime, ClientAppUsed\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where ClientAppUsed == \"Browser\"\r\n| top 1 by CreatedDateTime\r\n| project-away CreatedDateTime\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"result\"] !contains \"reportOnly\" and ConditionalAccessPolicies[\"result\"] !contains \"notEnabled\"\r\n| project name = ConditionalAccessPolicies[\"displayName\"]\r\n| project Value = name, Label = strcat(name, ' - (Enabled)'), selected = true, displayOrder = \"1\", group = \"Enabled policies\"\r\n| union (\r\nSigninLogs\r\n| project ConditionalAccessPolicies, CreatedDateTime, ClientAppUsed\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where ClientAppUsed == \"Browser\"\r\n| top 1 by CreatedDateTime\r\n| project-away CreatedDateTime\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"result\"] contains \"reportOnly\"\r\n| project name = ConditionalAccessPolicies[\"displayName\"]\r\n| project Value = name, Label = strcat(name, ' - (Report-only)'), selected = false, displayOrder = \"2\", group = \"Report-only policies\"\r\n)\r\n| sort by displayOrder asc, Label asc\r\n\r\n", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContext": { + "durationMs": 1800000 + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "17196e4b-f291-46a5-9e00-0b5e0d8943e8", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + } + }, + { + "id": "93cfc5e1-92f3-43a3-aad5-dc7fc507eb57", + "version": "KqlParameterItem/1.0", + "name": "User", + "type": 1, + "description": "Default value is All users", + "isRequired": true, + "value": "All users", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "60a4d33d-0d73-47e8-a32d-6798d0f5730e", + "version": "KqlParameterItem/1.0", + "name": "App", + "type": 1, + "description": "Default value is All apps", + "isRequired": true, + "value": "All apps", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "db042271-d62d-45ee-ab7f-56fef70dc459", + "version": "KqlParameterItem/1.0", + "name": "unit", + "label": "Data view", + "type": 2, + "description": "Display results by number of users or number of sign-ins", + "isRequired": true, + "query": "let unit = datatable(label:string,units:string)\r\n[\"users\", \"|\",\r\n \"sign-ins\",\"//\"];\r\nunit \r\n| project Value = units, Label = label", + "value": "|", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "## Impact Summary\nHere is the impact of the selected policy in your tenant over the {TimeRange}. \n\n💡 _View summary by number of users or number of sign-ins. Click on a tile to view details below._" + }, + "name": "text - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Total\r\nSigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| project-away ConditionalAccessPolicies\r\n{unit} summarize count() by UserDisplayName\r\n| summarize count()\r\n| extend resultName = \"Total\", unit = case(\"{unit}\" == \"//\", \"sign-ins\",\"users\"), statusCode = 1\r\n//\r\n//\r\n// Number of success/failure/user action required/not applied\r\n| union (\r\nSigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend resultName = case(result == \"success\" or result == \"reportOnlySuccess\", \"Success\", result == \"failure\" or result == \"reportOnlyFailure\", \"Failure\", result == \"interrupt\" or result == \"reportOnlyInterrupted\", \"User action required\", \"Not applied\")\r\n| extend statusCode = case(result == \"success\", 2, result == \"failure\", 3, result == \"interrupt\", 4, 5)\r\n{unit} summarize count() by resultName, UserDisplayName, statusCode\r\n| summarize count() by resultName, statusCode\r\n| extend unit = case(\"{unit}\" == \"//\", \"sign-ins\",\"users\")\r\n)\r\n//\r\n// Case if result count is 0\r\n| join kind = fullouter (\r\n datatable (resultName:string,statusCode1:string)\r\n [\"Total\", 1,\r\n \"Success\", 2,\r\n \"Failure\", 3,\r\n \"User action required\", 4,\r\n \"Not applied\", 5]\r\n) on resultName\r\n| extend resultName = iff(resultName == '', resultName1, resultName), count_ = iff(resultName == '', 0, count_), unit = \"{unit:label}\", statusCode1\r\n| project-away resultName1\r\n| sort by statusCode1 asc", + "size": 3, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "resultName", + "exportParameterName": "resultName", + "exportDefaultValue": "Total", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "resultName", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "secondaryContent": { + "columnMatch": "unit", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + } + }, + "name": "query - 56" + }, + { + "type": 1, + "content": { + "json": "__________________________________________\r\n## Breakdown per condition and sign-in status\r\n💡 _Click the LogAnalytics icon in the corner of each query to run in a new window._" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "name": "text - 14" + }, + { + "type": 1, + "content": { + "json": "### Device State \r\n{resultName} ({unit:label})" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "customWidth": "33", + "name": "text - 13" + }, + { + "type": 1, + "content": { + "json": "### Device Platform\r\n{resultName} ({unit:label})" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "customWidth": "33", + "name": "text - 15" + }, + { + "type": 1, + "content": { + "json": "### Client App\r\n{resultName} ({unit:label})" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "customWidth": "33", + "name": "text - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime{TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, DeviceDetail\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n| extend deviceState = case(DeviceDetail[\"trustType\"] == \"\", \"Unmanaged\", DeviceDetail[\"trustType\"])\r\n{unit} summarize count() by UserDisplayName, deviceState\r\n| summarize count() by deviceState\r\n\r\n", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "33", + "name": "success users device state" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, DeviceDetail\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n| extend device = tostring(DeviceDetail[\"operatingSystem\"])\r\n{unit} summarize count() by UserDisplayName, device\r\n| summarize count() by device\r\n\r\n\r\n", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "33", + "name": "success users device state - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, ClientAppUsed\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n{unit} summarize count() by UserDisplayName, ClientAppUsed\r\n| summarize count() by ClientAppUsed", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "33", + "name": "success users device state - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Sign-in Risk\r\n{resultName} ({unit:label})" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "customWidth": "33", + "name": "text - 23" + }, + { + "type": 1, + "content": { + "json": "### Location\r\n{resultName} ({unit:label})" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "customWidth": "33", + "name": "text - 16" + }, + { + "type": 1, + "content": { + "json": "### Applications\n{resultName} ({unit:label})\n" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "customWidth": "33", + "name": "text - 6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, RiskLevelDuringSignIn\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n{unit} summarize count() by UserDisplayName, RiskLevelDuringSignIn\r\n| summarize count() by RiskLevelDuringSignIn", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "deviceState", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "33", + "name": "success users device state - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName, location = tostring(LocationDetails.city)\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n{unit} summarize count() by UserDisplayName, location\r\n| summarize Count = count() by location\r\n| sort by Count desc", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "location", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Max" + } + }, + { + "columnMatch": "-- Group By --", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "TimeGenerated", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "UserDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "AppDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "rowNumber", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "combinedResult", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ConditionalAccessPolicies", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "rowNumber1", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "customWidth": "33", + "name": "success users location" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n{unit} summarize count() by UserDisplayName, AppDisplayName\r\n| summarize Count = count() by AppDisplayName\r\n| sort by Count desc", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "location", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Max" + } + }, + { + "columnMatch": "-- Group By --", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "TimeGenerated", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "UserDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "AppDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "rowNumber", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "combinedResult", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ConditionalAccessPolicies", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "rowNumber1", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "customWidth": "33", + "name": "success users location - Copy" + }, + { + "type": 1, + "content": { + "json": "____________________________________________\r\n## Sign-in Details\r\n💡 _To investigate sign-in details of a specific user, filter by username at the top of the workbook_" + }, + "conditionalVisibility": { + "parameterName": "statusCode", + "comparison": "isNotEqualTo", + "value": "0" + }, + "name": "text - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, UserDisplayName, AppDisplayName\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| project-away AppDisplayName\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"]\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n| summarize Count = count() by UserDisplayName\r\n| sort by Count desc", + "size": 0, + "showAnalytics": true, + "title": "User sign-in count", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "UserDisplayName", + "exportParameterName": "user", + "exportDefaultValue": "*", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "UserDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Signins", + "formatter": 8, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "customWidth": "30", + "name": "query - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where CreatedDateTime {TimeRange:value}\r\n| project ConditionalAccessPolicies, CreatedDateTime, UserDisplayName, AppDisplayName, CorrelationId, Status\r\n| where ConditionalAccessPolicies != \"[]\"\r\n| where '{user:escape}' == '*' or '{user:escape}' == UserDisplayName\r\n| where \"{User:escape}\" == \"All users\" or UserDisplayName contains \"{User:escape}\"\r\n| where \"{App:escape}\" == \"All apps\" or AppDisplayName contains \"{App:escape}\"\r\n| mv-expand ConditionalAccessPolicies\r\n| where ConditionalAccessPolicies[\"displayName\"] == \"{Policy:escape}\"\r\n| extend result = ConditionalAccessPolicies[\"result\"], failureReason = tostring(Status[\"failureReason\"])\r\n| project-away ConditionalAccessPolicies\r\n| extend filterResult = case(\"{resultName}\" == \"Total\",\"successfailureinterruptreportOnlySuccessreportOnlyFailurereportOnlyInterruptedreportOnlyNotAppliednotEnabled\", \"{resultName}\" == \"Success\", \"successreportOnlySuccess\", \"{resultName}\" == \"Failure\", \"failurereportOnlyFailure\", \"{resultName}\" == \"User action required\", \"interruptreportOnlyInterrupted\",\"notAppliedreportOnlyNotAppliednotEnabled\")\r\n| where filterResult contains result\r\n| project CreatedDateTime, UserDisplayName, AppDisplayName, result, CorrelationId", + "size": 0, + "showAnalytics": true, + "title": "Sign-in events", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "UserDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "count_", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TimeGenerated", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "AppDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Signins", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "CorrelationId", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "combinedResult", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "-- Group By --", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 1000, + "filter": true + } + }, + "customWidth": "70", + "name": "query - 22" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Active Directory Conditional Access/Workbooks/categoryResources.json b/Azure Active Directory Conditional Access/Workbooks/categoryResources.json new file mode 100644 index 0000000..87e8322 --- /dev/null +++ b/Azure Active Directory Conditional Access/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Conditional access", "description": "Provides insights on conditional access sign-ins", "order": 150} +} \ No newline at end of file diff --git a/Azure Active Directory Domain Services/Alerts/README b/Azure Active Directory Domain Services/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Azure Active Directory Domain Services/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Azure Active Directory Domain Services/Queries/README b/Azure Active Directory Domain Services/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Azure Active Directory Domain Services/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Azure Active Directory Domain Services/Workbooks/Account Activity Report/AccountActivityReport.workbook b/Azure Active Directory Domain Services/Workbooks/Account Activity Report/AccountActivityReport.workbook new file mode 100644 index 0000000..5c8a738 --- /dev/null +++ b/Azure Active Directory Domain Services/Workbooks/Account Activity Report/AccountActivityReport.workbook @@ -0,0 +1,1041 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# AAD-Domain Services: Account Activity Report #" + }, + "name": "text - 0" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "nav", + "links": [ + { + "cellValue": "https://aka.ms/aadds-accountreportwb", + "linkTarget": "Url", + "linkLabel": "how to", + "preText": "Learn", + "postText": "use this workbook or customize your own", + "style": "link" + } + ] + }, + "name": "links - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "ee63ceeb-6612-4328-a0d1-141346a75301", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription_Internal", + "type": 1, + "isRequired": true, + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "153c90e6-fd6d-453e-8cff-a51e8f194311", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "571bbb55-a9b5-4230-a2b4-a181e5ae43be", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "value": null + }, + { + "id": "ba96ec8f-64a9-42fd-a5b5-2896a07261c5", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "isRequired": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 3600000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "82dcabd6-5a30-4ead-904a-d1ade6d991ba", + "version": "KqlParameterItem/1.0", + "name": "TileView", + "label": "Tile view", + "type": 2, + "description": "What do you want the tiles to show?", + "isRequired": true, + "value": "A", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"label\":\"Percentages\", \"value\":\"A\" },\r\n { \"label\":\"Counts\", \"value\":\"B\" }\r\n]" + }, + { + "id": "ba102d1d-f49b-4e3a-b715-e2e79a6873b3", + "version": "KqlParameterItem/1.0", + "name": "name", + "label": "Account username", + "type": 1, + "description": "Which user account do you want to audit?", + "isRequired": true + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "____" + }, + "name": "text - 1" + }, + { + "type": 1, + "content": { + "json": "## Account Security ##" + }, + "name": "text - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Q0A: Generate percentage-tiles for sign-in attempts to a given user account with result percentages\r\n// Define lookup table for auth attempt result types\r\nlet ErrorCodes = datatable(ErrorCode:string, ErrorType:string)\r\n [ \"0xC0000064\", \"Bad Username\"\r\n , \"0xC000006A\", \"Bad Password\"\r\n , \"0xC000006D\", \"Generic Logon Failure\"\r\n , \"0xC000006F\", \"Outside Authorized Hours\"\r\n , \"0xC0000070\", \"Unauthorized Workstation\"\r\n , \"0xC0000071\", \"Expired Password\"\r\n , \"0xC0000072\", \"Account Disabled\"\r\n , \"0xC0000193\", \"Account Expired\"\r\n , \"0xC0000224\", \"Successful\"\r\n , \"0xC0000234\", \"Account Locked Out\"\r\n , \"0xC0000371\", \"The local account store does not contain secret material for the specified account.\"\r\n , \"0x0\", \"Successful\"\r\n ];\r\n// Get counts for each result type\r\nlet SourceTable = materialize(\r\n AADDomainServicesAccountLogon\r\n | where TimeGenerated {TimeRange:value}\r\n | project Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , AccountName = tolower(extract(\"Logon Account:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription)))\r\n , ErrorCode = extract(\"Error Code:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n | where Event_ID == \"4776\"\r\n and AccountName =~ '{name:value}'\r\n | lookup kind=leftouter ErrorCodes on ErrorCode\r\n | summarize count() by ErrorType\r\n | extend flag = 1\r\n);\r\n// Get total count for all auth attempts\r\nlet TotalCount = materialize(\r\n SourceTable\r\n | summarize sum(count_)\r\n | extend flag = 1\r\n);\r\n// Combine tables and calculate percentages\r\nlet percentTable = materialize(\r\n SourceTable\r\n | lookup kind=leftouter TotalCount on flag\r\n | project ErrorType\r\n , value = todouble(count_)\r\n , total = todouble(sum_count_)\r\n | project ErrorType\r\n , percentage = (value / total) * 100\r\n);\r\n// Make and merge a table for all attempts at 100%\r\nlet totalPercent = datatable(ErrorType:string, percentage:real) [ 'All',100 ];\r\nunion withsource=TableName percentTable, totalPercent\r\n| project ErrorType\r\n , percentage\r\n| sort by percentage", + "size": 3, + "exportFieldName": "ErrorType", + "exportParameterName": "AuthResultA", + "exportDefaultValue": "All", + "title": "Sign-in results", + "noDataMessage": "No sign-in attempts found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "ErrorType", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "percentage", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": true, + "sortCriteriaField": "percentage", + "sortOrderField": 2 + } + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "A" + }, + "name": "query - 0A" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Q0B: Generate percentage-tiles for sign-in attempts to a given user account with result counts\r\n// Define lookup table for auth attempt result types\r\nlet ErrorCodes = datatable(ErrorCode:string, ErrorType:string)\r\n [ \"0xC0000064\", \"Bad Username\"\r\n , \"0xC000006A\", \"Bad Password\"\r\n , \"0xC000006D\", \"Generic Logon Failure\"\r\n , \"0xC000006F\", \"Outside Authorized Hours\"\r\n , \"0xC0000070\", \"Unauthorized Workstation\"\r\n , \"0xC0000071\", \"Expired Password\"\r\n , \"0xC0000072\", \"Account Disabled\"\r\n , \"0xC0000193\", \"Account Expired\"\r\n , \"0xC0000224\", \"Successful\"\r\n , \"0xC0000234\", \"Account Locked Out\"\r\n , \"0xC0000371\", \"The local account store does not contain secret material for the specified account.\"\r\n , \"0x0\", \"Successful\"\r\n ];\r\n// Get counts for each result type\r\nlet SourceTable = materialize(\r\n AADDomainServicesAccountLogon\r\n | where TimeGenerated {TimeRange:value}\r\n | project Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , AccountName = tolower(extract(\"Logon Account:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription)))\r\n , ErrorCode = extract(\"Error Code:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n | where Event_ID == \"4776\"\r\n and AccountName =~ '{name:value}'\r\n | lookup kind=leftouter ErrorCodes on ErrorCode\r\n | summarize count() by ErrorType\r\n | extend flag = 1\r\n);\r\n// Get total count for all auth attempts\r\nlet TotalCount = materialize(\r\n SourceTable\r\n | summarize count_ = sum(count_)\r\n | extend ErrorType = \"All\"\r\n);\r\n// Combine the tables\r\nunion withsource=TableName SourceTable, TotalCount\r\n| project ErrorType\r\n , count_\r\n| sort by count_", + "size": 3, + "exportFieldName": "ErrorType", + "exportParameterName": "AuthResultB", + "exportDefaultValue": "All", + "title": "Sign-in results", + "noDataMessage": "No sign-in attempts found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "ErrorType", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": true, + "sortCriteriaField": "percentage", + "sortOrderField": 2 + } + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "B" + }, + "name": "query - 0B" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// THIS QUERY HAS TWO VERSIONS - THEY ARE IDENTICAL EXCEPT THEY USE DIFFERENT PARAMETERS FOR AUTH RESULT. THIS IS ...\r\n// ... SO THAT BOTH VERSIONS OF THE TILE OBJECT CAN CONTROL THE TIME CHART AND GRID\r\n// Q1A: Generate time-chart for sign-in attempts to a given user account with a selected auth result type - IF SHOWING PERCENTAGES\r\n// Define lookup table for auth attempt result types\r\nlet ErrorCodes = datatable(ErrorCode:string, ErrorType:string)\r\n [ \"0xC0000064\", \"Bad Username\"\r\n , \"0xC000006A\", \"Bad Password\"\r\n , \"0xC000006D\", \"Generic Logon Failure\"\r\n , \"0xC000006F\", \"Outside Authorized Hours\"\r\n , \"0xC0000070\", \"Unauthorized Workstation\"\r\n , \"0xC0000071\", \"Expired Password\"\r\n , \"0xC0000072\", \"Account Disabled\"\r\n , \"0xC0000193\", \"Account Expired\"\r\n , \"0xC0000224\", \"Successful\"\r\n , \"0xC0000234\", \"Account Locked Out\"\r\n , \"0xC0000371\", \"The local account store does not contain secret material for the specified account.\"\r\n , \"0x0\", \"Successful\"\r\n ];\r\n// Filter down to the selected username and auth result type\r\nAADDomainServicesAccountLogon\r\n| where TimeGenerated {TimeRange:value}\r\n| project TimeGenerated\r\n , Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , AccountName = tolower(extract(\"Logon Account:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription)))\r\n , ErrorCode = extract(\"Error Code:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n| where Event_ID == \"4776\"\r\n and AccountName =~ '{name:value}'\r\n| lookup kind=leftouter ErrorCodes on ErrorCode\r\n| extend ErrorFlag = \"All\" // Defined because boolean checks must begin with a column variable\r\n| where ErrorType == \"{AuthResultA}\"\r\n or ErrorFlag == \"{AuthResultA}\"\r\n// Keyword \"step\" refers to the aggregation bin width, or the period length that each data point in the ...\r\n// ... series will represent. For example, if we make a series ~ \"from 10am to 10pm step 1h\", the data ...\r\n// ... gets split into 12 hour-long segments (10-11, 11-12, 12-1, etc), so our series has 12 data points ...\r\n// ... where each one is the number of events that occurred in that hour-long stretch of time. You can ...\r\n// ... make this \"step\" variable any length of time. We recommend using the default {TimeRange:grain} ...\r\n// ... which changes based on how long the time range is, or just 1h for anything less than 30 days\r\n| make-series Attempts = count() on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1h\r\n| render timechart", + "size": 0, + "title": "Sign-in distribution*", + "noDataMessage": "No sign-in attempts found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "timeBrushParameterName": "TimeRangeA", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "A" + }, + "name": "query - 1A" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// THIS QUERY HAS TWO VERSIONS - THEY ARE IDENTICAL EXCEPT THEY USE DIFFERENT PARAMETERS FOR AUTH RESULT. THIS IS ...\r\n// ... SO THAT BOTH VERSIONS OF THE TILE OBJECT CAN CONTROL THE TIME CHART AND GRID\r\n// Q1B: Generate time-chart for sign-in attempts to a given user account with a selected auth result type - IF SHOWING COUNTS\r\n// Define lookup table for auth attempt result types\r\nlet ErrorCodes = datatable(ErrorCode:string, ErrorType:string)\r\n [ \"0xC0000064\", \"Bad Username\"\r\n , \"0xC000006A\", \"Bad Password\"\r\n , \"0xC000006D\", \"Generic Logon Failure\"\r\n , \"0xC000006F\", \"Outside Authorized Hours\"\r\n , \"0xC0000070\", \"Unauthorized Workstation\"\r\n , \"0xC0000071\", \"Expired Password\"\r\n , \"0xC0000072\", \"Account Disabled\"\r\n , \"0xC0000193\", \"Account Expired\"\r\n , \"0xC0000224\", \"Successful\"\r\n , \"0xC0000234\", \"Account Locked Out\"\r\n , \"0xC0000371\", \"The local account store does not contain secret material for the specified account.\"\r\n , \"0x0\", \"Successful\"\r\n ];\r\n// Filter down to the selected username and auth result type\r\nAADDomainServicesAccountLogon\r\n| where TimeGenerated {TimeRange:value}\r\n| project TimeGenerated\r\n , Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , AccountName = tolower(extract(\"Logon Account:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription)))\r\n , ErrorCode = extract(\"Error Code:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n| where Event_ID == \"4776\"\r\n and AccountName =~ '{name:value}'\r\n| lookup kind=leftouter ErrorCodes on ErrorCode\r\n| extend ErrorFlag = \"All\" // Defined because boolean checks must begin with a column variable\r\n| where ErrorType == \"{AuthResultB}\"\r\n or ErrorFlag == \"{AuthResultB}\"\r\n// Keyword \"step\" refers to the aggregation bin width, or the period length that each data point in the ...\r\n// ... series will represent. For example, if we make a series ~ \"from 10am to 10pm step 1h\", the data ...\r\n// ... gets split into 12 hour-long segments (10-11, 11-12, 12-1, etc), so our series has 12 data points ...\r\n// ... where each one is the number of events that occurred in that hour-long stretch of time. You can ...\r\n// ... make this \"step\" variable any length of time. We recommend using the default {TimeRange:grain} ...\r\n// ... which changes based on how long the time range is, or just 1h for anything less than 30 days\r\n| make-series Attempts = count() on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1h\r\n| render timechart", + "size": 0, + "title": "Sign-in distribution*", + "noDataMessage": "No sign-in attempts found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "timeBrushParameterName": "TimeRangeB", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "B" + }, + "name": "query - 1B" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// THIS QUERY HAS TWO VERSIONS - THEY ARE IDENTICAL EXCEPT THEY USE DIFFERENT PARAMETERS FOR AUTH RESULT. THIS IS ...\r\n// ... SO THAT BOTH VERSIONS OF THE TILE OBJECT AND TIME CHART CAN CONTROL THE GRID\r\n// Q2A: Generate grid of logged sign-in attempts to a given user account with a selected auth result type - IF SHOWING PERCENTAGES\r\n// Define lookup table for auth attempt result types\r\nlet ErrorCodes = datatable(ErrorCode:string, ErrorType:string)\r\n [ \"0xC0000064\", \"Bad Username\"\r\n , \"0xC000006A\", \"Bad Password\"\r\n , \"0xC000006D\", \"Generic Logon Failure\"\r\n , \"0xC000006F\", \"Outside Authorized Hours\"\r\n , \"0xC0000070\", \"Unauthorized Workstation\"\r\n , \"0xC0000071\", \"Expired Password\"\r\n , \"0xC0000072\", \"Account Disabled\"\r\n , \"0xC0000193\", \"Account Expired\"\r\n , \"0xC0000224\", \"Successful\"\r\n , \"0xC0000234\", \"Account Locked Out\"\r\n , \"0xC0000371\", \"The local account store does not contain secret material for the specified account.\"\r\n , \"0x0\", \"Successful\"\r\n ];\r\n// Filter down to the selected username and auth result type [and sub-selected time range]\r\nAADDomainServicesAccountLogon\r\n| where TimeGenerated {TimeRangeA:value}\r\n| extend Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , AccountName = tolower(extract(\"Logon Account:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription)))\r\n , ErrorCode = extract(\"Error Code:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n| where Event_ID == \"4776\"\r\n and AccountName =~ '{name:value}'\r\n| lookup kind=leftouter ErrorCodes on ErrorCode\r\n| extend ErrorFlag = \"All\" // Defined because boolean checks must begin with a column variable\r\n| where ErrorType == \"{AuthResultA}\"\r\n or ErrorFlag == \"{AuthResultA}\"\r\n| extend Source_Workstation = extract(\"Source Workstation:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n| sort by TimeGenerated\r\n| project TimeGenerated\r\n , Event_ID\r\n , Action = \"Sign-in attempt\"\r\n , ErrorType\r\n , AccountName\r\n , Workstation = iff(Source_Workstation != \"\", Source_Workstation, \"\")\r\n , DC_ID = extract(\"([0-9A-Za-z]+)\",1,tostring(RecordId))", + "size": 1, + "title": "Sign-in event logs*", + "noDataMessage": "No sign-in attempts found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "TimeGenerated", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Event_ID", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Action", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ErrorType", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "AccountName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Workstation", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DC_ID", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "TimeGenerated", + "label": "Time" + }, + { + "columnId": "Event_ID", + "label": "Event", + "comment": "Event ID in Windows Server 2016 protocol" + }, + { + "columnId": "AccountName", + "label": "Username" + }, + { + "columnId": "ErrorType", + "label": "Result" + }, + { + "columnId": "Workstation", + "comment": "Shows as if not recorded" + }, + { + "columnId": "DC_ID", + "label": "Domain Controller", + "comment": "Which Domain Controller the event was logged on" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "A" + }, + "name": "query - 2A", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// THIS QUERY HAS TWO VERSIONS - THEY ARE IDENTICAL EXCEPT THEY USE DIFFERENT PARAMETERS FOR AUTH RESULT. THIS IS ...\r\n// ... SO THAT BOTH VERSIONS OF THE TILE OBJECT AND TIME CHART CAN CONTROL THE GRID\r\n// Q2B: Generate grid of logged sign-in attempts to a given user account with a selected auth result type - IF SHOWING PERCENTAGES\r\n// Define lookup table for auth attempt result types\r\nlet ErrorCodes = datatable(ErrorCode:string, ErrorType:string)\r\n [ \"0xC0000064\", \"Bad Username\"\r\n , \"0xC000006A\", \"Bad Password\"\r\n , \"0xC000006D\", \"Generic Logon Failure\"\r\n , \"0xC000006F\", \"Outside Authorized Hours\"\r\n , \"0xC0000070\", \"Unauthorized Workstation\"\r\n , \"0xC0000071\", \"Expired Password\"\r\n , \"0xC0000072\", \"Account Disabled\"\r\n , \"0xC0000193\", \"Account Expired\"\r\n , \"0xC0000224\", \"Successful\"\r\n , \"0xC0000234\", \"Account Locked Out\"\r\n , \"0xC0000371\", \"The local account store does not contain secret material for the specified account.\"\r\n , \"0x0\", \"Successful\"\r\n ];\r\n// Filter down to the selected username and auth result type [and sub-selected time range]\r\nAADDomainServicesAccountLogon\r\n| where TimeGenerated {TimeRangeB:value}\r\n| extend Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , AccountName = tolower(extract(\"Logon Account:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription)))\r\n , ErrorCode = extract(\"Error Code:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n| where Event_ID == \"4776\"\r\n and AccountName =~ '{name:value}'\r\n| lookup kind=leftouter ErrorCodes on ErrorCode\r\n| extend ErrorFlag = \"All\" // Defined because boolean checks must begin with a column variable\r\n| where ErrorType == \"{AuthResultB}\"\r\n or ErrorFlag == \"{AuthResultB}\"\r\n| extend Source_Workstation = extract(\"Source Workstation:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n| sort by TimeGenerated\r\n| project TimeGenerated\r\n , Event_ID\r\n , Action = \"Sign-in attempt\"\r\n , ErrorType\r\n , AccountName\r\n , Workstation = iff(Source_Workstation != \"\", Source_Workstation, \"\")\r\n , DC_ID = extract(\"([0-9A-Za-z]+)\",1,tostring(RecordId))", + "size": 1, + "title": "Sign-in event logs*", + "noDataMessage": "No sign-in attempts found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "TimeGenerated", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Event_ID", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Action", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ErrorType", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "AccountName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Workstation", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DC_ID", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "TimeGenerated", + "label": "Time" + }, + { + "columnId": "Event_ID", + "label": "Event", + "comment": "Event ID in Windows Server 2016 protocol" + }, + { + "columnId": "AccountName", + "label": "Username" + }, + { + "columnId": "ErrorType", + "label": "Result" + }, + { + "columnId": "Workstation", + "comment": "Shows as if not recorded" + }, + { + "columnId": "DC_ID", + "label": "Domain Controller", + "comment": "Which Domain Controller the event was logged on" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "B" + }, + "name": "query - 2B", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 1, + "content": { + "json": "_\\* Showing **{AuthResultA}** sign-in attempts for **{name}**_" + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "A" + }, + "name": "text - 3A" + }, + { + "type": 1, + "content": { + "json": "_\\* Showing **{AuthResultB}** sign-in attempts for **{name}**_" + }, + "conditionalVisibility": { + "parameterName": "TIleView", + "comparison": "isEqualTo", + "value": "B" + }, + "name": "text - 3B" + }, + { + "type": 1, + "content": { + "json": "___" + }, + "name": "text - 4" + }, + { + "type": 1, + "content": { + "json": "## Account Management ##" + }, + "name": "text - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Q3: Generate a grid of state-changes to a given user account\r\nAADDomainServicesAccountManagement\r\n| where TimeGenerated {TimeRange:value}\r\n| extend Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n| where Event_ID == \"4720\"\r\n or Event_ID == \"4722\"\r\n or Event_ID == \"4725\"\r\n or Event_ID == \"4726\"\r\n| parse ResultDescription with * \"Target Account:\" target\r\n| extend TargetUserName = extract(\"Account Name:\\t\\t(.+[ -~])\",1,tostring(target))\r\n , TargetDomainName = extract(\"Account Domain:\\t\\t(.+[ -~])\",1,tostring(target))\r\n| where TargetUserName =~ '{name:value}'\r\n| sort by TimeGenerated\r\n| project TimeGenerated\r\n , Event_ID\r\n , Action = case(Event_ID == \"4720\", \"Account Created\"\r\n , Event_ID == \"4722\", \"Account Enabled\"\r\n , Event_ID == \"4725\", \"Account Disabled\"\r\n , \"Account Deleted\")\r\n , Subject = strcat(SubjectUserName, \" [\", SubjectDomainName, \"/\", SubjectUserSid, \"]\")\r\n , SubjectLogonId\r\n , Target = strcat(TargetUserName, \" [\", TargetDomainName, \"/\", TargetSid, \"]\")\r\n , DC_ID = extract(\"([0-9A-Za-z]+)\",1,tostring(RecordId))", + "size": 1, + "title": "Account state changes", + "noDataMessage": "No changes found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "TimeGenerated", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Event_ID", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Action", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SubjectUserSid", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SubjectUserName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SubjectDomainName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SubjectLogonId", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TargetSid", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TargetUserName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TargetDomainName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DC_ID", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "labelSettings": [ + { + "columnId": "TimeGenerated", + "label": "Time" + }, + { + "columnId": "Event_ID", + "label": "Event", + "comment": "Event ID in Windows Server 2016 protocol" + }, + { + "columnId": "Action" + }, + { + "columnId": "SubjectUserSid" + }, + { + "columnId": "SubjectUserName" + }, + { + "columnId": "SubjectDomainName" + }, + { + "columnId": "SubjectLogonId" + }, + { + "columnId": "TargetSid" + }, + { + "columnId": "TargetUserName" + }, + { + "columnId": "TargetDomainName" + }, + { + "columnId": "DC_ID", + "label": "Domain Controller", + "comment": "Which Domain Controller the event was logged on" + } + ] + } + }, + "name": "query - 3", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Q4: Generate a grid of password changes and resets for a given user account\r\nAADDomainServicesAccountManagement\r\n| where TimeGenerated {TimeRange:value}\r\n| extend Event_ID = extract(\".+/([0-9]+)\",1,tostring(OperationName))\r\n| where Event_ID == \"4723\"\r\n or Event_ID == \"4724\"\r\n| parse ResultDescription with * \"Target Account:\" target\r\n| extend TargetUserName = extract(\"Account Name:\\t*([[:print:]]*)\",1,tostring(target))\r\n , TargetDomainName = extract(\"Account Domain:\\t*([[:print:]]*)\",1,tostring(target))\r\n| where TargetUserName =~ '{name:value}'\r\n| sort by TimeGenerated\r\n| project TimeGenerated\r\n , Event_ID\r\n , Action = iif(Event_ID == \"4723\", \"Password Changed\", \"Password Reset\")\r\n , Subject = strcat(SubjectUserName, \" [\", SubjectDomainName, \"/\", SubjectUserSid, \"]\")\r\n , SubjectLogonId\r\n , Target = strcat(TargetUserName, \" [\", TargetDomainName, \"/\", TargetSid, \"]\")\r\n , DC_ID = extract(\"([0-9A-Za-z]+)\",1,tostring(RecordId))", + "size": 1, + "title": "Password management", + "noDataMessage": "No changes found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "TimeGenerated", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Event_ID", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Action", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SubjectUserSid", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SubjectUserName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SubjectDomainName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SubjectLogonId", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TargetSid", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TargetUserName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DC_ID", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "labelSettings": [ + { + "columnId": "TimeGenerated", + "label": "Time" + }, + { + "columnId": "Event_ID", + "label": "Event", + "comment": "Event ID in Windows Server 2016 protocol" + }, + { + "columnId": "Action" + }, + { + "columnId": "SubjectUserSid" + }, + { + "columnId": "SubjectUserName" + }, + { + "columnId": "SubjectDomainName" + }, + { + "columnId": "SubjectLogonId" + }, + { + "columnId": "TargetSid" + }, + { + "columnId": "TargetUserName" + }, + { + "columnId": "DC_ID", + "label": "Domain Controller", + "comment": "Which Domain Controller the event was logged on" + } + ] + } + }, + "name": "query - 4", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Q5: Generate a grid of group membership changes for a given user account\r\nAADDomainServicesAccountManagement\r\n| where TimeGenerated {TimeRange:value}\r\n| extend Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n| where Event_ID == \"4728\" or Event_ID == \"4729\"\r\n or Event_ID == \"4732\" or Event_ID == \"4733\"\r\n or Event_ID == \"4756\" or Event_ID == \"4757\"\r\n| where MemberName has '{name:value}'\r\n| parse ResultDescription with * \"Group:\" groupInfo\r\n| sort by TimeGenerated\r\n| project TimeGenerated\r\n , Event_ID\r\n , Action = iif(Event_ID in (\"4728\", \"4732\", \"4756\"), \"Added to a group\", \"Removed from a group\")\r\n , Subject = strcat(SubjectUserName, \" [\", SubjectDomainName, \"/\", SubjectUserSid, \"]\")\r\n , SubjectLogonId\r\n , Group = strcat(extract(\"Group Name:\\t*([ -~]*)\",1,tostring(groupInfo)), \" [\", TargetSid, \"]\")\r\n , Target = MemberName\r\n , DC_ID = extract(\"([0-9A-Za-z]+)\",1,tostring(RecordId))", + "size": 1, + "title": "Group membership", + "noDataMessage": "No changes found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "TimeGenerated", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Event_ID", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Action", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SubjectUserSid", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SubjectUserName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SubjectDomainName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SubjectLogonId", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TargetSid", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TargetUserName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "GroupSid", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "GroupName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DC_ID", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "labelSettings": [ + { + "columnId": "TimeGenerated", + "label": "Time" + }, + { + "columnId": "Event_ID", + "label": "Event", + "comment": "Event ID in Windows Server 2016 protocol" + }, + { + "columnId": "Action" + }, + { + "columnId": "SubjectUserSid" + }, + { + "columnId": "SubjectUserName" + }, + { + "columnId": "SubjectDomainName" + }, + { + "columnId": "SubjectLogonId" + }, + { + "columnId": "TargetSid" + }, + { + "columnId": "TargetUserName" + }, + { + "columnId": "GroupSid" + }, + { + "columnId": "GroupName" + }, + { + "columnId": "DC_ID", + "label": "Domain Controller", + "comment": "Which Domain Controller the event was logged on" + } + ] + } + }, + "name": "query - 5", + "styleSettings": { + "showBorder": true + } + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Active Directory Domain Services/Workbooks/Account Activity Report/aadds-logo.svg b/Azure Active Directory Domain Services/Workbooks/Account Activity Report/aadds-logo.svg new file mode 100644 index 0000000..ddb0955 --- /dev/null +++ b/Azure Active Directory Domain Services/Workbooks/Account Activity Report/aadds-logo.svg @@ -0,0 +1,33 @@ + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Azure Active Directory Domain Services/Workbooks/Account Activity Report/settings.json b/Azure Active Directory Domain Services/Workbooks/Account Activity Report/settings.json new file mode 100644 index 0000000..9b11d74 --- /dev/null +++ b/Azure Active Directory Domain Services/Workbooks/Account Activity Report/settings.json @@ -0,0 +1,10 @@ +{ + "name":"Account Activity Report", + "description":"Detailed sign-in and account management event logs for a specific user account", + "icon":"aadds-logo", + "tags": ["AADDS", "Audit logs"], + "author":"Microsoft", + "galleries": [{ "type":"workbook", "resourceType":"Microsoft.AAD/domainServices", "order": 200 }], + "order": 200, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json" +} \ No newline at end of file diff --git a/Azure Active Directory Domain Services/Workbooks/Security Overview Report/SecurityOverviewReport.workbook b/Azure Active Directory Domain Services/Workbooks/Security Overview Report/SecurityOverviewReport.workbook new file mode 100644 index 0000000..5126430 --- /dev/null +++ b/Azure Active Directory Domain Services/Workbooks/Security Overview Report/SecurityOverviewReport.workbook @@ -0,0 +1,584 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# AAD-Domain Services: Security Overview Report #" + }, + "name": "text - 0" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "nav", + "links": [ + { + "cellValue": "https://aka.ms/aadds-secoverviewwb", + "linkTarget": "Url", + "linkLabel": "how to", + "preText": "Learn", + "postText": "use this workbook or customize your own", + "style": "link" + } + ] + }, + "name": "links - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "value::selected" + ], + "parameters": [ + { + "id": "90303e6c-f16c-4afb-bfc2-642234cbaac8", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription_Internal", + "type": 1, + "isRequired": true, + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "735f8f15-3031-4f1c-9e10-7dc7c7e32bc4", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "ee1d4330-b4ef-46b7-b555-d15e2ccd0ced", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\n| project id", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "3dbe3381-e5e3-4e17-bbbf-2d715a70e95b", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "isRequired": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 3600000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "timeContext": { + "durationMs": 0 + } + }, + { + "id": "c2315535-f2b3-475c-ba7f-dcb883005e86", + "version": "KqlParameterItem/1.0", + "name": "TileView", + "label": "Tile view", + "type": 2, + "description": "What do you want the tiles to show?", + "isRequired": true, + "value": "A", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"label\":\"Percentages\", \"value\":\"A\" },\r\n { \"label\":\"Counts\", \"value\":\"B\" }\r\n]" + }, + { + "id": "3cfa8969-9796-4026-9786-4c6bb94d25c0", + "version": "KqlParameterItem/1.0", + "name": "TimeView", + "label": "Chart view", + "type": 2, + "description": "Do you want the chart to highlight anomalies?", + "isRequired": true, + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"label\":\"Highlight anomalies\", \"value\":\"1\" },\r\n { \"label\":\"Don't highlight anomalies\", \"value\":\"2\" }\r\n]" + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "___" + }, + "name": "text - 1" + }, + { + "type": 1, + "content": { + "json": "## Sign-in summary ##" + }, + "name": "text - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Q0A: Generate tiles for sign-in attempts with result percentages\r\n// Define lookup table for auth attempt result types\r\nlet ErrorCodes = datatable(ErrorCode:string, ErrorType:string)\r\n [ \"0xC0000064\", \"Bad Username\"\r\n , \"0xC000006A\", \"Bad Password\"\r\n , \"0xC000006D\", \"Generic Logon Failure\"\r\n , \"0xC000006F\", \"Outside Authorized Hours\"\r\n , \"0xC0000070\", \"Unauthorized Workstation\"\r\n , \"0xC0000071\", \"Expired Password\"\r\n , \"0xC0000072\", \"Account Disabled\"\r\n , \"0xC0000193\", \"Account Expired\"\r\n , \"0xC0000224\", \"Successful\"\r\n , \"0xC0000234\", \"Account Locked Out\"\r\n , \"0xC0000371\", \"The local account store does not contain secret material for the specified account.\"\r\n , \"0x0\", \"Successful\"\r\n ];\r\n// Get counts for each result type\r\nlet SourceTable = materialize(\r\n AADDomainServicesAccountLogon\r\n | where TimeGenerated {TimeRange:value}\r\n | project Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , ErrorCode = extract(\"Error Code:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n | where Event_ID == \"4776\"\r\n | lookup kind=leftouter ErrorCodes on ErrorCode\r\n | summarize count() by ErrorType\r\n | extend flag = 1\r\n);\r\n// Get total count for all auth attempts\r\nlet TotalCount = materialize(\r\n SourceTable\r\n | summarize sum(count_)\r\n | extend flag = 1\r\n);\r\n// Combine tables and calculate percentages\r\nlet percentTable = materialize(\r\n SourceTable\r\n | lookup kind=leftouter TotalCount on flag\r\n | project ErrorType\r\n , value = todouble(count_)\r\n , total = todouble(sum_count_)\r\n | project ErrorType\r\n , percentage = (value / total) * 100\r\n);\r\n// Make and merge a table for all attempts at 100%\r\nlet totalPercent = datatable(ErrorType:string, percentage:real) [ 'All',100 ];\r\nunion withsource=TableName percentTable, totalPercent\r\n| project ErrorType\r\n , percentage\r\n| sort by percentage", + "size": 3, + "exportFieldName": "ErrorType", + "exportParameterName": "AuthResultA", + "exportDefaultValue": "All", + "title": "Sign-in results", + "noDataMessage": "No sign-in attempts found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "ErrorType", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "percentage", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": true, + "sortCriteriaField": "percentage", + "sortOrderField": 2 + } + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "A" + }, + "name": "query - 0A" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Q0B: Generate tiles for sign-in attempts with result counts\r\n// Define lookup table for auth attempt result types\r\nlet ErrorCodes = datatable(ErrorCode:string, ErrorType:string)\r\n [ \"0xC0000064\", \"Bad Username\"\r\n , \"0xC000006A\", \"Bad Password\"\r\n , \"0xC000006D\", \"Generic Logon Failure\"\r\n , \"0xC000006F\", \"Outside Authorized Hours\"\r\n , \"0xC0000070\", \"Unauthorized Workstation\"\r\n , \"0xC0000071\", \"Expired Password\"\r\n , \"0xC0000072\", \"Account Disabled\"\r\n , \"0xC0000193\", \"Account Expired\"\r\n , \"0xC0000224\", \"Successful\"\r\n , \"0xC0000234\", \"Account Locked Out\"\r\n , \"0xC0000371\", \"The local account store does not contain secret material for the specified account.\"\r\n , \"0x0\", \"Successful\"\r\n ];\r\n// Get counts for each result type\r\nlet SourceTable = materialize(\r\n AADDomainServicesAccountLogon\r\n | where TimeGenerated {TimeRange:value}\r\n | project Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , ErrorCode = extract(\"Error Code:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n | where Event_ID == \"4776\"\r\n | lookup kind=leftouter ErrorCodes on ErrorCode\r\n | summarize count() by ErrorType\r\n);\r\n// Get total count for all auth attempts\r\nlet TotalCount = materialize(\r\n SourceTable\r\n | summarize count_ = sum(count_)\r\n | extend ErrorType = \"All\"\r\n);\r\n// Combine the tables\r\nunion withsource=TableName SourceTable, TotalCount\r\n| project ErrorType\r\n , count_\r\n| sort by count_", + "size": 3, + "exportFieldName": "ErrorType", + "exportParameterName": "AuthResultB", + "exportDefaultValue": "All", + "title": "Sign-in results", + "noDataMessage": "No sign-in attempts found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "ErrorType", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + } + }, + "showBorder": true, + "sortCriteriaField": "percentage", + "sortOrderField": 2 + } + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "B" + }, + "name": "query - 0B" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// THIS QUERY HAS TWO VERSIONS - THEY ARE IDENTICAL EXCEPT THEY USE DIFFERENT PARAMETERS FOR AUTH RESULT. THIS IS ...\r\n// ... SO THAT BOTH VERSIONS OF THE TILE OBJECT CAN CONTROL THE TIME CHART\r\n// Q1A: Generate time-chart for sign-in attempts with a selected auth result type (with or without anomaly detection) - IF SHOWING PERCENTAGES\r\n// Define lookup table for auth attempt result types\r\nlet ErrorCodes = datatable(ErrorCode:string, ErrorType:string)\r\n [ \"0xC0000064\", \"Bad Username\"\r\n , \"0xC000006A\", \"Bad Password\"\r\n , \"0xC000006D\", \"Generic Logon Failure\"\r\n , \"0xC000006F\", \"Outside Authorized Hours\"\r\n , \"0xC0000070\", \"Unauthorized Workstation\"\r\n , \"0xC0000071\", \"Expired Password\"\r\n , \"0xC0000072\", \"Account Disabled\"\r\n , \"0xC0000193\", \"Account Expired\"\r\n , \"0xC0000224\", \"Successful\"\r\n , \"0xC0000234\", \"Account Locked Out\"\r\n , \"0xC0000371\", \"The local account store does not contain secret material for the specified account.\"\r\n , \"0x0\", \"Successful\"\r\n ];\r\nAADDomainServicesAccountLogon\r\n// Filter down to the selected username and auth result type\r\n| where TimeGenerated {TimeRange:value}\r\n| project TimeGenerated\r\n , Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , ErrorCode = extract(\"Error Code:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n| where Event_ID == \"4776\"\r\n| lookup kind=leftouter ErrorCodes on ErrorCode\r\n| extend flag = \"All\" // Defined because boolean checks must begin with a column variable\r\n| where ErrorType == \"{AuthResultA:value}\"\r\n or flag == \"{AuthResultA:value}\"\r\n// Keyword \"step\" refers to the aggregation bin width, or the period length that each data point in the ...\r\n// ... series will represent. For example, if we make a series ~ \"from 10am to 10pm step 1h\", the data ...\r\n// ... gets split into 12 hour-long segments (10-11, 11-12, 12-1, etc), so our series has 12 data points ...\r\n// ... where each one is the number of events that occurred in that hour-long stretch of time. You can ...\r\n// ... make this \"step\" variable any length of time. We recommend using the default {TimeRange:grain} ...\r\n// ... which changes based on how long the time range is, or just 1h for anything less than 30 days \r\n| make-series y = count() on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1h\r\n// This function calculates the average value for the series and gives each data point in the series a ...\r\n// ... K-Score, which is based on standard deviation. Then, it \"flags\" every point with a K-score which ...\r\n// ... is greater than a positive threshold (or less than the negative of the threshold). The function ...\r\n// ... in the next line returns the average, the K-scores, and the flags as 3 additioanl series\r\n| extend series_decompose_anomalies(y)\r\n| extend series_stats(y)\r\n// This variable lets us turn off anomaly highlighting without making a separate query object\r\n| extend ShowAnomalies = \"1\"\r\n// Since we have a series of flags, and each flag is either +1, -1, or 0 (for anomaly greater than the ...\r\n// ... average, anomaly less than the average, or no anomaly, respectively), and that series lines up to ...\r\n// ... the original series on the time scale, we can make a new series that would visually draw attention ...\r\n// ... to the anomalies in the series. We do this by multiplying the flag series by the original series ...\r\n// ... which produces a new series that sits at zero for normal data but jumps up/down to the extreme ...\r\n// ... values where the series has an anomaly\r\n| project TimeGenerated\r\n , Attempt = y\r\n , Anomaly = iif(ShowAnomalies == {TimeView:value}, series_multiply(series_decompose_anomalies_y_ad_flag, y), series_multiply(y, 0))\r\n// If workbooks adds support for anomaly charts, we can just call \"render anomalychart\" on our original ...\r\n// ... data set without having to deal with flags and multiplication.\r\n| render timechart", + "size": 0, + "title": "Sign-in distribution*", + "noDataMessage": "No sign-in attempts found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "A" + }, + "name": "query - 1A" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// THIS QUERY HAS TWO VERSIONS - THEY ARE IDENTICAL EXCEPT THEY USE DIFFERENT PARAMETERS FOR AUTH RESULT. THIS IS ...\r\n// ... SO THAT BOTH VERSIONS OF THE TILE OBJECT CAN CONTROL THE TIME CHART\r\n// Q1A: Generate time-chart for sign-in attempts with a selected auth result type (with or without anomaly detection) - IF SHOWING COUNTS\r\n// Define lookup table for auth attempt result types\r\nlet ErrorCodes = datatable(ErrorCode:string, ErrorType:string)\r\n [ \"0xC0000064\", \"Bad Username\"\r\n , \"0xC000006A\", \"Bad Password\"\r\n , \"0xC000006D\", \"Generic Logon Failure\"\r\n , \"0xC000006F\", \"Outside Authorized Hours\"\r\n , \"0xC0000070\", \"Unauthorized Workstation\"\r\n , \"0xC0000071\", \"Expired Password\"\r\n , \"0xC0000072\", \"Account Disabled\"\r\n , \"0xC0000193\", \"Account Expired\"\r\n , \"0xC0000224\", \"Successful\"\r\n , \"0xC0000234\", \"Account Locked Out\"\r\n , \"0xC0000371\", \"The local account store does not contain secret material for the specified account.\"\r\n , \"0x0\", \"Successful\"\r\n ];\r\nAADDomainServicesAccountLogon\r\n// Filter down to the selected username and auth result type\r\n| where TimeGenerated {TimeRange:value}\r\n| project TimeGenerated\r\n , Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , ErrorCode = extract(\"Error Code:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n| where Event_ID == \"4776\"\r\n| lookup kind=leftouter ErrorCodes on ErrorCode\r\n| extend flag = \"All\" // Defined because boolean checks must begin with a column variable\r\n| where ErrorType == \"{AuthResultB:value}\"\r\n or flag == \"{AuthResultB:value}\"\r\n// Keyword \"step\" refers to the aggregation bin width, or the period length that each data point in the ...\r\n// ... series will represent. For example, if we make a series ~ \"from 10am to 10pm step 1h\", the data ...\r\n// ... gets split into 12 hour-long segments (10-11, 11-12, 12-1, etc), so our series has 12 data points ...\r\n// ... where each one is the number of events that occurred in that hour-long stretch of time. You can ...\r\n// ... make this \"step\" variable any length of time. We recommend using the default {TimeRange:grain} ...\r\n// ... which changes based on how long the time range is, or just 1h for anything less than 30 days \r\n| make-series y = count() on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1h\r\n// This function calculates the average value for the series and gives each data point in the series a ...\r\n// ... K-Score, which is based on standard deviation. Then, it \"flags\" every point with a K-score which ...\r\n// ... is greater than a positive threshold (or less than the negative of the threshold). The function ...\r\n// ... in the next line returns the average, the K-scores, and the flags as 3 additioanl series\r\n| extend series_decompose_anomalies(y)\r\n| extend series_stats(y)\r\n// This variable lets us turn off anomaly highlighting without making a separate query object\r\n| extend ShowAnomalies = \"1\"\r\n// Since we have a series of flags, and each flag is either +1, -1, or 0 (for anomaly greater than the ...\r\n// ... average, anomaly less than the average, or no anomaly, respectively), and that series lines up to ...\r\n// ... the original series on the time scale, we can make a new series that would visually draw attention ...\r\n// ... to the anomalies in the series. We do this by multiplying the flag series by the original series ...\r\n// ... which produces a new series that sits at zero for normal data but jumps up/down to the extreme ...\r\n// ... values where the series has an anomaly\r\n| project TimeGenerated\r\n , Attempt = y\r\n , Anomaly = iif(ShowAnomalies == {TimeView:value}, series_multiply(series_decompose_anomalies_y_ad_flag, y), series_multiply(y, 0))\r\n// If workbooks adds support for anomaly charts, we can just call \"render anomalychart\" on our original ...\r\n// ... data set without having to deal with flags and multiplication.\r\n| render timechart", + "size": 0, + "title": "Sign-in distribution*", + "noDataMessage": "No sign-in attempts found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "B" + }, + "name": "query - 1B" + }, + { + "type": 1, + "content": { + "json": "_\\* Showing **{AuthResultA}** sign-in attempts_" + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "A" + }, + "name": "text - 3A" + }, + { + "type": 1, + "content": { + "json": "_\\* Showing **{AuthResultB}** sign-in attempts_" + }, + "conditionalVisibility": { + "parameterName": "TileView", + "comparison": "isEqualTo", + "value": "B" + }, + "name": "text - 3B" + }, + { + "type": 1, + "content": { + "json": "___" + }, + "name": "text - 4" + }, + { + "type": 1, + "content": { + "json": "## Accounts to check ##" + }, + "name": "text - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Q2: Generate a parent-child stacked grid of account lockout instances\r\n// Find all account lockout events\r\nlet LockoutEvents = materialize(\r\n AADDomainServicesAccountManagement\r\n | where TimeGenerated {TimeRange:value}\r\n | project TimeGenerated\r\n , Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , ResultDescription\r\n | where Event_ID == \"4740\"\r\n | parse ResultDescription with * \"Account That Was Locked Out:\" accountInfo \"Additional Information:\" *\r\n | project TimeGenerated\r\n , AccountName = tolower(extract(\"Account Name:\\t\\t(.+[0-9A-Za-z])\",1,tostring(accountInfo)))\r\n);\r\n// De-duplicate the list of accounts which have been locked out\r\nlet LockedAccounts = materialize(\r\n LockoutEvents\r\n | distinct AccountName\r\n);\r\n// Filter and serialize the list of sign-in attempts to just accounts that have been locked out\r\nlet LockedAccountEvents = materialize(\r\n AADDomainServicesAccountLogon\r\n | where TimeGenerated {TimeRange:value}\r\n | project TimeGenerated\r\n , Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , AccountName = tolower(extract(\"Logon Account:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription)))\r\n , ErrorCode = extract(\"Error Code:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n , ResultDescription\r\n , RecordId\r\n | where Event_ID == \"4776\"\r\n and AccountName in ( LockedAccounts )\r\n and ErrorCode in (\"0xC000006A\" , \"0xC0000234\")\r\n | sort by AccountName, TimeGenerated asc\r\n | serialize id = row_number()\r\n);\r\n// Lookup sign-in attempts that failed with \"Bad Password\" with acount lockout that have matching timestamps ...\r\n// ... and account names. This will return the list of sign-in attempts filtered to just the ones that caused ...\r\n// ... that account to get locked out. Then, return the serial ID for these \"lockout strike events\" \r\nlet LockoutStrikeIDs = materialize(\r\n LockoutEvents\r\n | lookup kind=leftouter LockedAccountEvents on AccountName, TimeGenerated\r\n | project id\r\n);\r\n// Since an account gets locked out when it has 5 sign-in attempts fail with \"Bad Password\" within a period ...\r\n// ... of 2 minutes, we can find all the \"lockout sequences\" by looking up the 4 serialized sign-in attempts ...\r\n// ... preceding each of the \"lockout strike events\". So, return those serial IDs\r\nlet LockoutSequenceIDs = materialize(\r\n LockoutStrikeIDs\r\n | project sequence = range(id - 4, id + 1, 1)\r\n);\r\n// Count how many times each account was locked out\r\nlet LockoutStrikeSummary = materialize(\r\n LockoutEvents\r\n | summarize count() by AccountName\r\n);\r\n// Lookup the serialized sign-in events matching the returned serial IDs\r\nlet LockoutSequenceEvents = materialize(\r\n LockedAccountEvents\r\n | where id in (LockoutSequenceIDs)\r\n | extend SequenceID = case( ErrorCode == \"0xC0000234\", -1\r\n , (id + 0) in (LockoutStrikeIDs), 0\r\n , (id + 1) in (LockoutStrikeIDs), 1\r\n , (id + 2) in (LockoutStrikeIDs), 2\r\n , (id + 3) in (LockoutStrikeIDs), 3\r\n , 4\r\n )\r\n | serialize rn = row_number()\r\n | extend LockoutSequenceTimeStamp = case( ErrorCode == \"0xC0000234\", prev(TimeGenerated)\r\n , SequenceID == 0, TimeGenerated\r\n , SequenceID == 1, next(TimeGenerated, 1)\r\n , SequenceID == 2, next(TimeGenerated, 2)\r\n , SequenceID == 3, next(TimeGenerated, 3)\r\n , next(TimeGenerated, 4)\r\n )\r\n | lookup kind=leftouter LockoutStrikeSummary on AccountName\r\n);\r\n// Format and show the workstation if available\r\nLockoutSequenceEvents\r\n| extend Source_Workstation = extract(\"Source Workstation:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n| sort by count_ desc, AccountName\r\n| project TimeGenerated\r\n , AccountName = strcat(AccountName, \" [\", count_, \" lockouts]\")\r\n , ErrorType = strcat(\"Sign in Attempt:\\t\", iif(ErrorCode == \"0xC000006A\", \"Bad Password\", \"Account Locked Out\"))\r\n , SequenceName = strcat(\"Account Lockout: \", tostring(format_datetime(LockoutSequenceTimeStamp, 'yy-MM-dd, HH:mm:ss')), \" [UTC]\")\r\n , Event_ID\r\n , Workstation = iff(Source_Workstation != \"\", Source_Workstation, \"\")\r\n , DC_ID = extract(\"([0-9A-Za-z]+)\",1,tostring(RecordId))", + "size": 2, + "title": "Account lockouts", + "noDataMessage": "No account lockouts found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "TimeGenerated", + "formatter": 6, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "AccountName", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ErrorType", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SequenceName", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Event_ID", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Workstation", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DC_ID", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "$gen_group", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "AccountName", + "SequenceName" + ], + "expandTopLevel": false, + "finalBy": "ErrorType" + }, + "labelSettings": [ + { + "columnId": "TimeGenerated", + "label": "Time" + }, + { + "columnId": "AccountName", + "label": "Username" + }, + { + "columnId": "ErrorType", + "label": "" + }, + { + "columnId": "SequenceName" + }, + { + "columnId": "Event_ID", + "label": "Event", + "comment": "Event ID in Windows Server 2016 protocol" + }, + { + "columnId": "Workstation", + "label": "", + "comment": "Shows as if not recorded" + }, + { + "columnId": "DC_ID", + "label": "Domain Controller", + "comment": "Which Domain Controller the event was logged on" + } + ] + }, + "tileSettings": { + "showBorder": false + } + }, + "customWidth": "70", + "name": "query - 2", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Q3: Generate a grid of bad usernames and how many sign-in attempts have hit each one\r\nAADDomainServicesAccountLogon\r\n| where TimeGenerated {TimeRange:value}\r\n| project Event_ID = extract(\".+/(.+[0-9])\",1,tostring(OperationName))\r\n , AccountName = tolower(extract(\"Logon Account:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription)))\r\n , ErrorCode = extract(\"Error Code:\\t(.+[0-9A-Za-z])\",1,tostring(ResultDescription))\r\n| where Event_ID == \"4776\"\r\n and ErrorCode == \"0xC0000064\"\r\n| summarize count() by AccountName\r\n| sort by count_ desc\r\n| project AccountName = iif(AccountName != \"\", AccountName, \"\")\r\n , count_", + "size": 2, + "title": "Bad usernames", + "noDataMessage": "No bad usernames found", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "AccountName", + "formatter": 1, + "formatOptions": { + "showIcon": true, + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "adcb0d2c-72ce-4b2a-9f0f-c417208ea01a", + "typeSource": "default", + "gallerySource": "default" + } + } + }, + { + "columnMatch": "count_", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Attempted_Sign_ins", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "labelSettings": [ + { + "columnId": "AccountName", + "label": "Username", + "comment": "Fake usernames with recorded sign-in attempts" + }, + { + "columnId": "count_", + "label": "Sign-in attempts", + "comment": "How many sign-in attempts each bad username has" + } + ] + } + }, + "customWidth": "30", + "name": "query - 3", + "styleSettings": { + "showBorder": true + } + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Active Directory Domain Services/Workbooks/Security Overview Report/aadds-logo.svg b/Azure Active Directory Domain Services/Workbooks/Security Overview Report/aadds-logo.svg new file mode 100644 index 0000000..ddb0955 --- /dev/null +++ b/Azure Active Directory Domain Services/Workbooks/Security Overview Report/aadds-logo.svg @@ -0,0 +1,33 @@ + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Azure Active Directory Domain Services/Workbooks/Security Overview Report/settings.json b/Azure Active Directory Domain Services/Workbooks/Security Overview Report/settings.json new file mode 100644 index 0000000..27d73ef --- /dev/null +++ b/Azure Active Directory Domain Services/Workbooks/Security Overview Report/settings.json @@ -0,0 +1,10 @@ +{ + "name":"Security Overview Report", + "description":"A summary of sign-in attempts and a list of some accounts to check-in on", + "icon":"aadds-logo", + "tags": ["AADDS", "Audit logs"], + "author":"Microsoft", + "galleries": [{ "type":"workbook", "resourceType":"Microsoft.AAD/domainServices", "order": 100 }], + "order": 100, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json" +} \ No newline at end of file diff --git a/Azure Active Directory Domain Services/Workbooks/categoryResources.json b/Azure Active Directory Domain Services/Workbooks/categoryResources.json new file mode 100644 index 0000000..78ee711 --- /dev/null +++ b/Azure Active Directory Domain Services/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Azure Active Directory Domain Services", "description": "Security Audit Logs for Azure AD Domain Services", "order": 100} +} \ No newline at end of file diff --git a/Azure Active Directory TroubleShooting/Alerts/README b/Azure Active Directory TroubleShooting/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Azure Active Directory TroubleShooting/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Azure Active Directory TroubleShooting/Queries/README b/Azure Active Directory TroubleShooting/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Azure Active Directory TroubleShooting/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Azure Active Directory TroubleShooting/Workbooks/ArchivedLogDateRange/ArchivedLogDateRange.workbook b/Azure Active Directory TroubleShooting/Workbooks/ArchivedLogDateRange/ArchivedLogDateRange.workbook new file mode 100644 index 0000000..5eb88ef --- /dev/null +++ b/Azure Active Directory TroubleShooting/Workbooks/ArchivedLogDateRange/ArchivedLogDateRange.workbook @@ -0,0 +1,65 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Azure AD Sign-in and Audit Log Date Ranges" + }, + "name": "Title", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "### Sign-in Date Range" + }, + "name": "text - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs | where TimeGenerated > ago(3653d) | summarize OldestSignInEvent=min(TimeGenerated), NewestSignInEvent=max(TimeGenerated) by Type\r\n\r\n", + "size": 4, + "noDataMessage": "No sign-ins recorded.", + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "50", + "name": "signinlog query", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 1, + "content": { + "json": "### Audit Log Date Range" + }, + "name": "text - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AuditLogs | where TimeGenerated > ago(3653d) | summarize OldestAuditEvent=min(TimeGenerated), NewestAuditEvent=max(TimeGenerated) by Type", + "size": 4, + "noDataMessage": "No changes recorded.", + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "50", + "name": "AuditLog query", + "styleSettings": { + "maxWidth": "50" + } + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Azure Active Directory TroubleShooting/Workbooks/ArchivedLogDateRange/settings.json b/Azure Active Directory TroubleShooting/Workbooks/ArchivedLogDateRange/settings.json new file mode 100644 index 0000000..e56e291 --- /dev/null +++ b/Azure Active Directory TroubleShooting/Workbooks/ArchivedLogDateRange/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Archived Log Date Range", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.aadiam/tenant", "order": 300 }] +} diff --git a/Azure Active Directory TroubleShooting/Workbooks/SignInFailureAnalysis/SignInFailureAnalysis.workbook b/Azure Active Directory TroubleShooting/Workbooks/SignInFailureAnalysis/SignInFailureAnalysis.workbook new file mode 100644 index 0000000..d8b020c --- /dev/null +++ b/Azure Active Directory TroubleShooting/Workbooks/SignInFailureAnalysis/SignInFailureAnalysis.workbook @@ -0,0 +1,590 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Troubleshooting Sign-ins" + }, + "conditionalVisibility": null, + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "13f56671-7604-4427-a4d8-663f3da0cbc5", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 1209600000 + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-11-13T19:33:10.162Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-11-13T19:33:10.165Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-11-13T19:33:10.166Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-11-13T19:33:10.166Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-11-13T19:33:10.166Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-11-13T19:33:10.166Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-11-13T19:33:10.167Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "timeContextFromParameter": null + }, + { + "id": "3b5cc420-8ad8-4523-ba28-a54910756794", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "SigninLogs\r\n| summarize Count = count() by AppDisplayName\r\n| order by Count desc, AppDisplayName asc\r\n| project Value = AppDisplayName, Label = strcat(AppDisplayName, ' - ', Count, ' sign-ins'), Selected = false\r\n", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "limitSelectTo": 20, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "3b5cc420-8ad8-4523-ba28-a54910756794", + "version": "KqlParameterItem/1.0", + "name": "Users", + "type": 2, + "description": "Filter by User Name", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n| summarize Count = count() by UserDisplayName\r\n| order by Count desc, UserDisplayName asc\r\n| project Value = UserDisplayName, Label = strcat(UserDisplayName, ' - ', Count, ' sign-ins'), Selected = false\r\n", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "limitSelectTo": 20, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": null, + "name": "parameters - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n|extend errorCode = Status.errorCode\r\n|extend SigninStatus = case(errorCode == 0, \"Success\", errorCode == 50058, \"Pending action (Interrupts)\",errorCode == 50140, \"Pending action (Interrupts)\", errorCode == 51006, \"Pending action (Interrupts)\", errorCode == 50059, \"Pending action (Interrupts)\",errorCode == 65001, \"Pending action (Interrupts)\", errorCode == 52004, \"Pending action (Interrupts)\", errorCode == 50055, \"Pending action (Interrupts)\", errorCode == 50144, \"Pending action (Interrupts)\", errorCode == 50072, \"Pending action (Interrupts)\", errorCode == 50074, \"Pending action (Interrupts)\", errorCode == 16000, \"Pending action (Interrupts)\", errorCode == 16001, \"Pending action (Interrupts)\", errorCode == 16003, \"Pending action (Interrupts)\", errorCode == 50127, \"Pending action (Interrupts)\", errorCode == 50125, \"Pending action (Interrupts)\", errorCode == 50129, \"Pending action (Interrupts)\", errorCode == 50143, \"Pending action (Interrupts)\", errorCode == 81010, \"Pending action (Interrupts)\", errorCode == 81014, \"Pending action (Interrupts)\", errorCode == 81012 ,\"Pending action (Interrupts)\", \"Failure\");\r\ndata\r\n| summarize Count = count() by SigninStatus\r\n| join kind = fullouter (datatable(SigninStatus:string)['Success', 'Pending action (Interrupts)', 'Failure']) on SigninStatus\r\n| project SigninStatus = iff(SigninStatus == '', SigninStatus1, SigninStatus), Count = iff(SigninStatus == '', 0, Count)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SigninStatus)\r\n on SigninStatus\r\n| project-away SigninStatus1, TimeGenerated\r\n| extend Status = SigninStatus\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend SigninStatus = 'All Sign-ins', Status = '*' \r\n)\r\n| order by Count desc\r\n\r\n\r\n\r\n", + "size": 3, + "exportDefaultValue": "*", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "SigninStatus", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "conditionalVisibility": null, + "name": "query - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs \r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n| extend ErrorCode = tostring(Status.errorCode) \r\n| extend FailureReason = tostring(Status.failureReason) \r\n| where ErrorCode !in (\"0\",\"50058\",\"50148\",\"50140\", \"51006\", \"50059\", \"65001\", \"52004\", \"50055\", \"50144\",\"50072\", \"50074\", \"16000\",\"16001\", \"16003\", \"50127\", \"50125\", \"50129\",\"50143\", \"81010\", \"81014\", \"81012\") \r\n|summarize errCount = count() by ErrorCode, tostring(FailureReason)| sort by errCount\r\n|project ['❌ Error Code'] = ErrorCode, ['Reason']= FailureReason, ['Error Count'] = toint(errCount)", + "size": 1, + "exportFieldName": "❌ Error Code", + "exportParameterName": "ErrorCode", + "exportDefaultValue": "*", + "showAnalytics": true, + "title": "Summary of top errors", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Error Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "customWidth": "67", + "showPin": true, + "name": "query - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs \r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n| extend ErrorCode = tostring(Status.errorCode) \r\n| extend FailureReason = tostring(Status.failureReason) \r\n| where ErrorCode !in (\"0\",\"50058\",\"50148\",\"50140\", \"51006\", \"50059\", \"65001\", \"52004\", \"50055\", \"50144\",\"50072\", \"50074\", \"16000\",\"16001\", \"16003\", \"50127\", \"50125\", \"50129\",\"50143\", \"81010\", \"81014\", \"81012\") \r\n| where '{ErrorCode}' == '*' or '{ErrorCode}' == ErrorCode\r\n| top 200 by TimeGenerated desc\r\n| extend TimeFromNow = now() - TimeGenerated\r\n| extend TimeAgo = strcat(case(TimeFromNow < 2m, strcat(toint(TimeFromNow / 1m), ' seconds'), TimeFromNow < 2h, strcat(toint(TimeFromNow / 1m), ' minutes'), TimeFromNow < 2d, strcat(toint(TimeFromNow / 1h), ' hours'), strcat(toint(TimeFromNow / 1d), ' days')), ' ago')\r\n| project User = UserDisplayName, ['❌ Error Code'] = ErrorCode, ['Sign-in Time'] = TimeAgo, App = AppDisplayName, ['Error code'] = ErrorCode, ['Result type'] = ResultType, ['Result signature'] = ResultSignature, ['Result description'] = ResultDescription, ['Conditional access policies'] = ConditionalAccessPolicies, ['Conditional access status'] = ConditionalAccessStatus, ['Operating system'] = DeviceDetail.operatingSystem, Browser = DeviceDetail.browser, ['Country or region'] = LocationDetails.countryOrRegion, ['State'] = LocationDetails.state, ['City'] = LocationDetails.city, ['Time generated'] = TimeGenerated, Status, ['User principal name'] = UserPrincipalName\r\n\r\n\r\n", + "size": 1, + "showAnalytics": true, + "title": "Sign-ins with errors", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "❌ Error Code", + "formatter": 7, + "formatOptions": { + "linkTarget": "GenericDetails", + "showIcon": true + } + }, + { + "columnMatch": "App", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Error code", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result signature", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result description", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Conditional access policies", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Conditional access status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Operating system", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Browser", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Country or region", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "State", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "City", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Time generated", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "User principal name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "customWidth": "33", + "name": "query - 5 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs \r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n| extend ErrorCode = tostring(Status.errorCode) \r\n| extend FailureReason = Status.failureReason \r\n| where ErrorCode in (\"50058\",\"50140\", \"51006\", \"50059\", \"65001\", \"52004\", \"50055\", \"50144\",\"50072\", \"50074\", \"16000\",\"16001\", \"16003\", \"50127\", \"50125\", \"50129\",\"50143\", \"81010\", \"81014\", \"81012\") \r\n|summarize errCount = count() by ErrorCode, tostring(FailureReason)\r\n| sort by errCount\r\n|project ['❌ Error Code'] = ErrorCode, ['Reason'] = FailureReason, ['Interrupt Count'] = toint(errCount)", + "size": 1, + "exportFieldName": "❌ Error Code", + "exportParameterName": "InterruptErrorCode", + "exportDefaultValue": "*", + "showAnalytics": true, + "title": "Summary of sign-ins waiting on user action", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Interrupt Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange" + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "customWidth": "67", + "showPin": true, + "name": "query - 7" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs \r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n| extend ErrorCode = tostring(Status.errorCode) \r\n| extend FailureReason = Status.failureReason \r\n| where ErrorCode in (\"50058\",\"50140\", \"51006\", \"50059\", \"65001\", \"52004\", \"50055\", \"50144\",\"50072\", \"50074\", \"16000\",\"16001\", \"16003\", \"50127\", \"50125\", \"50129\",\"50143\", \"81010\", \"81014\", \"81012\") \r\n| where '{InterruptErrorCode}' == '*' or '{InterruptErrorCode}' == ErrorCode\r\n| top 200 by TimeGenerated desc\r\n| extend TimeFromNow = now() - TimeGenerated\r\n| extend TimeAgo = strcat(case(TimeFromNow < 2m, strcat(toint(TimeFromNow / 1m), ' seconds'), TimeFromNow < 2h, strcat(toint(TimeFromNow / 1m), ' minutes'), TimeFromNow < 2d, strcat(toint(TimeFromNow / 1h), ' hours'), strcat(toint(TimeFromNow / 1d), ' days')), ' ago')\r\n| project User = UserDisplayName, ['❌ Error Code'] = ErrorCode, ['Sign-in Time'] = TimeAgo, App = AppDisplayName, ['Error code'] = ErrorCode, ['Result type'] = ResultType, ['Result signature'] = ResultSignature, ['Result description'] = ResultDescription, ['Conditional access policies'] = ConditionalAccessPolicies, ['Conditional access status'] = ConditionalAccessStatus, ['Operating system'] = DeviceDetail.operatingSystem, Browser = DeviceDetail.browser, ['Country or region'] = LocationDetails.countryOrRegion, ['State'] = LocationDetails.state, ['City'] = LocationDetails.city, ['Time generated'] = TimeGenerated, Status, ['User principal name'] = UserPrincipalName\r\n\r\n", + "size": 1, + "showAnalytics": true, + "title": "Sign-ins waiting on user action", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "❌ Error Code", + "formatter": 7, + "formatOptions": { + "linkTarget": "GenericDetails", + "showIcon": true + } + }, + { + "columnMatch": "App", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Error code", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result signature", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result description", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Conditional access policies", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Conditional access status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Operating system", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Browser", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Country or region", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "State", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "City", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Time generated", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "User principal name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "customWidth": "33", + "showPin": true, + "name": "query - 7 - Copy" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Active Directory TroubleShooting/Workbooks/SignInFailureAnalysis/settings.json b/Azure Active Directory TroubleShooting/Workbooks/SignInFailureAnalysis/settings.json new file mode 100644 index 0000000..6b433a4 --- /dev/null +++ b/Azure Active Directory TroubleShooting/Workbooks/SignInFailureAnalysis/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Sign-ins Failure Analysis", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.aadiam/tenant", "order": 100 }] +} \ No newline at end of file diff --git a/Azure Active Directory TroubleShooting/Workbooks/categoryResources.json b/Azure Active Directory TroubleShooting/Workbooks/categoryResources.json new file mode 100644 index 0000000..a6d9225 --- /dev/null +++ b/Azure Active Directory TroubleShooting/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Troubleshoot", "description": "Provides insights on Troubleshooting", "order": 200} +} \ No newline at end of file diff --git a/Azure Active Directory/Alerts/README b/Azure Active Directory/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Azure Active Directory/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Azure Active Directory/Queries/README b/Azure Active Directory/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Azure Active Directory/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Azure Active Directory/Workbooks/App Consent Audit/App Consent Audit.workbook b/Azure Active Directory/Workbooks/App Consent Audit/App Consent Audit.workbook new file mode 100644 index 0000000..a6d7b30 --- /dev/null +++ b/Azure Active Directory/Workbooks/App Consent Audit/App Consent Audit.workbook @@ -0,0 +1,486 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## App Consent Audit" + }, + "name": "Title", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "f4d0d58a-e35f-4659-a490-5da142c9a6d2", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "value": { + "durationMs": 2592000000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "6b6b0bb3-667f-4fb8-9911-3b7f115c89ff", + "version": "KqlParameterItem/1.0", + "name": "UserName", + "label": "User Name", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "AuditLogs\r\n| where OperationName contains \"Consent\"\r\n// user name \r\n| extend initby = parse_json(InitiatedBy) | extend userinfo1 = initby.user | extend userinfo2 = parse_json(userinfo1) \r\n| extend username = userinfo2.userPrincipalName\r\n// app name \r\n| extend tr = parse_json(TargetResources) | mvexpand tr | extend appname = tostring(tr.displayName)\r\n| extend mp = tr.modifiedProperties | mvexpand mp\r\n| extend actinfo = mp.displayName\r\n// consent and scope information \r\n| extend value1 = parse_json(mp) | extend val1 = value1.newValue\r\n| where actinfo == \"ConsentAction.Permissions\"\r\n| parse val1 with * \"ResourceId:\" Resourceid1 \", ConsentType: \" ConsentType \", Scope:\" Scope \"]\" * \r\n| extend Scope1 = split(Scope, \" \")\r\n| mvexpand Scope1 \r\n| where Scope1 != \"\"\r\n| project OperationName , username, appname, actinfo, Resourceid1, ConsentType, Scope1, CorrelationId \r\n| project username = tostring(username) \r\n| distinct username\r\n| sort by username", + "crossComponentResources": [], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "c5bb7341-72dd-479b-b001-c58652ac709b", + "version": "KqlParameterItem/1.0", + "name": "AppName1", + "label": "App Name", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "(SigninLogs\r\n| extend corrIDTime = strcat(CorrelationId, TimeGenerated)\r\n| extend ConditionalAccessPolicies = tostring(ConditionalAccessPolicies)\r\n| extend DeviceDetail = tostring(DeviceDetail) \r\n| extend LocationDetails = tostring(LocationDetails) \r\n| extend Status = tostring(Status)\r\n| distinct *\r\n| distinct AppDisplayName)\r\n| union \r\n\r\n(AuditLogs\r\n| where OperationName contains \"Consent\"\r\n// user name \r\n| extend initby = parse_json(InitiatedBy) | extend userinfo1 = initby.user | extend userinfo2 = parse_json(userinfo1) \r\n| extend username = userinfo2.userPrincipalName\r\n// app name \r\n| extend tr = parse_json(TargetResources) | mvexpand tr | extend appname = tostring(tr.displayName)\r\n| extend mp = tr.modifiedProperties | mvexpand mp\r\n| extend actinfo = mp.displayName\r\n// consent and scope information \r\n| extend value1 = parse_json(mp) | extend val1 = value1.newValue\r\n| where actinfo == \"ConsentAction.Permissions\"\r\n| parse val1 with * \"ResourceId:\" Resourceid1 \", ConsentType: \" ConsentType \", Scope:\" Scope \"]\" * \r\n| extend Scope1 = split(Scope, \" \")\r\n| mvexpand Scope1 \r\n| where Scope1 != \"\"\r\n| project AppDisplayName = appname\r\n| distinct AppDisplayName)\r\n| distinct AppDisplayName\r\n\r\n\r\n", + "crossComponentResources": [], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "56de0861-b28c-4408-9c22-6612b1bad38e", + "version": "KqlParameterItem/1.0", + "name": "ScopeName1", + "label": "Scope Name", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "AuditLogs\r\n| where OperationName contains \"Consent\"\r\n// user name \r\n| extend initby = parse_json(InitiatedBy) | extend userinfo1 = initby.user | extend userinfo2 = parse_json(userinfo1) \r\n| extend username = userinfo2.userPrincipalName\r\n// app name \r\n| extend tr = parse_json(TargetResources) | mvexpand tr | extend appname = tostring(tr.displayName)\r\n| extend mp = tr.modifiedProperties | mvexpand mp\r\n| extend actinfo = mp.displayName\r\n// consent and scope information \r\n| extend value1 = parse_json(mp) | extend val1 = value1.newValue\r\n| where actinfo == \"ConsentAction.Permissions\"\r\n| parse val1 with * \"ResourceId:\" Resourceid1 \", ConsentType: \" ConsentType \", Scope:\" Scope \"]\" * \r\n| extend Scope1 = split(Scope, \" \")\r\n| mvexpand Scope1 \r\n| where Scope1 != \"\"\r\n| project Scope = tostring(Scope1)\r\n| distinct Scope\r\n", + "crossComponentResources": [], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "c1dfae76-fa0a-48c4-aa22-2006c098d8a5", + "version": "KqlParameterItem/1.0", + "name": "API_Name1", + "label": "API Name", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "AuditLogs\r\n| where OperationName contains \"Consent\"\r\n// user name \r\n| extend initby = parse_json(InitiatedBy) | extend userinfo1 = initby.user | extend userinfo2 = parse_json(userinfo1) \r\n| extend username = userinfo2.userPrincipalName\r\n// app name \r\n| extend tr = parse_json(TargetResources) | mvexpand tr | extend appname = tostring(tr.displayName)\r\n| extend mp = tr.modifiedProperties | mvexpand mp\r\n| extend actinfo = mp.displayName\r\n// consent and scope information \r\n| extend value1 = parse_json(mp) | extend val1 = value1.newValue\r\n| where actinfo == \"ConsentAction.Permissions\"\r\n| parse val1 with * \"ResourceId:\" Resourceid1 \", ConsentType: \" ConsentType \", Scope:\" Scope \"]\" * \r\n| extend Scope1 = split(Scope, \" \")\r\n| mvexpand Scope1 \r\n| where Scope1 != \"\"\r\n//| project OperationName , username, appname, actinfo, Resourceid1, ConsentType, Scope1, CorrelationId \r\n| join kind = leftouter \r\n(\r\nAuditLogs\r\n| where OperationName contains \"oAuth2\"\r\n| extend tr = parse_json(TargetResources) | mvexpand tr | extend apiname = tostring(tr.displayName)\r\n| where apiname != \"\"\r\n| project OperationName , apiname , CorrelationId\r\n)\r\non $left.CorrelationId == $right.CorrelationId\r\n|distinct apiname\r\n| where apiname !=\"\"\r\n| sort by apiname\r\n", + "crossComponentResources": [], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "07ba0b97-f870-4238-a950-e3bf31fe8a6b", + "version": "KqlParameterItem/1.0", + "name": "Consent_Type1", + "label": "Consent Type", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "AuditLogs\r\n| where OperationName contains \"Consent\"\r\n// user name \r\n| extend initby = parse_json(InitiatedBy) | extend userinfo1 = initby.user | extend userinfo2 = parse_json(userinfo1) \r\n| extend username = userinfo2.userPrincipalName\r\n// app name \r\n| extend tr = parse_json(TargetResources) | mvexpand tr | extend appname = tostring(tr.displayName)\r\n| extend mp = tr.modifiedProperties | mvexpand mp\r\n| extend actinfo = mp.displayName\r\n// consent and scope information \r\n| extend value1 = parse_json(mp) | extend val1 = value1.newValue\r\n| where actinfo == \"ConsentAction.Permissions\"\r\n| parse val1 with * \"ResourceId:\" Resourceid1 \", ConsentType: \" ConsentType \", Scope:\" Scope \"]\" * \r\n| project ConsentType \r\n//| where ConsentType != \"\"\r\n|distinct ConsentType\r\n", + "crossComponentResources": [], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "100", + "name": "parameters - 4", + "styleSettings": { + "margin": "0 0 15px 0" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AuditLogs\r\n| where OperationName contains \"Consent\"\r\n// user name \r\n| extend initby = parse_json(InitiatedBy) | extend userinfo1 = initby.user | extend userinfo2 = parse_json(userinfo1) \r\n| extend username = userinfo2.userPrincipalName\r\n// app name \r\n| extend tr = parse_json(TargetResources) | mvexpand tr | extend appname = tostring(tr.displayName)\r\n| extend mp = tr.modifiedProperties | mvexpand mp\r\n| extend actinfo = mp.displayName\r\n// consent and scope information \r\n| extend value1 = parse_json(mp) | extend val1 = value1.newValue\r\n| where actinfo == \"ConsentAction.Permissions\"\r\n| parse val1 with * \"ResourceId:\" Resourceid1 \", ConsentType: \" ConsentType \", Scope:\" Scope \"]\" * \r\n| extend Scope1 = split(Scope, \" \")\r\n| mvexpand Scope1 \r\n| where Scope1 != \"\"\r\n| project OperationName , username, appname, actinfo, Resourceid1, ConsentType, Scope1, CorrelationId\r\n| where username in ({UserName}) or '*' in ({UserName})\r\n| where ConsentType in ({Consent_Type1}) or '*' in ({Consent_Type1})\r\n| where appname in ({AppName1}) or '*' in ({AppName1})\r\n| where Scope1 in ({ScopeName1}) or '*' in ({ScopeName1})\r\n| join kind = leftouter \r\n(\r\nAuditLogs\r\n| where OperationName contains \"oAuth2\"\r\n| extend tr = parse_json(TargetResources) | mvexpand tr | extend apiname = tostring(tr.displayName)\r\n| where apiname != \"\"\r\n| project OperationName , apiname , CorrelationId\r\n| where apiname in ({API_Name1}) or '*' in ({API_Name1})\r\n)\r\non $left.CorrelationId == $right.CorrelationId\r\n| join kind = leftouter\r\n(\r\nSigninLogs\r\n| summarize distinctUserSignInCount=dcount(UserId), signInCount=count() by AppDisplayName \r\n) \r\non $left.appname == $right.AppDisplayName\r\n//| extend api_scope = strcat(apiname, \" - \", Scope1) \r\n| extend Scope = tostring(Scope1)\r\n//| distinct Scope, appname, distinctUserSignInCount, signInCount, ConsentType \r\n| summarize Appcount=dcount(appname) by Scope\r\n| sort by Appcount desc\r\n", + "size": 1, + "showAnalytics": true, + "title": "Scope by Unique App Consent Requests", + "timeContext": { + "durationMs": 2592000000 + }, + "exportFieldName": "Scope", + "exportParameterName": "Scope_Bar", + "exportDefaultValue": "'*'", + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Scope", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Appcount", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "grayBlue", + "showIcon": true + } + } + ], + "rowLimit": 100, + "labelSettings": [ + { + "columnId": "Scope", + "label": "Scope" + }, + { + "columnId": "Appcount", + "label": "Appcount" + } + ] + } + }, + "customWidth": "50", + "name": "query - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AuditLogs\r\n| where OperationName contains \"Consent\"\r\n// user name \r\n| extend initby = parse_json(InitiatedBy) | extend userinfo1 = initby.user | extend userinfo2 = parse_json(userinfo1) \r\n| extend username = userinfo2.userPrincipalName\r\n// app name \r\n| extend tr = parse_json(TargetResources) | mvexpand tr | extend appname = tostring(tr.displayName)\r\n| extend mp = tr.modifiedProperties | mvexpand mp\r\n| extend actinfo = mp.displayName\r\n// consent and scope information \r\n| extend value1 = parse_json(mp) | extend val1 = value1.newValue\r\n| where actinfo == \"ConsentAction.Permissions\"\r\n| parse val1 with * \"ResourceId:\" Resourceid1 \", ConsentType: \" ConsentType \", Scope:\" Scope \"]\" * \r\n| extend Scope1 = split(Scope, \" \")\r\n| mvexpand Scope1 \r\n| where Scope1 != \"\"\r\n| project OperationName , username, appname, actinfo, Resourceid1, ConsentType, Scope1, CorrelationId \r\n| where username in ({UserName}) or '*' in ({UserName})\r\n| where ConsentType in ({Consent_Type1}) or '*' in ({Consent_Type1})\r\n| where appname in ({AppName1}) or '*' in ({AppName1})\r\n| where Scope1 in ({ScopeName1}) or '*' in ({ScopeName1})\r\n| join kind = leftouter \r\n(\r\nAuditLogs\r\n| where OperationName contains \"oAuth2\"\r\n| extend tr = parse_json(TargetResources) | mvexpand tr | extend apiname = tostring(tr.displayName)\r\n| where apiname != \"\"\r\n| project OperationName , apiname , CorrelationId\r\n| where apiname in ({API_Name1}) or '*' in ({API_Name1})\r\n)\r\non $left.CorrelationId == $right.CorrelationId\r\n| join kind = leftouter\r\n(\r\nSigninLogs\r\n| summarize distinctUserSignInCount=dcount(UserId), signInCount=count() by AppDisplayName \r\n) \r\non $left.appname == $right.AppDisplayName\r\n| extend api_scope = tostring(Scope1), API = tostring(apiname) \r\n| distinct appname, distinctUserSignInCount\r\n", + "size": 1, + "showAnalytics": true, + "title": "Applications by Unique User Sign Ins", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "appname", + "exportParameterName": "appname", + "exportDefaultValue": "*", + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "appname", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "api_scope", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "API", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "distinctUserSignInCount", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "grayBlue", + "showIcon": true + } + }, + { + "columnMatch": "signInCount", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 100, + "labelSettings": [ + { + "columnId": "appname", + "label": "appname" + }, + { + "columnId": "distinctUserSignInCount", + "label": "distinctUserSignInCount" + } + ] + } + }, + "customWidth": "50", + "name": "query - 0 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AuditLogs\r\n| where OperationName contains \"Consent\"\r\n// user name \r\n| extend initby = parse_json(InitiatedBy) | extend userinfo1 = initby.user | extend userinfo2 = parse_json(userinfo1) \r\n| extend username = userinfo2.userPrincipalName\r\n// app name \r\n| extend tr = parse_json(TargetResources) | mvexpand tr | extend appname = tostring(tr.displayName)\r\n| extend mp = tr.modifiedProperties | mvexpand mp\r\n| extend actinfo = mp.displayName\r\n// consent and scope information \r\n| extend value1 = parse_json(mp) | extend val1 = value1.newValue\r\n| where actinfo == \"ConsentAction.Permissions\"\r\n| parse val1 with * \"ResourceId:\" Resourceid1 \", ConsentType: \" ConsentType \", Scope:\" Scope \"]\" * \r\n| extend Scope1 = split(Scope, \" \")\r\n| mvexpand Scope1 \r\n| where Scope1 != \"\"\r\n| project OperationName , username, appname, actinfo, Resourceid1, ConsentType, Scope1, CorrelationId \r\n| where username in ({UserName}) or '*' in ({UserName})\r\n| where ConsentType in ({Consent_Type1}) or '*' in ({Consent_Type1})\r\n| where appname in ({AppName1}) or '*' in ({AppName1})\r\n| where Scope1 in ({ScopeName1}) or '*' in ({ScopeName1})\r\n| join kind = leftouter \r\n(\r\nAuditLogs\r\n| where OperationName contains \"oAuth2\"\r\n| extend tr = parse_json(TargetResources) | mvexpand tr | extend apiname = tostring(tr.displayName)\r\n| where apiname != \"\"\r\n| project OperationName , apiname , CorrelationId\r\n| where apiname in ({API_Name1}) or '*' in ({API_Name1})\r\n)\r\non $left.CorrelationId == $right.CorrelationId\r\n|project UserName = tostring(username), AppName = appname, ConsentType, Scope = tostring(Scope1), API = apiname\r\n|distinct UserName, AppName, ConsentType, Scope, API", + "size": 1, + "showAnalytics": true, + "title": "Users by Application, API, Scope, Sign In Counts", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "rowLimit": 100, + "labelSettings": [ + { + "columnId": "UserName", + "label": "UserName" + }, + { + "columnId": "AppName", + "label": "AppName" + }, + { + "columnId": "ConsentType", + "label": "ConsentType" + }, + { + "columnId": "Scope", + "label": "Scope" + }, + { + "columnId": "API", + "label": "API" + } + ] + } + }, + "name": "query - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "2ecf7153-2928-43d0-8159-ae085e546259", + "version": "KqlParameterItem/1.0", + "name": "UserDisplayName", + "label": "User Display Name", + "type": 2, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let SinginConsentTimes = SigninLogs\r\n| join kind = leftouter\r\n(\r\nSigninLogs\r\n|extend errorCode = Status.errorCode\r\n|where errorCode == 90094 \r\n|distinct CorrelationId \r\n)\r\non $left.CorrelationId == $right.CorrelationId\r\n| summarize maxTime = max(TimeGenerated) by CorrelationId, UserId\r\n| extend corrIDMaxTime = strcat(CorrelationId, maxTime)\r\n| project corrIDMaxTime;\r\nunion\r\nSigninLogs\r\n| extend corrIDTime = strcat(CorrelationId, TimeGenerated)\r\n| where corrIDTime in (SinginConsentTimes)\r\n| extend ConditionalAccessPolicies = tostring(ConditionalAccessPolicies)\r\n| extend DeviceDetail = tostring(DeviceDetail) \r\n| extend LocationDetails = tostring(LocationDetails) \r\n| extend Status = tostring(Status)\r\n| distinct *\r\n| distinct UserDisplayName\r\n| sort by UserDisplayName\r\n\r\n\r\n", + "crossComponentResources": [], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SinginConsentTimes = SigninLogs\r\n| join kind = inner\r\n(\r\nSigninLogs\r\n|extend errorCode = Status.errorCode\r\n|where errorCode == 90094 \r\n|distinct CorrelationId \r\n)\r\non $left.CorrelationId == $right.CorrelationId\r\n| summarize maxTime = max(TimeGenerated) by CorrelationId, UserId\r\n| extend corrIDMaxTime = strcat(CorrelationId, maxTime)\r\n| project corrIDMaxTime;\r\nSigninLogs\r\n| extend corrIDTime = strcat(CorrelationId, TimeGenerated)\r\n| where corrIDTime in (SinginConsentTimes)\r\n| project AppDisplayName, UserId, CorrelationId, ResultType, UserDisplayName\r\n| where AppDisplayName in ({AppName1}) or '*' in ({AppName1})\r\n| where UserDisplayName in ({UserDisplayName}) or '*' in ({UserDisplayName})\r\n//| summarize cnt = count() by ResultType\r\n//| extend SigninStatus = case(ResultType == 0, \"Success\", \"Failure\")\r\n//| summarize cnt = count() by AppDisplayName, SigninStatus\r\n| summarize TotalFlows = count(), TotalUsers = dcount(UserId) by AppDisplayName\r\n", + "size": 0, + "showAnalytics": true, + "title": "Count of access attempts where user needs admin consent for access", + "noDataMessage": "There were no access attempts in the time range", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "AppDisplayName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TotalFlows", + "formatter": 3, + "formatOptions": { + "palette": "grayBlue", + "showIcon": true + } + } + ], + "labelSettings": [ + { + "columnId": "AppDisplayName", + "label": "AppDisplayName" + }, + { + "columnId": "TotalFlows", + "label": "TotalFlows" + } + ] + } + }, + "name": "query - 11" + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Active Directory/Workbooks/App Consent Audit/settings.json b/Azure Active Directory/Workbooks/App Consent Audit/settings.json new file mode 100644 index 0000000..4a7ed13 --- /dev/null +++ b/Azure Active Directory/Workbooks/App Consent Audit/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"App Consent Audit", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.aadiam/tenant", "order": 300 }] +} \ No newline at end of file diff --git a/Azure Active Directory/Workbooks/EntitlementManagementAccessPackageActivity/EntitlementManagementAccessPackageActivity.workbook b/Azure Active Directory/Workbooks/EntitlementManagementAccessPackageActivity/EntitlementManagementAccessPackageActivity.workbook new file mode 100644 index 0000000..588b652 --- /dev/null +++ b/Azure Active Directory/Workbooks/EntitlementManagementAccessPackageActivity/EntitlementManagementAccessPackageActivity.workbook @@ -0,0 +1,68 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Entitlement Management Access Package Activity" + }, + "name": "text - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "b0ccd080-3619-416b-8079-b8691b23a3d5", + "version": "KqlParameterItem/1.0", + "name": "Since", + "label": "Activity since last", + "type": 2, + "description": "Include audit events since a particular date", + "isRequired": true, + "value": "3653d", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[ {\"value\":\"1d\",\"label\":\"24 hours\"}, {\"value\":\"7d\",\"label\":\"7 days\"}, {\"value\":\"30d\",\"label\":\"30 days\"}, {\"value\":\"90d\",\"label\":\"90 days\"}, { \"value\":\"3653d\", \"label\":\"all\" }]\r\n" + }, + { + "id": "700e461e-68e1-457c-b269-9772078f0458", + "version": "KqlParameterItem/1.0", + "name": "AccessPackageId", + "label": "Access package", + "type": 2, + "description": "Show entitlement management audit events for the specified access package", + "isRequired": true, + "query": "AuditLogs | where TimeGenerated > ago({Since:value}) and Category == \"EntitlementManagement\" and Result == \"success\" | project TargetResources | mvexpand TargetResources | extend AccessPackageId=tostring(TargetResources.id), TTYPE=TargetResources.type, TD=strcat(tostring(TargetResources.displayName),\" \",TargetResources.id) | where TTYPE == \"AccessPackage\" | project TD,AccessPackageId | distinct AccessPackageId,TD | sort by TD asc", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AuditLogs | where TimeGenerated > ago({Since:value}) and Category == \"EntitlementManagement\" and Result == \"success\" \r\n| project TargetResources, Time=TimeGenerated, InitiatedBy, OperationName, InitiatedByDisplayName=Identity, AdditionalDetails\r\n| mvexpand TargetResources | extend AccessPackageId=TargetResources.id, TTYPE=TargetResources.type,InitiatedById=InitiatedBy.user.id,InitiatedByUPN = InitiatedBy.user.userPrincipalName | where TTYPE == \"AccessPackage\" and AccessPackageId == \"{AccessPackageId:value}\" | order by Time desc | project Time,AccessPackageId,OperationName,InitiatedById,InitiatedByUPN,InitiatedByDisplayName,AdditionalDetails\r\n", + "size": 0, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "query - 1" + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Azure Active Directory/Workbooks/EntitlementManagementAccessPackageActivity/settings.json b/Azure Active Directory/Workbooks/EntitlementManagementAccessPackageActivity/settings.json new file mode 100644 index 0000000..9e7b752 --- /dev/null +++ b/Azure Active Directory/Workbooks/EntitlementManagementAccessPackageActivity/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Access Package Activity", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.aadiam/tenant", "order": 300 }] +} diff --git a/Azure Active Directory/Workbooks/SSPR Reset Funnel/SSPR Reset Funnel.workbook b/Azure Active Directory/Workbooks/SSPR Reset Funnel/SSPR Reset Funnel.workbook new file mode 100644 index 0000000..eddcdbc --- /dev/null +++ b/Azure Active Directory/Workbooks/SSPR Reset Funnel/SSPR Reset Funnel.workbook @@ -0,0 +1,745 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Self-service Password Reset Funnel and Troubleshooting" + }, + "name": "Title", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "51539750-6bc8-4a60-a05d-cdf9d40f7a5d", + "version": "KqlParameterItem/1.0", + "name": "Date", + "type": 4, + "description": "Select the date range", + "isRequired": true, + "value": { + "durationMs": 2592000000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "03bb225a-19e0-4fb2-b38e-c79ea6c928e2", + "version": "KqlParameterItem/1.0", + "name": "Users", + "label": "User Name", + "type": 1, + "description": "Enter the UPN (xxxx@domain.com) to filter the reset info for a specific user. Default value is \"All\"", + "isRequired": true, + "query": "print \"All\"", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Date", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = AuditLogs\r\n|where LoggedByService contains \"password\" \r\n|where ActivityDisplayName contains \"Self-service password reset flow activity progress\" or ActivityDisplayName contains \"Blocked from self-service password reset\" or ActivityDisplayName contains \"Unlock a user account (self-service)\"\r\n|extend User = TargetResources[0].userPrincipalName\r\n| where \"{Users:escape}\" == \"All\" or User contains \"{Users:escape}\"\r\n|project TimeGenerated, User, ActivityDisplayName, ResultReason\r\n|extend ResetStatus = case(ActivityDisplayName contains \"Unlock a user account (self-service)\", \"Unlock account\",ActivityDisplayName contains \"Reset password (self-service)\", \"Success\",\r\nResultReason contains \"User successfully reset password\", \"Success\",\r\nResultReason contains \"User successfully unlocked the account\", \"Success\",\r\nResultReason contains \"User cancelled before passing the required authentication methods\", \"Cancelled\",\r\nResultReason contains \"User cancelled before submitting a new password\", \"Cancelled\",\r\nResultReason contains \"We encountered a problem while resetting the user's on-premises password. Check your sync machine's event log\", \"Failed\", \r\nResultReason contains \"We could not reach your on-premises password reset service. Check your sync machine's event log\", \"Failed\",\r\nResultReason contains \"We encountered a problem while resetting the user's on-premises password. Check your sync machine's event log\", \"Failed\",\r\nResultReason contains \"We could not reach your on-premises password reset service. Check your sync machine's event log\", \"Failed\", \r\nResultReason contains \"User's password is managed on-premises. You can enable Password Writeback to resolve this\", \"Failed\", \r\nResultReason contains \"User does not have a license. You can add a license to the user to resolve this\", \"Failed\",\r\nResultReason contains \"Password reset is not enabled for this user. Enable password reset under the configure tab to resolve this\", \"Failed\",\r\nResultReason contains \"User's account has insufficient authentication methods defined. Add authentication info to resolve this\", \"Failed\",\r\nResultReason contains \"Password reset has been disabled entirely for this tenant. See http://aka.ms/ssprtroubleshoot to resolve this.\", \"Failed\",\r\nResultReason contains \"This user is not a member of the password reset users group. Add this user to that group to resolve this.\", \"Failed\",\r\nResultReason contains \"User tried to reset from a device without cookies enabled\", \"Failed\",\r\nResultReason contains \"User submitted a password that did not meet the requirements of the AD on-prem policy\", \"Failed\",\r\nResultReason contains \"The user selected a password that was automatically banned because the Microsoft Banned Password Detection capabilities found it to be too common or especially weak.\",\"Failed\",\r\nResultReason contains \"A system error occurred while attempting to reset the user's password\", \"Failed\",\r\nResultReason contains \"User submitted a password that did not meet the security requirements of the cloud password policy: password was null or empty\",\"Failed\",\r\nResultReason contains \"User entered too many invalid SMS verification codes and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User entered too many invalid email verification codes and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried mobile phone voice verification too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried office phone voice verification too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried to answer security questions too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried to verify a phone number too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried email verification too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User submitted their user ID\", \"Initiated reset\",\r\nResultReason contains \"User submitted a new password\", \"Submitted Password\",\r\nResultReason contains \"User contacted an admin after trying the security question verification option\", \"Contacted Admin\",\r\nResultReason contains \"User contacted an admin\",\"Contacted Admin\",\r\nResultReason contains \"User contacted an admin\", \"Contacted Admin\",\r\nResultReason contains \"User contacted an admin\", \"Contacted Admin\",\r\nActivityDisplayName contains \"Blocked from self-service password reset\", \"Blocked\",\r\nResultReason contains \"User completed all verification steps required to reset their password\", \"All gates verified\",\r\nResultReason contains \"User completed the email verification option\", \"Email gate verified\", \r\nResultReason contains \"User started the email verification option\", \"Email gate started\", \r\nResultReason contains \"User completed the mobile SMS verification option\", \"SMS gate verified\",\r\nResultReason contains \"User started the mobile SMS verification option\", \"SMS gate started\",\r\nResultReason contains \"User completed the mobile voice call verification option\", \"Mobile call gate verified\",\r\nResultReason contains \"User started the mobile voice call verification option\", \"Mobile call gate started\",ResultReason contains \"User completed the mobile app\", \"Mobile app gate verified\",\r\nResultReason contains \"User started the mobile app\", \"Mobile app notification gate started\",\r\nResultReason contains \"User completed the security questions verification option\", \"Security questions gate verified\",\r\nResultReason contains \"User started the security questions verification option\", \"Security questions gate started\",\r\nResultReason contains \"User was presented with verification options\", \"Started Gate verification\",\r\n\"Other\")\r\n|extend Stage = case(ResetStatus contains \" verified\", \"Inprogress\",\r\nResultReason contains \"User submitted their user ID\", \"Inprogress\",\r\nResetStatus contains \"Initiated\", \"Inprogress\",\r\nResetStatus contains \"started Gate\", \"Inprogress\",\r\nResetStatus contains \"Gate started\", \"Inprogress\",\r\nResetStatus contains \"contacted admin\", \"Inprogress\",\r\nResetStatus contains \"submitted password\", \"Inprogress\",\r\nResetStatus);\r\ndata\r\n| summarize Count = count() by Stage\r\n| project Stage, Count = iff(Stage == '', 0, Count)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {Date:start} to {Date:end} step {Date:grain} by Stage)\r\n on Stage\r\n| project-away TimeGenerated\r\n| order by Count desc", + "size": 3, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Date", + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Stage", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "turquoise", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "palette": "grayBlue", + "showIcon": true + } + }, + "showBorder": false + }, + "graphSettings": { + "type": 0 + } + }, + "name": "query - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data =AuditLogs\r\n|where LoggedByService contains \"password\" \r\n|where ActivityDisplayName contains \"Self-service password reset flow activity progress\" or ActivityDisplayName contains \"Blocked from self-service password reset\" or ActivityDisplayName contains \"Unlock a user account (self-service)\"\r\n|extend User = TargetResources[0].userPrincipalName\r\n| where \"{Users:escape}\" == \"All\" or User contains \"{Users:escape}\"\r\n|project TimeGenerated, User, ActivityDisplayName, ResultReason\r\n|extend ResetStatus = case(ActivityDisplayName contains \"Unlock a user account (self-service)\", \"Unlock account\",ActivityDisplayName contains \"Reset password (self-service)\", \"Success\",\r\nResultReason contains \"User successfully reset password\", \"Success\",\r\nResultReason contains \"User successfully unlocked the account\", \"Success\",\r\nResultReason contains \"User cancelled before passing the required authentication methods\", \"Cancelled\",\r\nResultReason contains \"User cancelled before submitting a new password\", \"Cancelled\",\r\nResultReason contains \"We encountered a problem while resetting the user's on-premises password. Check your sync machine's event log\", \"Failed\", \r\nResultReason contains \"We could not reach your on-premises password reset service. Check your sync machine's event log\", \"Failed\",\r\nResultReason contains \"We encountered a problem while resetting the user's on-premises password. Check your sync machine's event log\", \"Failed\",\r\nResultReason contains \"We could not reach your on-premises password reset service. Check your sync machine's event log\", \"Failed\", \r\nResultReason contains \"User's password is managed on-premises. You can enable Password Writeback to resolve this\", \"Failed\", \r\nResultReason contains \"User does not have a license. You can add a license to the user to resolve this\", \"Failed\",\r\nResultReason contains \"Password reset is not enabled for this user. Enable password reset under the configure tab to resolve this\", \"Failed\",\r\nResultReason contains \"User's account has insufficient authentication methods defined. Add authentication info to resolve this\", \"Failed\",\r\nResultReason contains \"Password reset has been disabled entirely for this tenant. See http://aka.ms/ssprtroubleshoot to resolve this.\", \"Failed\",\r\nResultReason contains \"This user is not a member of the password reset users group. Add this user to that group to resolve this.\", \"Failed\",\r\nResultReason contains \"User tried to reset from a device without cookies enabled\", \"Failed\",\r\nResultReason contains \"User submitted a password that did not meet the requirements of the AD on-prem policy\", \"Failed\",\r\nResultReason contains \"The user selected a password that was automatically banned because the Microsoft Banned Password Detection capabilities found it to be too common or especially weak.\",\"Failed\",\r\nResultReason contains \"A system error occurred while attempting to reset the user's password\", \"Failed\",\r\nResultReason contains \"User submitted a password that did not meet the security requirements of the cloud password policy: password was null or empty\",\"Failed\",\r\nResultReason contains \"User entered too many invalid SMS verification codes and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User entered too many invalid email verification codes and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried mobile phone voice verification too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried office phone voice verification too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried to answer security questions too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried to verify a phone number too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried email verification too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User submitted their user ID\", \"Initiated reset\",\r\nResultReason contains \"User submitted a new password\", \"Submitted Password\",\r\nResultReason contains \"User contacted an admin after trying the security question verification option\", \"Contacted Admin\",\r\nResultReason contains \"User contacted an admin\",\"Contacted Admin\",\r\nResultReason contains \"User contacted an admin\", \"Contacted Admin\",\r\nResultReason contains \"User contacted an admin\", \"Contacted Admin\",\r\nActivityDisplayName contains \"Blocked from self-service password reset\", \"Blocked\",\r\nResultReason contains \"User completed all verification steps required to reset their password\", \"All gates verified\",\r\nResultReason contains \"User completed the email verification option\", \"Email gate verified\", \r\nResultReason contains \"User started the email verification option\", \"Email gate started\", \r\nResultReason contains \"User completed the mobile SMS verification option\", \"SMS gate verified\",\r\nResultReason contains \"User started the mobile SMS verification option\", \"SMS gate started\",\r\nResultReason contains \"User completed the mobile voice call verification option\", \"Mobile call gate verified\",\r\nResultReason contains \"User started the mobile voice call verification option\", \"Mobile call gate started\",ResultReason contains \"User completed the mobile app\", \"Mobile app gate verified\",\r\nResultReason contains \"User started the mobile app\", \"Mobile app notification gate started\",\r\nResultReason contains \"User completed the security questions verification option\", \"Security questions gate verified\",\r\nResultReason contains \"User started the security questions verification option\", \"Security questions gate started\",\r\nResultReason contains \"User was presented with verification options\", \"Started Gate verification\",\r\n\"Other\")\r\n|extend Stage = case(ResetStatus contains \" verified\", \"Inprogress (Gate Verification)\",\r\nResultReason contains \"User submitted their user ID\", \"Inprogress (Initiated Reset)\",\r\nResetStatus contains \"Initiated\", \"Inprogress (Initiated Reset)\",\r\nResetStatus contains \"started Gate\", \"Inprogress (Gate Verification)\",\r\nResetStatus contains \"Gate started\", \"Inprogress (Gate Verification)\",\r\nResetStatus contains \"contacted admin\", \"Inprogress (Gate Verification)\",\r\nResetStatus contains \"submitted password\", \"Inprogress (Submit password)\",\r\nResetStatus)\r\n|project TimeGenerated, Stage, ResetStatus;\r\nlet caData = data\r\n|summarize Count = count() by Stage\r\n| order by Count desc\r\n| project Stage, Count\r\n| extend Id = Stage;\r\ndata\r\n|summarize ResetDate = min(TimeGenerated), Count = count() by Stage, ResetStatus\r\n| order by ResetDate asc\r\n| project ResetDate, Stage, ResetStatus, Count\r\n| serialize Id = strcat(Stage, '/', ResetStatus)\r\n| join kind=inner\r\n(\r\n caData\r\n)\r\non Stage\r\n| project Id, Name = ResetStatus, Type ='Action', ['Reset Flow Count'] = Count, ParentId = Id1, Stage, ResetDate\r\n| union \r\n(\r\ncaData\r\n| project Id,Name = Stage, Type ='Action', ['Reset Flow Count'] = Count, ParentId = '')\r\n|order by ['Reset Flow Count'] desc, ResetDate asc\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n", + "size": 3, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Date", + "exportFieldName": "", + "exportParameterName": "StageInfo", + "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\"}", + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 20, + "formatOptions": { + "palette": "turquoise", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "ParentId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Stage", + "formatter": 5, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "ResetDate", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ResetStatus", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 50, + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "ParentId", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": false + }, + "labelSettings": [ + { + "columnId": "Id", + "label": "Id" + }, + { + "columnId": "Name", + "label": "Name" + }, + { + "columnId": "Type", + "label": "Type" + }, + { + "columnId": "Reset Flow Count", + "label": "Reset Flow Count" + }, + { + "columnId": "ParentId", + "label": "ParentId" + }, + { + "columnId": "Stage", + "label": "Stage" + }, + { + "columnId": "ResetDate", + "label": "ResetDate" + } + ] + }, + "tileSettings": { + "titleContent": { + "columnMatch": "ResetStatus", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "Stage", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": true, + "minimumIntegerDigits": 1, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false + } + }, + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let details = dynamic({StageInfo});\r\nAuditLogs\r\n|where LoggedByService contains \"password\" \r\n|where ActivityDisplayName contains \"Self-service password reset flow activity progress\" or ActivityDisplayName contains \"Blocked from self-service password reset\" or ActivityDisplayName contains \"Unlock a user account (self-service)\"\r\n|extend User = tostring(TargetResources[0].userPrincipalName)\r\n| where \"{Users:escape}\" == \"All\" or User contains \"{Users:escape}\"\r\n|project TimeGenerated, User, ActivityDisplayName, ResultReason\r\n|extend ResetStatus = case(ActivityDisplayName contains \"Unlock a user account (self-service)\", \"Unlock account\",ActivityDisplayName contains \"Reset password (self-service)\", \"Success\",\r\nResultReason contains \"User successfully reset password\", \"Success\",\r\nResultReason contains \"User successfully unlocked the account\", \"Success\",\r\nResultReason contains \"User cancelled before passing the required authentication methods\", \"Cancelled\",\r\nResultReason contains \"User cancelled before submitting a new password\", \"Cancelled\",\r\nResultReason contains \"We encountered a problem while resetting the user's on-premises password. Check your sync machine's event log\", \"Failed\", \r\nResultReason contains \"We could not reach your on-premises password reset service. Check your sync machine's event log\", \"Failed\",\r\nResultReason contains \"We encountered a problem while resetting the user's on-premises password. Check your sync machine's event log\", \"Failed\",\r\nResultReason contains \"We could not reach your on-premises password reset service. Check your sync machine's event log\", \"Failed\", \r\nResultReason contains \"User's password is managed on-premises. You can enable Password Writeback to resolve this\", \"Failed\", \r\nResultReason contains \"User does not have a license. You can add a license to the user to resolve this\", \"Failed\",\r\nResultReason contains \"Password reset is not enabled for this user. Enable password reset under the configure tab to resolve this\", \"Failed\",\r\nResultReason contains \"User's account has insufficient authentication methods defined. Add authentication info to resolve this\", \"Failed\",\r\nResultReason contains \"Password reset has been disabled entirely for this tenant. See http://aka.ms/ssprtroubleshoot to resolve this.\", \"Failed\",\r\nResultReason contains \"This user is not a member of the password reset users group. Add this user to that group to resolve this.\", \"Failed\",\r\nResultReason contains \"User tried to reset from a device without cookies enabled\", \"Failed\",\r\nResultReason contains \"User submitted a password that did not meet the requirements of the AD on-prem policy\", \"Failed\",\r\nResultReason contains \"The user selected a password that was automatically banned because the Microsoft Banned Password Detection capabilities found it to be too common or especially weak.\",\"Failed\",\r\nResultReason contains \"A system error occurred while attempting to reset the user's password\", \"Failed\",\r\nResultReason contains \"User submitted a password that did not meet the security requirements of the cloud password policy: password was null or empty\",\"Failed\",\r\nResultReason contains \"User entered too many invalid SMS verification codes and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User entered too many invalid email verification codes and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried mobile phone voice verification too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried office phone voice verification too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried to answer security questions too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried to verify a phone number too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried email verification too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User submitted their user ID\", \"Initiated reset\",\r\nResultReason contains \"User submitted a new password\", \"Submitted Password\",\r\nResultReason contains \"User contacted an admin after trying the security question verification option\", \"Contacted Admin\",\r\nResultReason contains \"User contacted an admin\",\"Contacted Admin\",\r\nResultReason contains \"User contacted an admin\", \"Contacted Admin\",\r\nResultReason contains \"User contacted an admin\", \"Contacted Admin\",\r\nActivityDisplayName contains \"Blocked from self-service password reset\", \"Blocked\",\r\nResultReason contains \"User completed all verification steps required to reset their password\", \"All gates verified\",\r\nResultReason contains \"User completed the email verification option\", \"Email gate verified\", \r\nResultReason contains \"User started the email verification option\", \"Email gate started\", \r\nResultReason contains \"User completed the mobile SMS verification option\", \"SMS gate verified\",\r\nResultReason contains \"User started the mobile SMS verification option\", \"SMS gate started\",\r\nResultReason contains \"User completed the mobile voice call verification option\", \"Mobile call gate verified\",\r\nResultReason contains \"User started the mobile voice call verification option\", \"Mobile call gate started\",ResultReason contains \"User completed the mobile app\", \"Mobile app gate verified\",\r\nResultReason contains \"User started the mobile app\", \"Mobile app notification gate started\",\r\nResultReason contains \"User completed the security questions verification option\", \"Security questions gate verified\",\r\nResultReason contains \"User started the security questions verification option\", \"Security questions gate started\",\r\nResultReason contains \"User was presented with verification options\", \"Started Gate verification\",\r\n\"Other\")\r\n|extend Stage = case(ResetStatus contains \" verified\", \"Inprogress (Gate Verification)\",\r\nResultReason contains \"User submitted their user ID\", \"Inprogress (Initiated Reset)\",\r\nResetStatus contains \"Initiated\", \"Inprogress (Initiated Reset)\",\r\nResetStatus contains \"started Gate\", \"Inprogress (Gate Verification)\",\r\nResetStatus contains \"Gate started\", \"Inprogress (Gate Verification)\",\r\nResetStatus contains \"contacted admin\", \"Inprogress (Gate Verification)\",\r\nResetStatus contains \"submitted password\", \"Inprogress (Submit password)\",\r\nResetStatus)\r\n| where details.Type == '*' or (details.Type == 'Action' and Stage == details.Name) or (details.Type == 'Action' and Stage == details.ParentId and ResetStatus == details.Name)\r\n|summarize TotalCount = count(), SuccessCount = countif(ResetStatus == \"Success\"), FailureCount = countif(ResetStatus == \"Failed\"), CancelledCount = countif(ResetStatus == \"Cancelled\"),ThrottledCount = countif(ResetStatus == \"Throttled\"), BlockedCount = countif(ResetStatus == \"Blocked\"),InProgressCount = countif(Stage contains \"Inprogress\") by User\r\n| order by TotalCount desc, User asc\r\n| extend Id = User\r\n| project Id, Name = User, Type = 'User', ['Inprogress'] = InProgressCount,['Success'] = SuccessCount,['Failed'] = FailureCount, ['Cancelled'] = CancelledCount,['Blocked'] = BlockedCount,['Throttled'] = ThrottledCount\r\n| order by Name asc\r\n\r\n", + "size": 3, + "title": "User List & Reset Status Count", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Date", + "exportFieldName": "Name", + "exportParameterName": "UserName", + "exportDefaultValue": "*", + "exportToExcelOptions": "all", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Inprogress", + "formatter": 4, + "formatOptions": { + "palette": "yellow", + "showIcon": true + } + }, + { + "columnMatch": "Success", + "formatter": 4, + "formatOptions": { + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Failed", + "formatter": 4, + "formatOptions": { + "palette": "redBright", + "showIcon": true + } + }, + { + "columnMatch": "Cancelled", + "formatter": 4, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Blocked", + "formatter": 4, + "formatOptions": { + "palette": "redBright", + "showIcon": true + } + }, + { + "columnMatch": "Throttled", + "formatter": 4, + "formatOptions": { + "palette": "redBright", + "showIcon": true + } + }, + { + "columnMatch": "Reset Flow Count", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 50, + "filter": true, + "labelSettings": [ + { + "columnId": "Id", + "label": "Id" + }, + { + "columnId": "Name", + "label": "Name" + }, + { + "columnId": "Type", + "label": "Type" + }, + { + "columnId": "Inprogress", + "label": "Inprogress" + }, + { + "columnId": "Success", + "label": "Success" + }, + { + "columnId": "Failed", + "label": "Failed" + }, + { + "columnId": "Cancelled", + "label": "Cancelled" + }, + { + "columnId": "Blocked", + "label": "Blocked" + }, + { + "columnId": "Throttled", + "label": "Throttled" + } + ] + } + }, + "name": "query - 5", + "styleSettings": { + "progressStyle": "squares" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "//let details = dynamic({StageInfo});\r\nlet data = AuditLogs\r\n|where LoggedByService contains \"password\" \r\n|where ActivityDisplayName contains \"Self-service password reset flow activity progress\" or ActivityDisplayName contains \"Blocked from self-service password reset\" or ActivityDisplayName contains \"Unlock a user account (self-service)\"\r\n|extend User = tostring(TargetResources[0].userPrincipalName)\r\n//|where User in ({Users}) or '*' in ({Users})\r\n| where \"{Users:escape}\" == \"All\" or User contains \"{Users:escape}\"\r\n| where '{UserName}' == User\r\n|extend IPAddress = tostring(InitiatedBy.user.ipAddress)\r\n|extend UserId = tostring(InitiatedBy.user.id)\r\n|extend ResetStatus = case(ActivityDisplayName contains \"Unlock a user account (self-service)\", \"Unlock account\",ActivityDisplayName contains \"Reset password (self-service)\", \"Success\",\r\nResultReason contains \"User successfully reset password\", \"Success\",\r\nResultReason contains \"User successfully unlocked the account\", \"Success\",\r\nResultReason contains \"User cancelled before passing the required authentication methods\", \"Cancelled\",\r\nResultReason contains \"User cancelled before submitting a new password\", \"Cancelled\",\r\nResultReason contains \"We encountered a problem while resetting the user's on-premises password. Check your sync machine's event log\", \"Failed\", \r\nResultReason contains \"We could not reach your on-premises password reset service. Check your sync machine's event log\", \"Failed\",\r\nResultReason contains \"We encountered a problem while resetting the user's on-premises password. Check your sync machine's event log\", \"Failed\",\r\nResultReason contains \"We could not reach your on-premises password reset service. Check your sync machine's event log\", \"Failed\", \r\nResultReason contains \"User's password is managed on-premises. You can enable Password Writeback to resolve this\", \"Failed\", \r\nResultReason contains \"User does not have a license. You can add a license to the user to resolve this\", \"Failed\",\r\nResultReason contains \"Password reset is not enabled for this user. Enable password reset under the configure tab to resolve this\", \"Failed\",\r\nResultReason contains \"User's account has insufficient authentication methods defined. Add authentication info to resolve this\", \"Failed\",\r\nResultReason contains \"Password reset has been disabled entirely for this tenant. See http://aka.ms/ssprtroubleshoot to resolve this.\", \"Failed\",\r\nResultReason contains \"This user is not a member of the password reset users group. Add this user to that group to resolve this.\", \"Failed\",\r\nResultReason contains \"User tried to reset from a device without cookies enabled\", \"Failed\",\r\nResultReason contains \"User submitted a password that did not meet the requirements of the AD on-prem policy\", \"Failed\",\r\nResultReason contains \"The user selected a password that was automatically banned because the Microsoft Banned Password Detection capabilities found it to be too common or especially weak.\",\"Failed\",\r\nResultReason contains \"A system error occurred while attempting to reset the user's password\", \"Failed\",\r\nResultReason contains \"User submitted a password that did not meet the security requirements of the cloud password policy: password was null or empty\",\"Failed\",\r\nResultReason contains \"User entered too many invalid SMS verification codes and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User entered too many invalid email verification codes and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried mobile phone voice verification too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried office phone voice verification too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried to answer security questions too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried to verify a phone number too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User tried email verification too many times and is blocked for 24 hours\", \"Throttled\",\r\nResultReason contains \"User submitted their user ID\", \"Initiated reset\",\r\nResultReason contains \"User submitted a new password\", \"Submitted Password\",\r\nResultReason contains \"User contacted an admin after trying the security question verification option\", \"Contacted Admin\",\r\nResultReason contains \"User contacted an admin\",\"Contacted Admin\",\r\nResultReason contains \"User contacted an admin\", \"Contacted Admin\",\r\nResultReason contains \"User contacted an admin\", \"Contacted Admin\",\r\nActivityDisplayName contains \"Blocked from self-service password reset\", \"Blocked\",\r\nResultReason contains \"User completed all verification steps required to reset their password\", \"All gates verified\",\r\nResultReason contains \"User completed the email verification option\", \"Email gate verified\", \r\nResultReason contains \"User started the email verification option\", \"Email gate started\", \r\nResultReason contains \"User completed the mobile SMS verification option\", \"SMS gate verified\",\r\nResultReason contains \"User started the mobile SMS verification option\", \"SMS gate started\",\r\nResultReason contains \"User completed the mobile voice call verification option\", \"Mobile call gate verified\",\r\nResultReason contains \"User started the mobile voice call verification option\", \"Mobile call gate started\",ResultReason contains \"User completed the mobile app\", \"Mobile app gate verified\",\r\nResultReason contains \"User started the mobile app\", \"Mobile app notification gate started\",\r\nResultReason contains \"User completed the security questions verification option\", \"Security questions gate verified\",\r\nResultReason contains \"User started the security questions verification option\", \"Security questions gate started\",\r\nResultReason contains \"User was presented with verification options\", \"Started Gate verification\",\r\n\"Other\")\r\n|extend Stage = case(ResetStatus contains \" verified\", \"Inprogress (Gate Verification)\",\r\nResultReason contains \"User submitted their user ID\", \"Inprogress (Initiated Reset)\",\r\nResetStatus contains \"Initiated\", \"Inprogress (Initiated Reset)\",\r\nResetStatus contains \"started Gate\", \"Inprogress (Gate Verification)\",\r\nResetStatus contains \"Gate started\", \"Inprogress (Gate Verification)\",\r\nResetStatus contains \"contacted admin\", \"Inprogress (Gate Verification)\",\r\nResetStatus contains \"submitted password\", \"Inprogress (Submit password)\",\r\nResetStatus)\r\n//| where details.Type == '*' or (details.Type == 'Action' and Stage == details.Name) or (details.Type == 'Action' and Stage == details.ParentId and ResetStatus == details.Name)\r\n|project TimeGenerated, CorrelationId, User, UserId, IPAddress, Stage, ResetStatus,ResultReason, Result\r\n|order by TimeGenerated asc;\r\nlet caData = data\r\n|summarize TotalCount = count() by User\r\n| order by TotalCount desc, User asc\r\n| project User, TotalCount\r\n| extend Id = User;\r\ndata\r\n//| where details.Type == '*' or (details.Type == 'Action' and Stage == details.Name) or (details.Type == 'Action' and Stage == details.ParentId and ResetStatus == details.Name)\r\n|summarize ResetDate = min(TimeGenerated), TotalCount = count(), SuccessCount = countif(ResetStatus == \"Success\"), FailureCount = countif(ResetStatus == \"Failed\"), CancelledCount = countif(ResetStatus == \"Cancelled\"),ThrottledCount = countif(ResetStatus == \"Throttled\"), BlockedCount = countif(ResetStatus == \"Blocked\"),InProgressCount = countif(Stage contains \"InProgress\") by User, ResetStatus, UserId, IPAddress, Stage, ResultReason, Result\r\n| order by ResetDate asc, User asc\r\n| project ResetDate, User, ResetStatus,TotalCount, SuccessCount,FailureCount,CancelledCount,InProgressCount,ThrottledCount, BlockedCount, UserId, IPAddress, Stage, ResultReason, Result\r\n| serialize Id = strcat(User, '/', ResetStatus)\r\n| join kind=inner\r\n(\r\n caData\r\n)\r\non User\r\n| project User, UserId, IPAddress, Stage, ResultReason, Result, Id, ResetDate, Name = ResetStatus, Type = 'Action', Details = 'View Details', ['Reset Flow Count'] = TotalCount, ['Inprogress'] = InProgressCount,['Success'] = SuccessCount,['Failed'] = FailureCount, ['Cancelled'] = CancelledCount,['Blocked'] = BlockedCount,['Throttled'] = ThrottledCount, ParentId = Id1\r\n| union (caData\r\n| project Id,Name = User, Type = 'User', ['Reset Flow Count'] = TotalCount, ParentId = '')\r\n|order by ResetDate asc\r\n\r\n\r\n", + "size": 3, + "title": "Reset Funnel per User", + "noDataMessage": "Please select a user from the user list above to see the reset funnel details", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Date", + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "User", + "formatter": 5, + "formatOptions": { + "linkTarget": "GenericDetails", + "linkIsContextBlade": true, + "showIcon": true + } + }, + { + "columnMatch": "IPAddress", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Stage", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ResultReason", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ResetDate", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Details", + "formatter": 7, + "formatOptions": { + "linkTarget": "GenericDetails", + "linkIsContextBlade": true, + "showIcon": true + } + }, + { + "columnMatch": "Reset Flow Count", + "formatter": 20, + "formatOptions": { + "palette": "turquoise", + "showIcon": true + } + }, + { + "columnMatch": "Inprogress", + "formatter": 4, + "formatOptions": { + "palette": "yellow", + "showIcon": true + } + }, + { + "columnMatch": "Success", + "formatter": 4, + "formatOptions": { + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Failed", + "formatter": 4, + "formatOptions": { + "palette": "redBright", + "showIcon": true + } + }, + { + "columnMatch": "Cancelled", + "formatter": 4, + "formatOptions": { + "palette": "redBright", + "showIcon": true + } + }, + { + "columnMatch": "Blocked", + "formatter": 4, + "formatOptions": { + "palette": "redBright", + "showIcon": true + } + }, + { + "columnMatch": "Throttled", + "formatter": 4, + "formatOptions": { + "palette": "redBright", + "showIcon": true + } + }, + { + "columnMatch": "ParentId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 100, + "filter": true, + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "ParentId", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": true + }, + "labelSettings": [ + { + "columnId": "User", + "label": "User" + }, + { + "columnId": "UserId", + "label": "UserId" + }, + { + "columnId": "IPAddress", + "label": "IPAddress" + }, + { + "columnId": "Stage", + "label": "Stage" + }, + { + "columnId": "ResultReason", + "label": "ResultReason" + }, + { + "columnId": "Result", + "label": "Result" + }, + { + "columnId": "Id", + "label": "Id" + }, + { + "columnId": "ResetDate", + "label": "ResetDate" + }, + { + "columnId": "Name", + "label": "Name" + }, + { + "columnId": "Type", + "label": "Type" + }, + { + "columnId": "Details", + "label": "Details" + }, + { + "columnId": "Reset Flow Count", + "label": "Reset Flow Count" + }, + { + "columnId": "Inprogress", + "label": "Inprogress" + }, + { + "columnId": "Success", + "label": "Success" + }, + { + "columnId": "Failed", + "label": "Failed" + }, + { + "columnId": "Cancelled", + "label": "Cancelled" + }, + { + "columnId": "Blocked", + "label": "Blocked" + }, + { + "columnId": "Throttled", + "label": "Throttled" + }, + { + "columnId": "ParentId", + "label": "ParentId" + } + ] + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "ResetStatus", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "centerContent": { + "columnMatch": "dcount_User", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "nodeIdField": "ResetStatus", + "sourceIdField": "ResetStatus", + "targetIdField": "dcount_User", + "nodeSize": null, + "staticNodeSize": 100, + "colorSettings": null, + "hivesMargin": 5 + } + }, + "conditionalVisibility": { + "parameterName": "UserName", + "comparison": "isNotEqualTo", + "value": "null" + }, + "name": "ResetDetails", + "styleSettings": { + "progressStyle": "squares" + } + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Azure Active Directory/Workbooks/SSPR Reset Funnel/settings.json b/Azure Active Directory/Workbooks/SSPR Reset Funnel/settings.json new file mode 100644 index 0000000..a1383ef --- /dev/null +++ b/Azure Active Directory/Workbooks/SSPR Reset Funnel/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"SSPR Reset Funnel", + "author": "Microsoft", + "isPreview": true, + "galleries": [{ "type": "workbook", "resourceType": "microsoft.aadiam/tenant", "order": 400 }] +} \ No newline at end of file diff --git a/Azure Active Directory/Workbooks/SignIns/SignIns.workbook b/Azure Active Directory/Workbooks/SignIns/SignIns.workbook new file mode 100644 index 0000000..24fc71d --- /dev/null +++ b/Azure Active Directory/Workbooks/SignIns/SignIns.workbook @@ -0,0 +1,760 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Sign-in Analysis" + }, + "conditionalVisibility": null, + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "13f56671-7604-4427-a4d8-663f3da0cbc5", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 1209600000 + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-11-13T19:33:10.162Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-11-13T19:33:10.165Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-11-13T19:33:10.166Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-11-13T19:33:10.166Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-11-13T19:33:10.166Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-11-13T19:33:10.166Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-11-13T19:33:10.167Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "timeContextFromParameter": null + }, + { + "id": "3b5cc420-8ad8-4523-ba28-a54910756794", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "SigninLogs\r\n| summarize Count = count() by AppDisplayName\r\n| order by Count desc, AppDisplayName asc\r\n| project Value = AppDisplayName, Label = strcat(AppDisplayName, ' - ', Count, ' sign-ins'), Selected = false\r\n", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "limitSelectTo": 10, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "f7f7970b-58c1-474f-9043-62243d2d4edd", + "version": "KqlParameterItem/1.0", + "name": "Users", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n| summarize Count = count() by UserDisplayName\r\n| order by Count desc, UserDisplayName asc\r\n| project Value = UserDisplayName, Label = strcat(UserDisplayName, ' - ', Count, ' sign-ins'), Selected = false\r\n", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "limitSelectTo": 20, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": null, + "name": "parameters - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n|extend errorCode = Status.errorCode\r\n|extend SigninStatus = case(errorCode == 0, \"Success\", errorCode == 50058, \"Pending user action\",errorCode == 50140, \"Pending user action\", errorCode == 51006, \"Pending user action\", errorCode == 50059, \"Pending user action\",errorCode == 65001, \"Pending user action\", errorCode == 52004, \"Pending user action\", errorCode == 50055, \"Pending user action\", errorCode == 50144, \"Pending user action\", errorCode == 50072, \"Pending user action\", errorCode == 50074, \"Pending user action\", errorCode == 16000, \"Pending user action\", errorCode == 16001, \"Pending user action\", errorCode == 16003, \"Pending user action\", errorCode == 50127, \"Pending user action\", errorCode == 50125, \"Pending user action\", errorCode == 50129, \"Pending user action\", errorCode == 50143, \"Pending user action\", errorCode == 81010, \"Pending user action\", errorCode == 81014, \"Pending user action\", errorCode == 81012 ,\"Pending user action\", \"Failure\");\r\ndata\r\n| summarize Count = count() by SigninStatus\r\n| join kind = fullouter (datatable(SigninStatus:string)['Success', 'Pending action (Interrupts)', 'Failure']) on SigninStatus\r\n| project SigninStatus = iff(SigninStatus == '', SigninStatus1, SigninStatus), Count = iff(SigninStatus == '', 0, Count)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SigninStatus)\r\n on SigninStatus\r\n| project-away SigninStatus1, TimeGenerated\r\n| extend Status = SigninStatus\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend SigninStatus = 'All Sign-ins', Status = '*' \r\n)\r\n| order by Count desc\r\n\r\n\r\n\r\n", + "size": 3, + "exportFieldName": "Status", + "exportParameterName": "SigninStatus", + "exportDefaultValue": "*", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "SigninStatus", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "conditionalVisibility": null, + "name": "query - 5" + }, + { + "type": 1, + "content": { + "json": "
\r\n💡 _Click on a tile or a row in the grid to drill-in further_" + }, + "conditionalVisibility": null, + "name": "text - 6 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = SigninLogs\r\n| extend AppDisplayName = iff(AppDisplayName == '', 'Unknown', AppDisplayName)\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n| extend Country = iff(LocationDetails.countryOrRegion == '', 'Unknown country', tostring(LocationDetails.countryOrRegion))\r\n| extend City = iff(LocationDetails.city == '', 'Unknown city', tostring(LocationDetails.city))\r\n| extend errorCode = Status.errorCode\r\n| extend SigninStatus = case(errorCode == 0, \"Success\", errorCode == 50058, \"Pending user action\",errorCode == 50140, \"Pending user action\", errorCode == 51006, \"Pending user action\", errorCode == 50059, \"Pending user action\",errorCode == 65001, \"Pending user action\", errorCode == 52004, \"Pending user action\", errorCode == 50055, \"Pending user action\", errorCode == 50144, \"Pending user action\", errorCode == 50072, \"Pending user action\", errorCode == 50074, \"Pending user action\", errorCode == 16000, \"Pending user action\", errorCode == 16001, \"Pending user action\", errorCode == 16003, \"Pending user action\", errorCode == 50127, \"Pending user action\", errorCode == 50125, \"Pending user action\", errorCode == 50129, \"Pending user action\", errorCode == 50143, \"Pending user action\", errorCode == 81010, \"Pending user action\", errorCode == 81014, \"Pending user action\", errorCode == 81012 ,\"Pending user action\", \"Failure\")\r\n| where SigninStatus == '{SigninStatus}' or '{SigninStatus}' == '*' or '{SigninStatus}' == 'All Sign-ins';\r\nlet countryData = data\r\n| summarize TotalCount = count(), SuccessCount = countif(SigninStatus == \"Success\"), FailureCount = countif(SigninStatus == \"Failure\"), InterruptCount = countif(SigninStatus == \"Pending user action\") by Country\r\n| join kind=inner\r\n(\r\n data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Country\r\n | project-away TimeGenerated\r\n)\r\non Country\r\n| project Country, TotalCount, SuccessCount,FailureCount,InterruptCount, Trend\r\n| order by TotalCount desc, Country asc;\r\ndata\r\n| summarize TotalCount = count(), SuccessCount = countif(SigninStatus == \"Success\"), FailureCount = countif(SigninStatus == \"Failure\"), InterruptCount = countif(SigninStatus == \"Pending user action\") by Country, City\r\n| join kind=inner\r\n(\r\n data \r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Country, City\r\n | project-away TimeGenerated\r\n)\r\non Country, City\r\n| order by TotalCount desc, Country asc\r\n| project Country, City,TotalCount, SuccessCount,FailureCount,InterruptCount, Trend\r\n| join kind=inner\r\n(\r\n countryData\r\n)\r\non Country\r\n| project Id = City, Name = City, Type = 'City', ['Sign-in Count'] = TotalCount, Trend, ['Failure Count'] = FailureCount, ['Interrupt Count'] = InterruptCount, ['Success Rate'] = 1.0 * SuccessCount / TotalCount, ParentId = Country\r\n| union (countryData\r\n| project Id = Country, Name = Country, Type = 'Country', ['Sign-in Count'] = TotalCount, Trend, ['Failure Count'] = FailureCount, ['Interrupt Count'] = InterruptCount, ['Success Rate'] = 1.0 * SuccessCount / TotalCount, ParentId = 'root')\r\n| order by ['Sign-in Count'] desc, Name asc", + "size": 1, + "exportParameterName": "LocationDetail", + "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\"}", + "showAnalytics": true, + "title": "Sign-ins by Location", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Sign-in Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Failure Count|Interrupt Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Success Rate", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "percent" + } + } + }, + { + "columnMatch": "ParentId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true, + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "ParentId", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": false + } + } + }, + "conditionalVisibility": null, + "customWidth": "67", + "showPin": true, + "name": "query - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let details = dynamic({LocationDetail});\r\nlet data = SigninLogs\r\n| extend AppDisplayName = iff(AppDisplayName == '', 'Unknown', AppDisplayName)\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n| extend Country = tostring(LocationDetails.countryOrRegion)\r\n| extend City = tostring(LocationDetails.city)\r\n| extend errorCode = Status.errorCode\r\n| extend SigninStatus = case(errorCode == 0, \"Success\", errorCode == 50058, \"Pending user action\",errorCode == 50140, \"Pending user action\", errorCode == 51006, \"Pending user action\", errorCode == 50059, \"Pending user action\",errorCode == 65001, \"Pending user action\", errorCode == 52004, \"Pending user action\", errorCode == 50055, \"Pending user action\", errorCode == 50144, \"Pending user action\", errorCode == 50072, \"Pending user action\", errorCode == 50074, \"Pending user action\", errorCode == 16000, \"Pending user action\", errorCode == 16001, \"Pending user action\", errorCode == 16003, \"Pending user action\", errorCode == 50127, \"Pending user action\", errorCode == 50125, \"Pending user action\", errorCode == 50129, \"Pending user action\", errorCode == 50143, \"Pending user action\", errorCode == 81010, \"Pending user action\", errorCode == 81014, \"Pending user action\", errorCode == 81012 ,\"Pending user action\", \"Failure\")\r\n| where SigninStatus == '{SigninStatus}' or '{SigninStatus}' == '*' or '{SigninStatus}' == 'All Sign-ins'\r\n| where details.Type == '*' or (details.Type == 'Country' and Country == details.Name) or (details.Type == 'City' and City == details.Name);\r\ndata\r\n| top 200 by TimeGenerated desc\r\n| extend TimeFromNow = now() - TimeGenerated\r\n| extend TimeAgo = strcat(case(TimeFromNow < 2m, strcat(toint(TimeFromNow / 1m), ' seconds'), TimeFromNow < 2h, strcat(toint(TimeFromNow / 1m), ' minutes'), TimeFromNow < 2d, strcat(toint(TimeFromNow / 1h), ' hours'), strcat(toint(TimeFromNow / 1d), ' days')), ' ago')\r\n| project User = UserDisplayName, ['Sign-in Status'] = strcat(iff(SigninStatus == 'Success', '✔️', '❌'), ' ', SigninStatus), ['Sign-in Time'] = TimeAgo, App = AppDisplayName, ['Error code'] = errorCode, ['Result type'] = ResultType, ['Result signature'] = ResultSignature, ['Result description'] = ResultDescription, ['Conditional access policies'] = ConditionalAccessPolicies, ['Conditional access status'] = ConditionalAccessStatus, ['Operating system'] = DeviceDetail.operatingSystem, Browser = DeviceDetail.browser, ['Country or region'] = LocationDetails.countryOrRegion, ['State'] = LocationDetails.state, ['City'] = LocationDetails.city, ['Time generated'] = TimeGenerated, Status, ['User principal name'] = UserPrincipalName\r\n\r\n", + "size": 1, + "showAnalytics": true, + "title": "Location Sign-in details", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Sign-in Status", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "showIcon": true + } + }, + { + "columnMatch": "App", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Error code", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result signature", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result description", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Conditional access policies", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Conditional access status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Operating system", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Browser", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Country or region", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "State", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "City", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Time generated", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "User principal name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TimeGenerated", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "customWidth": "33", + "name": "query - 8" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "name": "text - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n| extend errorCode = Status.errorCode\r\n| extend SigninStatus = case(errorCode == 0, \"Success\", errorCode == 50058, \"Pending user action\",errorCode == 50140, \"Pending user action\", errorCode == 51006, \"Pending user action\", errorCode == 50059, \"Pending user action\",errorCode == 65001, \"Pending user action\", errorCode == 52004, \"Pending user action\", errorCode == 50055, \"Pending user action\", errorCode == 50144, \"Pending user action\", errorCode == 50072, \"Pending user action\", errorCode == 50074, \"Pending user action\", errorCode == 16000, \"Pending user action\", errorCode == 16001, \"Pending user action\", errorCode == 16003, \"Pending user action\", errorCode == 50127, \"Pending user action\", errorCode == 50125, \"Pending user action\", errorCode == 50129, \"Pending user action\", errorCode == 50143, \"Pending user action\", errorCode == 81010, \"Pending user action\", errorCode == 81014, \"Pending user action\", errorCode == 81012 ,\"Pending user action\", \"Failure\")\r\n| where SigninStatus == '{SigninStatus}' or '{SigninStatus}' == '*' or '{SigninStatus}' == 'All Sign-ins';\r\nlet appData = data\r\n| summarize TotalCount = count(), SuccessCount = countif(SigninStatus == \"Success\"), FailureCount = countif(SigninStatus == \"Failure\"), InterruptCount = countif(SigninStatus == \"Pending user action\") by Os = tostring(DeviceDetail.operatingSystem)\r\n| where Os != ''\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Os = tostring(DeviceDetail.operatingSystem)\r\n | project-away TimeGenerated) on Os\r\n| order by TotalCount desc, Os asc\r\n| project Os, TotalCount, SuccessCount, FailureCount, InterruptCount, Trend\r\n| serialize Id = row_number();\r\ndata\r\n| summarize TotalCount = count(), SuccessCount = countif(SigninStatus == \"Success\"), FailureCount = countif(SigninStatus == \"Failure\"), InterruptCount = countif(SigninStatus == \"Pending user action\") by Os = tostring(DeviceDetail.operatingSystem), Browser = tostring(DeviceDetail.browser)\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Os = tostring(DeviceDetail.operatingSystem), Browser = tostring(DeviceDetail.browser)\r\n | project-away TimeGenerated) on Os, Browser\r\n| order by TotalCount desc, Os asc\r\n| project Os, Browser, TotalCount, SuccessCount, FailureCount, InterruptCount, Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on Os\r\n| project Id, Name = Browser, Type = 'Browser', ['Sign-in Count'] = TotalCount, Trend, ['Failure Count'] = FailureCount, ['Interrupt Count'] = InterruptCount, ['Success Rate'] = 1.0 * SuccessCount / TotalCount, ParentId = Id1\r\n| union (appData \r\n | project Id, Name = Os, Type = 'Operating System', ['Sign-in Count'] = TotalCount, Trend, ['Failure Count'] = FailureCount, ['Interrupt Count'] = InterruptCount, ['Success Rate'] = 1.0 * SuccessCount / TotalCount, ParentId = -1)\r\n| order by ['Sign-in Count'] desc, Name asc", + "size": 1, + "exportParameterName": "DeviceDetail", + "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\"}", + "showAnalytics": true, + "title": "Sign-ins by Device", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Sign-in Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Failure Count|Interrupt Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Success Rate", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "percent" + } + } + }, + { + "columnMatch": "ParentId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true, + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "ParentId", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": false + } + } + }, + "conditionalVisibility": null, + "customWidth": "67", + "showPin": true, + "name": "query - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let details = dynamic({DeviceDetail});\r\nlet data = SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n| extend errorCode = Status.errorCode\r\n| extend SigninStatus = case(errorCode == 0, \"Success\", errorCode == 50058, \"Pending user action\",errorCode == 50140, \"Pending user action\", errorCode == 51006, \"Pending user action\", errorCode == 50059, \"Pending user action\",errorCode == 65001, \"Pending user action\", errorCode == 52004, \"Pending user action\", errorCode == 50055, \"Pending user action\", errorCode == 50144, \"Pending user action\", errorCode == 50072, \"Pending user action\", errorCode == 50074, \"Pending user action\", errorCode == 16000, \"Pending user action\", errorCode == 16001, \"Pending user action\", errorCode == 16003, \"Pending user action\", errorCode == 50127, \"Pending user action\", errorCode == 50125, \"Pending user action\", errorCode == 50129, \"Pending user action\", errorCode == 50143, \"Pending user action\", errorCode == 81010, \"Pending user action\", errorCode == 81014, \"Pending user action\", errorCode == 81012 ,\"Pending user action\", \"Failure\")\r\n| where SigninStatus == '{SigninStatus}' or '{SigninStatus}' == '*' or '{SigninStatus}' == 'All Sign-ins'\r\n| extend Os = tostring(DeviceDetail.operatingSystem), Browser = tostring(DeviceDetail.browser)\r\n| where details.Type == '*' or (details.Type == 'Operating System' and Os == details.Name) or (details.Type == 'Browser' and Browser == details.Name);\r\ndata\r\n| order by TimeGenerated desc\r\n| top 200 by TimeGenerated desc\r\n| extend TimeFromNow = now() - TimeGenerated\r\n| extend TimeAgo = strcat(case(TimeFromNow < 2m, strcat(toint(TimeFromNow / 1m), ' seconds'), TimeFromNow < 2h, strcat(toint(TimeFromNow / 1m), ' minutes'), TimeFromNow < 2d, strcat(toint(TimeFromNow / 1h), ' hours'), strcat(toint(TimeFromNow / 1d), ' days')), ' ago')\r\n| project User = UserDisplayName, ['Sign-in Status'] = strcat(iff(SigninStatus == 'Success', '✔️', '❌'), ' ', SigninStatus), ['Sign-in Time'] = TimeAgo, App = AppDisplayName, ['Error code'] = errorCode, ['Result type'] = ResultType, ['Result signature'] = ResultSignature, ['Result description'] = ResultDescription, ['Conditional access policies'] = ConditionalAccessPolicies, ['Conditional access status'] = ConditionalAccessStatus, ['Operating system'] = DeviceDetail.operatingSystem, Browser = DeviceDetail.browser, ['Country or region'] = LocationDetails.countryOrRegion, ['State'] = LocationDetails.state, ['City'] = LocationDetails.city, ['Time generated'] = TimeGenerated, Status, ['User principal name'] = UserPrincipalName\r\n\r\n", + "size": 1, + "showAnalytics": true, + "title": "Device Sign-in details", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Sign-in Status", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "showIcon": true + } + }, + { + "columnMatch": "App", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Error code", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result signature", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result description", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Conditional access policies", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Conditional access status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Operating system", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Browser", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Country or region", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "State", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "City", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Time generated", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "User principal name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "customWidth": "33", + "name": "query - 8 - Copy" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Active Directory/Workbooks/SignIns/settings.json b/Azure Active Directory/Workbooks/SignIns/settings.json new file mode 100644 index 0000000..986761e --- /dev/null +++ b/Azure Active Directory/Workbooks/SignIns/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Sign-ins", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.aadiam/tenant", "order": 100 }] +} \ No newline at end of file diff --git a/Azure Active Directory/Workbooks/SignInsUsingLegacyAuth/SignIns.workbook b/Azure Active Directory/Workbooks/SignInsUsingLegacyAuth/SignIns.workbook new file mode 100644 index 0000000..bb5625f --- /dev/null +++ b/Azure Active Directory/Workbooks/SignInsUsingLegacyAuth/SignIns.workbook @@ -0,0 +1,487 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Sign-ins using Legacy Auth" + }, + "customWidth": "100", + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "13f56671-7604-4427-a4d8-663f3da0cbc5", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 1209600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-11-13T19:33:10.162Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-11-13T19:33:10.164Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-11-13T19:33:10.165Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-11-13T19:33:10.166Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-11-13T19:33:10.166Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-11-13T19:33:10.166Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-11-13T19:33:10.166Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-11-13T19:33:10.167Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "3b5cc420-8ad8-4523-ba28-a54910756794", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 2, + "description": "Provide Application Name", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "SigninLogs\r\n| extend ClientAppUsed = iff(isempty(ClientAppUsed)==true,\"Unknown\" ,ClientAppUsed) \r\n| extend isLegacyAuth = case(ClientAppUsed contains \"Browser\", \"No\", ClientAppUsed contains \"Mobile Apps and Desktop clients\", \"No\", ClientAppUsed contains \"Exchange ActiveSync\", \"No\", ClientAppUsed contains \"Other clients\", \"Yes\", \"Unknown\") \r\n| where isLegacyAuth==\"Yes\"\r\n| summarize Count = count() by AppDisplayName\r\n| order by Count desc, AppDisplayName asc\r\n| project Value = AppDisplayName, Label = strcat(AppDisplayName, ' - ', Count, ' sign-ins'), Selected = false\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "limitSelectTo": 20, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "15200934-c2dd-488b-be37-8b038696deee", + "version": "KqlParameterItem/1.0", + "name": "Users", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n| extend ClientAppUsed = iff(isempty(ClientAppUsed)==true,\"Unknown\" ,ClientAppUsed) \r\n| extend isLegacyAuth = case(ClientAppUsed contains \"Browser\", \"No\", ClientAppUsed contains \"Mobile Apps and Desktop clients\", \"No\", ClientAppUsed contains \"Exchange ActiveSync\", \"No\", ClientAppUsed contains \"Other clients\", \"Yes\", \"Unknown\") \r\n| where isLegacyAuth==\"Yes\"\r\n| summarize Count = count() by UserDisplayName\r\n| order by Count desc, UserDisplayName asc\r\n| project Value = UserDisplayName, Label = strcat(UserDisplayName, ' - ', Count, ' sign-ins'), Selected = false\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "limitSelectTo": 20, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "2d1aee59-8171-4fc3-954f-19b1e0114f04", + "version": "KqlParameterItem/1.0", + "name": "Protocols", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n| extend ClientAppUsed = iff(isempty(ClientAppUsed)==true,\"Unknown\" ,ClientAppUsed) \r\n| extend isLegacyAuth = case(ClientAppUsed contains \"Browser\", \"No\", ClientAppUsed contains \"Mobile Apps and Desktop clients\", \"No\", ClientAppUsed contains \"Exchange ActiveSync\", \"No\", ClientAppUsed contains \"Unknown\", \"Unknown\", \"Yes\") \r\n| where isLegacyAuth==\"Yes\"\r\n|extend ClientAppUsed = iff(isempty(ClientAppUsed)==true,\"Unknown\", ClientAppUsed)\r\n| summarize Count = count() by ClientAppUsed\r\n| order by Count desc, ClientAppUsed asc\r\n| project value = ClientAppUsed, label = strcat(ClientAppUsed, ' - ', Count, ' sign ins')\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "limitSelectTo": 20, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n|extend errorCode = toint(Status.errorCode)\r\n|extend SigninStatus = case(errorCode == 0, \"Success\", \r\n errorCode == 50058, \"Interrupt\", \r\n errorCode == 50140, \"Interrupt\", \r\n errorCode == 51006, \"Interrupt\", \r\n errorCode == 50059, \"Interrupt\", \r\n errorCode == 65001, \"Interrupt\", \r\n errorCode == 52004, \"Interrupt\", \r\n errorCode == 50055, \"Interrupt\", \r\n errorCode == 50144, \"Interrupt\", \r\n errorCode == 50072, \"Interrupt\", \r\n errorCode == 50074, \"Interrupt\", \r\n errorCode == 16000, \"Interrupt\", \r\n errorCode == 16001, \"Interrupt\", \r\n errorCode == 16003, \"Interrupt\", \r\n errorCode == 50127, \"Interrupt\", \r\n errorCode == 50125, \"Interrupt\", \r\n errorCode == 50129, \"Interrupt\", \r\n errorCode == 50143, \"Interrupt\", \r\n errorCode == 81010, \"Interrupt\", \r\n errorCode == 81014, \"Interrupt\", \r\n errorCode == 81012 ,\"Interrupt\", \r\n \"Failure\") \r\n|extend Reason = tostring(Status.failureReason)\r\n|extend ClientAppUsed = iff(isempty(ClientAppUsed)==true,\"Unknown\" ,ClientAppUsed) \r\n| where ClientAppUsed in ({Protocols}) or '*' in ({Protocols}) or ('Unknown' in ({Protocols}) and isempty(ClientAppUsed))\r\n|extend isLegacyAuth = case(ClientAppUsed contains \"Browser\", \"No\", ClientAppUsed contains \"Mobile Apps and Desktop clients\", \"No\", ClientAppUsed contains \"Exchange ActiveSync\", \"Yes\", ClientAppUsed contains \"Unknown\", \"Unknown\", \"Yes\") \r\n|where isLegacyAuth==\"Yes\";\r\ndata\r\n| summarize Count = count() by SigninStatus\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by SigninStatus) on SigninStatus\r\n| project-away SigninStatus1, TimeGenerated\r\n| union (data\r\n | summarize Count = count()\r\n | extend SigninStatus = 'All Sign-ins', jkey = 1\r\n | join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) \r\n | extend jkey = 1) on jkey\r\n | project-away jkey, jkey1, TimeGenerated\r\n\r\n)\r\n", + "size": 3, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "SigninStatus", + "exportParameterName": "SigninStatus", + "exportDefaultValue": "*", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "SigninStatus", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n|extend errorCode = toint(Status.errorCode)\r\n|extend SigninStatus = case(errorCode == 0, \"Success\", \r\n errorCode == 50058, \"Interrupt\", \r\n errorCode == 50140, \"Interrupt\", \r\n errorCode == 51006, \"Interrupt\", \r\n errorCode == 50059, \"Interrupt\", \r\n errorCode == 65001, \"Interrupt\", \r\n errorCode == 52004, \"Interrupt\", \r\n errorCode == 50055, \"Interrupt\", \r\n errorCode == 50144, \"Interrupt\", \r\n errorCode == 50072, \"Interrupt\", \r\n errorCode == 50074, \"Interrupt\", \r\n errorCode == 16000, \"Interrupt\", \r\n errorCode == 16001, \"Interrupt\", \r\n errorCode == 16003, \"Interrupt\", \r\n errorCode == 50127, \"Interrupt\", \r\n errorCode == 50125, \"Interrupt\", \r\n errorCode == 50129, \"Interrupt\", \r\n errorCode == 50143, \"Interrupt\", \r\n errorCode == 81010, \"Interrupt\", \r\n errorCode == 81014, \"Interrupt\", \r\n errorCode == 81012 ,\"Interrupt\", \r\n \"Failure\") \r\n| where SigninStatus == '{SigninStatus}' or '{SigninStatus}' == '*' or '{SigninStatus}' == 'All Sign-ins'\r\n|extend Reason = tostring(Status.failureReason)\r\n|extend ClientAppUsed = iff(isempty(ClientAppUsed)==true,\"Unknown\" ,ClientAppUsed) \r\n|extend isLegacyAuth = case(ClientAppUsed contains \"Browser\", \"No\", ClientAppUsed contains \"Mobile Apps and Desktop clients\", \"No\", ClientAppUsed contains \"Exchange ActiveSync\", \"Yes\", ClientAppUsed contains \"Unknown\", \"Unknown\", \"Yes\") \r\n|where isLegacyAuth==\"Yes\"\r\n| where AppDisplayName in ('*') or '*' in ('*');\r\nlet caData = data\r\n| summarize TotalCount = count(), SuccessCount = countif(SigninStatus == \"Success\"), FailureCount = countif(SigninStatus == \"Failure\"), UserInterruptedCount = countif(SigninStatus == \"Interrupted\") by AppDisplayName\r\n| join kind=inner\r\n(\r\n data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by AppDisplayName\r\n | project-away TimeGenerated\r\n)\r\non AppDisplayName\r\n| project AppDisplayName, TotalCount, SuccessCount,FailureCount,UserInterruptedCount, Trend\r\n| order by TotalCount desc, AppDisplayName asc\r\n| extend Id = AppDisplayName;\r\ndata\r\n| summarize TotalCount = count(), SuccessCount = countif(SigninStatus == \"Success\"), FailureCount = countif(SigninStatus == \"Failure\"), UserInterruptedCount = countif(SigninStatus == \"Interrupted\") by AppDisplayName, ClientAppUsed\r\n| join kind=inner\r\n(\r\n data \r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by AppDisplayName, ClientAppUsed\r\n | project-away TimeGenerated\r\n)\r\non AppDisplayName, ClientAppUsed\r\n| order by TotalCount desc, AppDisplayName asc\r\n| project AppDisplayName, ClientAppUsed,TotalCount, SuccessCount,FailureCount,UserInterruptedCount, Trend\r\n| serialize Id = strcat(AppDisplayName, '/', ClientAppUsed)\r\n| join kind=inner\r\n(\r\n caData\r\n)\r\non AppDisplayName\r\n| project Id, Name = ClientAppUsed , Type = 'Protocol', ['Sign-in Count'] = TotalCount, Trend, ['Failure Count'] = FailureCount, ['User Interrupted Count'] = UserInterruptedCount, ParentId = Id1\r\n| union (caData\r\n| project Id, Name = AppDisplayName, Type = 'App', ['Sign-in Count'] = TotalCount, Trend, ['Failure Count'] = FailureCount, ['User Interrupted Count'] = UserInterruptedCount, ParentId = '')\r\n| order by ['Sign-in Count'] desc, Name asc", + "size": 0, + "showAnalytics": true, + "title": "Legacy Auth Sign-ins by App and Protocol", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportParameterName": "SigninDetails", + "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\"}", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Sign-in Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Failure Count|User Interrupted Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "rowLimit": 100, + "filter": true, + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "ParentId", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": true + } + } + }, + "customWidth": "67", + "showPin": true, + "name": "query - 11" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let details = dynamic({SigninDetails});\r\nlet data = SigninLogs\r\n|where AppDisplayName in ({Apps}) or '*' in ({Apps})\r\n|where UserDisplayName in ({Users}) or '*' in ({Users})\r\n|extend errorCode = toint(Status.errorCode)\r\n|extend SigninStatus = case(errorCode == 0, \"Success\", \r\n errorCode == 50058, \"Interrupt\", \r\n errorCode == 50140, \"Interrupt\", \r\n errorCode == 51006, \"Interrupt\", \r\n errorCode == 50059, \"Interrupt\", \r\n errorCode == 65001, \"Interrupt\", \r\n errorCode == 52004, \"Interrupt\", \r\n errorCode == 50055, \"Interrupt\", \r\n errorCode == 50144, \"Interrupt\", \r\n errorCode == 50072, \"Interrupt\", \r\n errorCode == 50074, \"Interrupt\", \r\n errorCode == 16000, \"Interrupt\", \r\n errorCode == 16001, \"Interrupt\", \r\n errorCode == 16003, \"Interrupt\", \r\n errorCode == 50127, \"Interrupt\", \r\n errorCode == 50125, \"Interrupt\", \r\n errorCode == 50129, \"Interrupt\", \r\n errorCode == 50143, \"Interrupt\", \r\n errorCode == 81010, \"Interrupt\", \r\n errorCode == 81014, \"Interrupt\", \r\n errorCode == 81012 ,\"Interrupt\", \r\n \"Failure\") \r\n|where SigninStatus == '{SigninStatus}' or '{SigninStatus}' == '*' or '{SigninStatus}' == 'All Sign-ins' \r\n|extend Reason = tostring(Status.failureReason)\r\n|extend ClientAppUsed = iff(isempty(ClientAppUsed)==true,\"Unknown\" ,ClientAppUsed) \r\n|extend isLegacyAuth = case(ClientAppUsed contains \"Browser\", \"No\", ClientAppUsed contains \"Mobile Apps and Desktop clients\", \"No\", ClientAppUsed contains \"Exchange ActiveSync\", \"Yes\", ClientAppUsed contains \"Unknown\", \"Unknown\", \"Yes\") \r\n|where isLegacyAuth==\"Yes\"\r\n| where AppDisplayName in ('*') or '*' in ('*')\r\n| where details.Type == '*' or (details.Type == 'App' and AppDisplayName == details.Name) or (details.Type == 'Protocol' and AppDisplayName == details.ParentId and ClientAppUsed == details.Name);\r\ndata\r\n| top 200 by TimeGenerated desc\r\n| extend TimeFromNow = now() - TimeGenerated\r\n| extend TimeAgo = strcat(case(TimeFromNow < 2m, strcat(toint(TimeFromNow / 1m), ' seconds'), TimeFromNow < 2h, strcat(toint(TimeFromNow / 1m), ' minutes'), TimeFromNow < 2d, strcat(toint(TimeFromNow / 1h), ' hours'), strcat(toint(TimeFromNow / 1d), ' days')), ' ago')\r\n| project User = UserDisplayName, ['Sign-in Status'] = strcat(iff(SigninStatus == 'Success', '✔️', '❌'), ' ', SigninStatus), ['Sign-in Time'] = TimeAgo, App = AppDisplayName, ['Error code'] = errorCode, ['Result type'] = ResultType, ['Result signature'] = ResultSignature, ['Result description'] = ResultDescription, ['Conditional access policies'] = ConditionalAccessPolicies, ['Conditional access status'] = ConditionalAccessStatus, ['Operating system'] = DeviceDetail.operatingSystem, Browser = DeviceDetail.browser, ['Country or region'] = LocationDetails.countryOrRegion, ['State'] = LocationDetails.state, ['City'] = LocationDetails.city, ['Time generated'] = TimeGenerated, Status, ['User principal name'] = UserPrincipalName\r\n\r\n", + "size": 0, + "showAnalytics": true, + "title": "Legacy Auth Sign-in Details", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Sign-in Status", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "showIcon": true + } + }, + { + "columnMatch": "App", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Error code", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result signature", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Result description", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Conditional access policies", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Conditional access status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Operating system", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Browser", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Country or region", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "State", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "City", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Time generated", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "User principal name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 200, + "filter": true + } + }, + "customWidth": "33", + "name": "query - 11 - Copy" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Active Directory/Workbooks/SignInsUsingLegacyAuth/settings.json b/Azure Active Directory/Workbooks/SignInsUsingLegacyAuth/settings.json new file mode 100644 index 0000000..5d8ba25 --- /dev/null +++ b/Azure Active Directory/Workbooks/SignInsUsingLegacyAuth/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Sign-ins using Legacy Authentication", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.aadiam/tenant", "order": 100 }] +} \ No newline at end of file diff --git a/Azure Active Directory/Workbooks/categoryResources.json b/Azure Active Directory/Workbooks/categoryResources.json new file mode 100644 index 0000000..90774b1 --- /dev/null +++ b/Azure Active Directory/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Usage", "description": "Provides insights on usage of your Directory", "order": 100} +} \ No newline at end of file diff --git a/Azure Backup/Alerts/README b/Azure Backup/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Azure Backup/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Azure Backup/Queries/README b/Azure Backup/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Azure Backup/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Azure Backup/Workbooks/Backup Explorer/Backup Explorer.workbook b/Azure Backup/Workbooks/Backup Explorer/Backup Explorer.workbook new file mode 100644 index 0000000..779c8d3 --- /dev/null +++ b/Azure Backup/Workbooks/Backup Explorer/Backup Explorer.workbook @@ -0,0 +1,4442 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "Tabname", + "linkTarget": "parameter", + "linkLabel": "Summary", + "subTarget": "Summary", + "style": "link" + }, + { + "cellValue": "Tabname", + "linkTarget": "parameter", + "linkLabel": "Backup Items", + "subTarget": "Backup Items", + "style": "link" + }, + { + "cellValue": "Tabname", + "linkTarget": "parameter", + "linkLabel": "Jobs", + "subTarget": "Jobs", + "style": "link" + }, + { + "cellValue": "Tabname", + "linkTarget": "parameter", + "linkLabel": "Alerts", + "subTarget": "Alerts", + "style": "link" + }, + { + "cellValue": "Tabname", + "linkTarget": "parameter", + "linkLabel": "Policies", + "subTarget": "Policies", + "style": "link" + }, + { + "cellValue": "Tabname", + "linkTarget": "parameter", + "linkLabel": "Backup Not Enabled", + "subTarget": "Backup Not Enabled", + "style": "link" + } + ] + }, + "name": "Tabs" + }, + { + "type": 1, + "content": { + "json": "
Backup Explorer (Virtual Machines) - {Tabname}
" + }, + "name": "MainHeadingAndLink" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "8a19264d-e7e9-4a23-8c3a-128bda8340f7", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "description": "Select from list of Default Subscriptions", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "includeAll": false + } + }, + { + "id": "eb783656-4dd4-4973-a090-eea8cf20fb42", + "version": "KqlParameterItem/1.0", + "name": "BackupItemHostHash", + "type": 1, + "isRequired": true, + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| extend x = split(tolower(tostring(properties.containerName)),\";\")\r\n| project x = iff(array_length(x) == 4, tostring(hash(strcat(tolower(subscriptionId), tostring(x[2]), tostring(x[3])))), tostring(hash(strcat(tolower(subscriptionId), tostring(x[1]), tostring(x[2])))))\r\n| distinct x\r\n| summarize x = tostring(makelist(x,32000))\r\n| project x = replace(\"[\\\\]\\\\[]\",\"\",x)\r\n// Default Value as it is required Parameter\r\n| project x = iff(isempty(x), \"0\", x)\r\n", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2fea6948-d21b-478f-9a4a-d58b5e30e14f", + "version": "KqlParameterItem/1.0", + "name": "VMHash", + "type": 1, + "isRequired": true, + "query": "Resources\r\n| where type == \"microsoft.compute/virtualmachines\" or type == \"microsoft.classiccompute/virtualmachines\"\r\n| project x = tolower(subscriptionId), y = tolower(resourceGroup), z = tolower(name)\r\n| project a = tostring(hash(strcat(x,y,z)))\r\n| where a in ({BackupItemHostHash})\r\n| summarize a = makelist(a,32000)\r\n| project a = replace(\"[\\\\]\\\\[]\",\"\",tostring(a))\r\n// Default Value as it is required Parameter\r\n| project a = iff(isempty(a), \"0\", a)\r\n", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "customWidth": "18", + "name": "SubscriptionParameterBlock" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "d8d14542-cdfb-4299-aa94-b633567ab68d", + "version": "KqlParameterItem/1.0", + "name": "Location", + "label": "Vault Location", + "type": 2, + "description": "Select one or more locations having Recovery Services Vaults", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type == \"microsoft.recoveryservices/vaults\"\r\n| summarize by location", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "8a2998fa-6ce1-4285-a2b3-63597e7a63b7", + "version": "KqlParameterItem/1.0", + "name": "Vault", + "type": 5, + "description": "Select one or more Recovery Services Vaults", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type == \"microsoft.recoveryservices/vaults\"\r\n| where location in ({Location}) or '*' in ({Location})\r\n| summarize by id = tolower(id)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isNotEqualTo", + "value": "Backup Not Enabled" + }, + "customWidth": "36", + "name": "VaultParameterBlock" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "e10a33af-55df-48ee-ac20-57f70436964c", + "version": "KqlParameterItem/1.0", + "name": "AllVaultHash", + "type": 1, + "isRequired": true, + "query": "Resources\r\n| where type == \"microsoft.recoveryservices/vaults\"\r\n| where location in ({Location}) or '*' in ({Location})\r\n| summarize by id = tolower(id)\r\n| summarize x = makelist(tostring(hash(id)),32000)\r\n| project a = replace(\"[\\\\]\\\\[]\",\"\",tostring(x))\r\n// Default Value as it is required Parameter\r\n| project a = iff(isempty(a), \"0\", a)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "aeb07d33-7b35-4996-abb7-20d546e8696f", + "version": "KqlParameterItem/1.0", + "name": "SummaryProtectionState", + "type": 1, + "isHiddenWhenLocked": true + }, + { + "id": "40047988-c2d0-4f10-b71f-24f4070b4bb6", + "version": "KqlParameterItem/1.0", + "name": "SummaryJobStatus", + "type": 1, + "isHiddenWhenLocked": true + }, + { + "id": "9e976a4c-a44e-4434-b3e3-28b77991ee6b", + "version": "KqlParameterItem/1.0", + "name": "SummaryAlertSeverity", + "type": 1, + "isHiddenWhenLocked": true + }, + { + "id": "373f9703-b07f-4a82-be21-9f1d328723fe", + "version": "KqlParameterItem/1.0", + "name": "SummaryNotEnabledLocation", + "type": 1, + "isHiddenWhenLocked": true + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isNotEqualTo", + "value": "Backup Not Enabled" + }, + "customWidth": "5", + "name": "VaultHashParameterBlock" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "2a83acc5-2123-476f-8a4c-da2fddf231a1", + "version": "KqlParameterItem/1.0", + "name": "VMLocation", + "label": "VM Location", + "type": 2, + "description": "Select one or more locations having virtual machines", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type in (\"microsoft.compute/virtualmachines\", \"microsoft.classiccompute/virtualmachines\")\r\n| where tostring(hash(strcat(tolower(subscriptionId), tolower(resourceGroup), tolower(name)))) !in ({BackupItemHostHash})\r\n| summarize by location", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Backup Not Enabled" + }, + "customWidth": "18", + "name": "VMLocationParameterBlock" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "60a7f6fb-86ec-4e68-ac3e-d5f83419cc09", + "version": "KqlParameterItem/1.0", + "name": "BackupItemView", + "label": "Backup Item View", + "type": 2, + "description": "Choose Advanced view for more filters and columns to interact", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"Standard\", \"label\":\"Standard\", \"selected\":true },\r\n { \"value\":\"Enhanced\", \"label\":\"Advanced\" }\r\n]" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Backup Items" + }, + "customWidth": "18", + "name": "BackupItemViewParameterBlock" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "60a7f6fb-86ec-4e68-ac3e-d5f83419cc09", + "version": "KqlParameterItem/1.0", + "name": "PolicyView", + "label": "Choose Policy View", + "type": 2, + "description": "Choose advanced view for more filters and columns to interact and view Backup Items related to selected policy", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"Standard\", \"label\":\"Standard\", \"selected\":true },\r\n { \"value\":\"Enhanced\", \"label\":\"Advanced\" }\r\n]" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + "customWidth": "18", + "name": "PolicyViewParameterBlock" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "8c4ae44c-fa9a-4498-aedc-736a56e64b43", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "description": "Select Time Range to view Jobs and Alerts", + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + } + ], + "allowCustom": false + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isNotEqualTo", + "value": "Backup Items" + }, + { + "parameterName": "Tabname", + "comparison": "isNotEqualTo", + "value": "Policies" + }, + { + "parameterName": "Tabname", + "comparison": "isNotEqualTo", + "value": "Backup Not Enabled" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isNotEqualTo", + "value": "Backup Items" + }, + "customWidth": "18", + "name": "TimeRangeParameterBlock" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "60a7f6fb-86ec-4e68-ac3e-d5f83419cc09", + "version": "KqlParameterItem/1.0", + "name": "RowsPerPage", + "label": "Rows Per Page", + "type": 2, + "description": "Number of rows to display in grid view", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":10, \"label\":\"10\", \"selected\":true },\r\n { \"value\":25, \"label\":\"25\" },\r\n { \"value\":50, \"label\":\"50\" },\r\n { \"value\":100, \"label\":\"100\" },\r\n { \"value\":250, \"label\":\"250\" },\r\n { \"value\":500, \"label\":\"500\" },\r\n { \"value\":1000, \"label\":\"1000\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isNotEqualTo", + "value": "Overview" + }, + { + "parameterName": "Tabname", + "comparison": "isNotEqualTo", + "value": "Summary" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isNotEqualTo", + "value": "Overview" + }, + "customWidth": "18", + "name": "RowsPerPageParameterBlock" + }, + { + "type": 1, + "content": { + "json": "_______" + }, + "name": "DividingLine" + }, + { + "type": 1, + "content": { + "json": "

Click on any of the tiles to see more details

" + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + "name": "InstructionText" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupFabrics.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| summarize c = count() \r\n| extend Item = \"Backup Items\", SubText = \"Total\", Key = 1\r\n| union\r\n(\r\nRecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupjobs\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| where todatetime(properties.startTime) {TimeRange}\r\n| where properties.status != \"InProgress\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupJobs.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| summarize c = count()\r\n| extend Item = \"Backup Jobs\", SubText = \"Total\", Key = 2\r\n) \r\n| union\r\n(\r\nRecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/alerts\"\r\n| where properties.sourceType == \"IaaSVM\"\r\n| where todatetime(properties.initialOccurrenceTime) {TimeRange}\r\n| extend vaultId = tolower(replace(\"\\\\/alerts.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend Items = \"Backup Alerts\", SubText = \"Total\"\r\n| summarize c = count()\r\n| extend Item = \"Backup Alerts\", SubText = \"Total\", Key = 3\r\n) \r\n| sort by Key asc", + "size": 4, + "exportFieldName": "Item", + "exportParameterName": "SummarySelectedItem", + "exportDefaultValue": "\"\"", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "table", + "tileSettings": { + "titleContent": { + "columnMatch": "Item", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubText", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "c", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + } + }, + "showBorder": true + } + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Always Hide" + }, + "customWidth": "0", + "name": "SummaryTilesFromRecoveryServices" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Resources\r\n| where type in (\"microsoft.compute/virtualmachines\", \"microsoft.classiccompute/virtualmachines\")\r\n| where tostring(hash(strcat(tolower(subscriptionId), tolower(resourceGroup), tolower(name)))) !in ({BackupItemHostHash})\r\n| summarize c = count() \r\n| extend Item = \"Backup Not Enabled\", SubText = \"Virtual Machines\", Key = 4\r\n", + "size": 4, + "exportFieldName": "NotProtected", + "exportParameterName": "SummarySelectedItem1", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "table", + "tileSettings": { + "titleContent": { + "columnMatch": "NotProtected", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "VirtualMachines", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "c", + "formatter": 12, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + } + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Always Hide" + }, + "customWidth": "0", + "name": "SummaryTilesFromResources" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"d07e608f-747a-4780-9d2d-ed1cb021802d\",\"mergeType\":\"union\",\"leftTable\":\"SummaryTilesFromRecoveryServices\",\"rightTable\":\"SummaryTilesFromResources\"}],\"projectRename\":[{\"originalName\":\"[SummaryTilesFromRecoveryServices].c\",\"mergedName\":\"c\",\"fromId\":\"d07e608f-747a-4780-9d2d-ed1cb021802d\"},{\"originalName\":\"[SummaryTilesFromRecoveryServices].Item\",\"mergedName\":\"Item\",\"fromId\":\"d07e608f-747a-4780-9d2d-ed1cb021802d\"},{\"originalName\":\"[SummaryTilesFromRecoveryServices].SubText\",\"mergedName\":\"SubText\",\"fromId\":\"d07e608f-747a-4780-9d2d-ed1cb021802d\"},{\"originalName\":\"[SummaryTilesFromRecoveryServices].Key\",\"mergedName\":\"Key\",\"fromId\":\"d07e608f-747a-4780-9d2d-ed1cb021802d\"},{\"originalName\":\"c\",\"mergedName\":\"c\",\"fromId\":\"unknown\"},{\"originalName\":\"Item\",\"mergedName\":\"Item\",\"fromId\":\"unknown\"},{\"originalName\":\"SubText\",\"mergedName\":\"SubText\",\"fromId\":\"unknown\"},{\"originalName\":\"Key\",\"mergedName\":\"Key\",\"fromId\":\"unknown\"}]}", + "size": 4, + "exportFieldName": "Item", + "exportParameterName": "SummarySelectedItem", + "exportDefaultValue": "\"\"", + "queryType": 7, + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Item", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubText", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "c", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + } + }, + "showBorder": true + } + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + "customWidth": "0", + "name": "MergedSummaryTiles" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + "name": "text - 38" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupFabrics.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend ProtectionState = iff(tostring(properties.protectionState) == \"IRPending\", \"Initial Backup Pending\", iff(tostring(properties.protectionState) == \"Protected\", \"Actively Protected\", iff(tostring(properties.protectionState) == \"ProtectionStopped\", \"Protection Stopped\", \"Actively Protected\")))\r\n| summarize BackupItems = count() by ProtectionState\r\n| sort by ProtectionState asc", + "size": 1, + "title": "Backup Items by Protection State", + "noDataMessage": "No BackupItems were found in the selected scope", + "exportFieldName": "", + "exportParameterName": "SummaryProtectionState", + "exportDefaultValue": "*", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "piechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "vaultId", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + } + ] + }, + "tileSettings": { + "titleContent": { + "columnMatch": "ProtectionState", + "formatter": 1, + "formatOptions": { + "showIcon": true, + "workbookContext": null + } + }, + "subtitleContent": { + "columnMatch": "ResourceState", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "BackupItems", + "formatter": 12, + "formatOptions": { + "showIcon": true, + "workbookContext": null + } + }, + "showBorder": true + }, + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "Actively Protected", + "color": "green" + }, + { + "seriesName": "Protection Stopped", + "color": "redBright" + }, + { + "seriesName": "Initial Backup Pending", + "color": "yellow" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + { + "parameterName": "SummarySelectedItem", + "comparison": "isEqualTo", + "value": "Backup Items" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + "customWidth": "0", + "name": "BackupItemsByProtectionState" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupFabrics.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend ProtectionState = iff(tostring(properties.protectionState) == \"IRPending\", \"Initial Backup Pending\", iff(tostring(properties.protectionState) == \"Protected\", \"Actively Protected\", iff(tostring(properties.protectionState) == \"ProtectionStopped\", \"Protection Stopped\", \"Actively Protected\")))\r\n| where ProtectionState == tostring(parse_json('{SummaryProtectionState}').label) or '{SummaryProtectionState}' contains \"*\"\r\n| extend a = split(tolower(tostring(properties.containerName)),\";\")\r\n| extend a = iff(array_length(a) == 4, tostring(hash(strcat(tolower(subscriptionId), tostring(a[2]), tostring(a[3])))), tostring(hash(strcat(tolower(subscriptionId), tostring(a[1]), tostring(a[2])))))\r\n| extend ResourceState = iff(a in ({VMHash}), \"VM Active\", \"VM Not Found\")\r\n| summarize BackupItems = count() by ResourceState\r\n| sort by ResourceState asc", + "size": 1, + "title": "Backup Items by Resource State", + "noDataMessage": "No BackupItems were found in the selected scope", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "piechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "vaultId", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + } + ] + }, + "tileSettings": { + "titleContent": { + "columnMatch": "ProtectionState", + "formatter": 1, + "formatOptions": { + "showIcon": true, + "workbookContext": null + } + }, + "subtitleContent": { + "columnMatch": "ResourceState", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "BackupItems", + "formatter": 12, + "formatOptions": { + "showIcon": true, + "workbookContext": null + } + }, + "showBorder": true + }, + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "VM Active", + "color": "green" + }, + { + "seriesName": "VM Not Found", + "color": "redBright" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + { + "parameterName": "SummarySelectedItem", + "comparison": "isEqualTo", + "value": "Backup Items" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + "customWidth": "0", + "name": "BackupItemsByResourceState" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupjobs\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| where todatetime(properties.startTime) {TimeRange}\r\n| where properties.status != \"InProgress\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupJobs.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend SubText = \"Jobs\"\r\n| summarize c=count() by status = tostring(properties.status)\r\n| sort by status asc\r\n", + "size": 1, + "title": "Jobs by Status", + "noDataMessage": "No jobs were found in the selected scope and time range", + "exportParameterName": "SummaryJobStatus", + "exportDefaultValue": "*", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "piechart", + "tileSettings": { + "titleContent": { + "columnMatch": "status", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubText", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "c", + "formatter": 12, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + }, + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "Completed", + "color": "green" + }, + { + "seriesName": "Failed", + "color": "redBright" + }, + { + "seriesName": "CompletedWithWarnings", + "color": "yellow" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + { + "parameterName": "SummarySelectedItem", + "comparison": "isEqualTo", + "value": "Backup Jobs" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + "customWidth": "0", + "name": "JobsByStatus" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupjobs\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| where todatetime(properties.startTime) {TimeRange}\r\n| where properties.status != \"InProgress\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupJobs.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| where tostring(properties.status) == tostring(parse_json('{SummaryJobStatus}').label) or '{SummaryJobStatus}' contains \"*\"\r\n| extend SubText = \"Jobs\"\r\n| summarize c=count() by operation = tostring(properties.operation)\r\n| sort by operation asc\r\n", + "size": 1, + "title": "Jobs by Operation", + "noDataMessage": "No jobs were found in the selected scope and time range", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "piechart", + "tileSettings": { + "titleContent": { + "columnMatch": "status", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubText", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "c", + "formatter": 12, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + }, + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "Backup", + "color": "green" + }, + { + "seriesName": "DeleteBackupData", + "color": "redBright" + }, + { + "seriesName": "ConfigureBackup", + "color": "turquoise" + }, + { + "seriesName": "Restore", + "color": "lightBlue" + }, + { + "seriesName": "DisableBackup", + "color": "red" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + { + "parameterName": "SummarySelectedItem", + "comparison": "isEqualTo", + "value": "Backup Jobs" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + "customWidth": "0", + "name": "JobsByOperation" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/alerts\"\r\n| where properties.sourceType == \"IaaSVM\"\r\n| where todatetime(properties.initialOccurrenceTime) {TimeRange}\r\n| extend vaultId = tolower(replace(\"\\\\/alerts.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend SubText = \"Alerts\", severity = iff(tolong(properties.severity) == 1, \"Critical\", iff(tolong(properties.severity) == 2, \"Warining\", \"Info\"))\r\n| summarize c=count() by severity\r\n| sort by severity\r\n", + "size": 4, + "title": "Alerts by Severity", + "noDataMessage": "No alerts were found in the selected scope and time range", + "exportParameterName": "SummaryAlertSeverity", + "exportDefaultValue": "*", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "piechart", + "tileSettings": { + "titleContent": { + "columnMatch": "severity", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubText", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "c", + "formatter": 12, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + }, + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "Critical", + "color": "redBright" + }, + { + "seriesName": "Warning", + "color": "yellow" + }, + { + "seriesName": "Info", + "color": "blue" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + { + "parameterName": "SummarySelectedItem", + "comparison": "isEqualTo", + "value": "Backup Alerts" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + "customWidth": "0", + "name": "AlertsBySeverity" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/alerts\"\r\n| where properties.sourceType == \"IaaSVM\"\r\n| where todatetime(properties.initialOccurrenceTime) {TimeRange}\r\n| extend vaultId = tolower(replace(\"\\\\/alerts.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend SubText = \"Alerts\", severity = iff(tolong(properties.severity) == 1, \"Critical\", iff(tolong(properties.severity) == 2, \"Warining\", \"Info\"))\r\n| where severity == tostring(parse_json('{SummaryAlertSeverity}').label) or '{SummaryAlertSeverity}' contains \"*\"\r\n| summarize c=count() by AlertName = tostring(properties.alertTitle)\r\n| sort by AlertName\r\n", + "size": 4, + "title": "Alerts by Alert Type", + "noDataMessage": "No alerts were found in the selected scope and time range", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "piechart", + "tileSettings": { + "titleContent": { + "columnMatch": "severity", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubText", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "c", + "formatter": 12, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + }, + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "Delete Backup Data", + "color": "redBright" + }, + { + "seriesName": "Backup failure", + "color": "red" + }, + { + "seriesName": "Restore failure", + "color": "orange" + }, + { + "seriesName": "Backup completed with warnings", + "color": "yellow" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + { + "parameterName": "SummarySelectedItem", + "comparison": "isEqualTo", + "value": "Backup Alerts" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + "customWidth": "0", + "name": "AlertsByAlertType" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Resources\r\n| where type in (\"microsoft.compute/virtualmachines\", \"microsoft.classiccompute/virtualmachines\")\r\n| where tostring(hash(strcat(tolower(subscriptionId), tolower(resourceGroup), tolower(name)))) !in ({BackupItemHostHash})\r\n| project id, location\r\n| summarize c = count() by location\r\n| sort by c desc, location asc\r\n", + "size": 4, + "title": "Backup Not Enabled Machines by Location", + "exportParameterName": "SummaryNotEnabledLocation", + "exportDefaultValue": "*", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "piechart", + "tileSettings": { + "titleContent": { + "columnMatch": "severity", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubText", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "c", + "formatter": 12, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + }, + "chartSettings": { + "group": "location", + "createOtherGroup": 5 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + { + "parameterName": "SummarySelectedItem", + "comparison": "isEqualTo", + "value": "Backup Not Enabled" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + "customWidth": "0", + "name": "BackupNotEnabledMachineByLocation" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Resources\r\n| where type in (\"microsoft.compute/virtualmachines\", \"microsoft.classiccompute/virtualmachines\")\r\n| where tostring(hash(strcat(tolower(subscriptionId), tolower(resourceGroup), tolower(name)))) !in ({BackupItemHostHash})\r\n| where location == tostring(parse_json('{SummaryNotEnabledLocation}').label) or '{SummaryNotEnabledLocation}' contains \"*\" or '{SummaryNotEnabledLocation}' contains \"Other\"\r\n| project id, resourceGroup\r\n| summarize c = count() by resourceGroup\r\n| sort by c desc, resourceGroup asc\r\n", + "size": 4, + "title": "Backup Not Enabled Machines by Resource Group", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "piechart", + "tileSettings": { + "titleContent": { + "columnMatch": "severity", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubText", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "c", + "formatter": 12, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + }, + "chartSettings": { + "group": "resourceGroup", + "createOtherGroup": 5 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + { + "parameterName": "SummarySelectedItem", + "comparison": "isEqualTo", + "value": "Backup Not Enabled" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Summary" + }, + "customWidth": "0", + "name": "BackupNotEnabledMachinesByResourceGroup" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "a29464c3-34f0-4d60-82bb-614b8128b7f9", + "version": "KqlParameterItem/1.0", + "name": "BackupItemName", + "label": "Search Item or RG", + "type": 1, + "description": "Use to filter by BackupItem or Resource Group.
To filter for a specific item in a specific resource group use <resourceGroup>;<backupItem>", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "" + }, + { + "id": "db5ab575-14f6-44d0-bbb9-71c59d0d86b2", + "version": "KqlParameterItem/1.0", + "name": "PolicyName", + "label": "Search Vault or Policy", + "type": 1, + "description": "Use to filter by Vault or Policy Name.
To filter by a policy within a vault use <Vault>;<Policy>", + "value": "", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "2fd2f893-b2e3-44d8-9326-5f6b9564b3c4", + "version": "KqlParameterItem/1.0", + "name": "ProtectionState", + "label": "Protection State", + "type": 2, + "description": "Use to filter by Protection State of the Backup Item", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Actively Protected\", \"label\":\"Actively Protected\" },\r\n { \"value\":\"Protection Stopped\", \"label\":\"Protection Stopped\" },\r\n { \"value\":\"Initial Backup Pending\", \"label\":\"Initial Backup Pending\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "ad30973f-5071-4ce4-9f2b-df9a93955879", + "version": "KqlParameterItem/1.0", + "name": "ResourceState", + "label": "Resource State", + "type": 2, + "description": "Use to filter by the current state of the resource being backed up", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"VM Active\", \"label\":\"VM Active\" },\r\n { \"value\":\"VM Not Found\", \"label\":\"VM Not Found\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "4c20879b-cb6e-4c9c-8923-0af5a1c063bd", + "version": "KqlParameterItem/1.0", + "name": "InDeferredDelete", + "label": "Soft-deleted?", + "type": 2, + "description": "Use to filter for Soft-Deleted Backup Items", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Yes\", \"label\":\"Yes\" },\r\n { \"value\":\"No\", \"label\":\"No\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "2a76174a-d5a5-41bb-99d2-9d2fce0e3167", + "version": "KqlParameterItem/1.0", + "name": "HealthCheck", + "label": "Health Check Status", + "type": 2, + "description": "Use to filter by Health Check Status of the Backup Item", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Passed\", \"label\":\"Passed\" },\r\n { \"value\":\"ActionRequired\", \"label\":\"ActionRequired\" },\r\n { \"value\":\"ActionSuggested\", \"label\":\"ActionSuggested\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "ee5b73b4-8354-47fa-b98f-e4bd20332298", + "version": "KqlParameterItem/1.0", + "name": "LastBackup", + "label": "Last Backup Status", + "type": 2, + "description": "Use to filter by status of the last Backup Job for each each Backup Item", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Completed\", \"label\":\"Completed\" },\r\n { \"value\":\"CompletedWithWarnings\", \"label\":\"CompletedWithWarnings\" },\r\n { \"value\":\"Failed\", \"label\":\"Failed\" },\r\n { \"value\":\"Unknown\", \"label\":\"Unknown\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "dd894ccd-2ec7-456b-941a-f3ca616ad9e3", + "version": "KqlParameterItem/1.0", + "name": "MinDailyRetention", + "type": 1, + "description": "Specify minimum number of days the daily backup is retained in the vault. Use zero to view rows with no daily retention.", + "isRequired": true, + "value": "0", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "label": "Min Daily Retention" + }, + { + "id": "1fc96995-297e-476d-8964-83b0d0e3687c", + "version": "KqlParameterItem/1.0", + "name": "MaxDailyRetention", + "type": 1, + "description": "Specify maximum number of days the daily backup is retained in the vault", + "isRequired": true, + "value": "3650", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "label": "Max Daily Retention" + }, + { + "id": "1d767e68-5daf-4741-afa5-1dd017d68ba2", + "version": "KqlParameterItem/1.0", + "name": "SnapshotRetention", + "type": 2, + "description": "To filter by number of days the backup snapshot is retained for fast restores. Use zero to view rows with no snapshot retention.", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"0\", \"label\":\"0\" },\r\n { \"value\":\"1\", \"label\":\"1\" },\r\n { \"value\":\"2\", \"label\":\"2\" },\r\n { \"value\":\"3\", \"label\":\"3\" },\r\n { \"value\":\"4\", \"label\":\"4\" },\r\n { \"value\":\"5\", \"label\":\"5\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "label": "Snapshot Retention Days" + }, + { + "id": "2cdfb760-6c7c-4eab-a653-581a04640397", + "version": "KqlParameterItem/1.0", + "name": "BackupItemPageNumber", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupFabrics.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend a = split(tolower(tostring(properties.containerName)),\";\")\r\n| extend a = iff(array_length(a) == 4, tostring(hash(strcat(tolower(subscriptionId), tostring(a[2]), tostring(a[3])))), tostring(hash(strcat(tolower(subscriptionId), tostring(a[1]), tostring(a[2])))))\r\n| extend ResourceState = iff(a in ({VMHash}), \"VM Active\", \"VM Not Found\")\r\n| project backupItemId = id,\r\n\t\t Name = replace(\"iaasvmcontainer;\",\"\",replace(\"iaasvmcontainerv2;\",\"\",tolower(tostring(properties.containerName)))),\r\n ProtectionState = iff(tostring(properties.protectionState) == \"IRPending\", \"Initial Backup Pending\", iff(tostring(properties.protectionState) == \"Protected\", \"Actively Protected\", iff(tostring(properties.protectionState) == \"ProtectionStopped\", \"Protection Stopped\", \"Actively Protected\"))),\r\n ResourceState,\r\n\t\t InDeferredDelete = iff(tostring(properties.isScheduledForDeferredDelete) == \"true\", \"Yes\", \"No\"),\r\n\t\t HealthCheck = tostring(properties.healthStatus),\r\n\t\t LastBackup = iff(isempty(tostring(properties.lastBackupStatus)),\"Unknown\",tostring(properties.lastBackupStatus)), \r\n\t\t LastBackupTime = properties.lastBackupTime,\r\n LastRecoveryPoint = properties.lastRecoveryPoint,\r\n\t\t backupItemHostId = properties.sourceResourceId,\r\n\t\t Host = iff(tostring(properties.protectedItemType) contains \"classic\", \"Classic VM\", \"VM\"),\r\n\t\t policyId = tolower(tostring(properties.policyId)),\r\n\t\t vaultId = replace(\"\\\\/backupFabrics.*\",\"\",id),\r\n VaultName = replace(\".*\\\\/vaults\\\\/\",\"\",replace(\"\\\\/backupFabrics.*\",\"\",id)),\r\n\t\t PolicyName = tostring(properties.policyName),\r\n\t\t deferredDeleteTimeInUTC = properties.deferredDeleteTimeInUTC, \r\n\t\t deferredDeleteTimeRemaining = properties.deferredDeleteTimeRemaining, \r\n\t\t healthDetails = properties.healthDetails\r\n| where Name contains (@\"{BackupItemName}\") \r\n| where strcat(VaultName,\";\",PolicyName) contains (@\"{PolicyName}\")\r\n| where ProtectionState == \"{ProtectionState}\" or strcat(ProtectionState,\"{ProtectionState}\") contains \"All\"\r\n| where ResourceState == \"{ResourceState}\" or strcat(ResourceState,\"{ResourceState}\") contains \"All\"\r\n| where InDeferredDelete == \"{InDeferredDelete}\" or strcat(InDeferredDelete,\"{InDeferredDelete}\") contains \"All\"\r\n| where HealthCheck == \"{HealthCheck}\" or strcat(HealthCheck,\"{HealthCheck}\") contains \"All\"\r\n| where LastBackup == \"{LastBackup}\" or strcat(LastBackup,\"{LastBackup}\") contains \"All\"\r\n| join kind = leftouter (\r\n\tRecoveryServicesResources\r\n\t| where type == \"microsoft.recoveryservices/vaults/backuppolicies\"\r\n\t| where properties.backupManagementType == \"AzureIaasVM\"\r\n\t| extend policyId = tolower(id)\r\n\t| project policyId, DailyRetention = tostring(properties.retentionPolicy.dailySchedule.retentionDuration.['count']),\r\n\t InstantRpRetention = iff(isempty(tostring(properties.instantRpRetentionRangeInDays)), \"2\", tostring(properties.instantRpRetentionRangeInDays)), schedulePolicy = properties.schedulePolicy, retentionPolicy = properties.retentionPolicy \r\n) on policyId\r\n| project backupItemId,\r\n\t\t Name,\r\n Item = tostring(split(Name,\";\")[1]),\r\n ResourceGroup = tostring(split(Name,\";\")[0]),\r\n ProtectionState,\r\n ResourceState,\r\n\t\t InDeferredDelete,\r\n\t\t HealthCheck,\r\n\t\t LastBackup, \r\n\t\t LastBackupTime = todatetime(LastBackupTime),\r\n LastRecoveryPoint = todatetime(LastRecoveryPoint),\r\n\t\t Host = iff(ResourceState == \"VM Active\",backupItemHostId,\"\"),\r\n\t\t DailyRetention,\r\n\t\t InstantRpRetention,\r\n\t\t PolicyName,\r\n\t\t vaultId,\r\n\t\t Info = \"Details\",\r\n\t\t InfoDetails = pack(\"deferredDeleteTimeInUTC\",deferredDeleteTimeInUTC,\"deferredDeleteTimeRemaining\",deferredDeleteTimeRemaining,\"healthDetails\",healthDetails,\"schedulePolicy\",schedulePolicy,\"retentionPolicy\",retentionPolicy,\"InstantRpRetentionInDays\",tolong(InstantRpRetention))\r\n| where (tolong(DailyRetention) >= {MinDailyRetention} and tolong(DailyRetention) <= {MaxDailyRetention}) or (isempty(DailyRetention) and tolong({MinDailyRetention}) <= 0)\r\n| where InstantRpRetention == \"{SnapshotRetention}\" or strcat(InstantRpRetention,\"{SnapshotRetention}\") contains \"All\" or (isempty(InstantRpRetention) and strcat(InstantRpRetention,\"{SnapshotRetention}\") contains \"0\")\r\n| summarize c = count()\r\n| project num = (c-1)/{RowsPerPage} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Backup Items" + }, + { + "parameterName": "BackupItemView", + "comparison": "isEqualTo", + "value": "Enhanced" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Backup Items" + }, + "customWidth": "100", + "name": "BackupItemsAdvancedParameterBlock" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupFabrics.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend a = split(tolower(tostring(properties.containerName)),\";\")\r\n| extend a = iff(array_length(a) == 4, tostring(hash(strcat(tolower(subscriptionId), tostring(a[2]), tostring(a[3])))), tostring(hash(strcat(tolower(subscriptionId), tostring(a[1]), tostring(a[2])))))\r\n| extend ResourceState = iff(a in ({VMHash}), \"VM Active\", \"VM Not Found\")\r\n| project backupItemId = id,\r\n\t\t Name = replace(\"iaasvmcontainer;\",\"\",replace(\"iaasvmcontainerv2;\",\"\",tolower(tostring(properties.containerName)))),\r\n ProtectionState = iff(tostring(properties.protectionState) == \"IRPending\", \"Initial Backup Pending\", iff(tostring(properties.protectionState) == \"Protected\", \"Actively Protected\", iff(tostring(properties.protectionState) == \"ProtectionStopped\", \"Protection Stopped\", \"Actively Protected\"))),\r\n ResourceState,\r\n\t\t InDeferredDelete = iff(tostring(properties.isScheduledForDeferredDelete) == \"true\", \"Yes\", \"No\"),\r\n\t\t HealthCheck = tostring(properties.healthStatus),\r\n\t\t LastBackup = iff(isempty(tostring(properties.lastBackupStatus)),\"Unknown\",tostring(properties.lastBackupStatus)), \r\n\t\t LastBackupTime = properties.lastBackupTime,\r\n LastRecoveryPoint = properties.lastRecoveryPoint,\r\n\t\t backupItemHostId = properties.sourceResourceId,\r\n\t\t Host = iff(tostring(properties.protectedItemType) contains \"classic\", \"Classic VM\", \"VM\"),\r\n\t\t policyId = tolower(tostring(properties.policyId)),\r\n\t\t vaultId = replace(\"\\\\/backupFabrics.*\",\"\",id),\r\n VaultName = replace(\".*\\\\/vaults\\\\/\",\"\",replace(\"\\\\/backupFabrics.*\",\"\",id)),\r\n\t\t PolicyName = tostring(properties.policyName),\r\n\t\t deferredDeleteTimeInUTC = properties.deferredDeleteTimeInUTC, \r\n\t\t deferredDeleteTimeRemaining = properties.deferredDeleteTimeRemaining, \r\n\t\t healthDetails = properties.healthDetails\r\n| where Name contains (@\"{BackupItemName}\") \r\n| where strcat(VaultName,\";\",PolicyName) contains (@\"{PolicyName}\")\r\n| where ProtectionState == \"{ProtectionState}\" or strcat(ProtectionState,\"{ProtectionState}\") contains \"All\"\r\n| where ResourceState == \"{ResourceState}\" or strcat(ResourceState,\"{ResourceState}\") contains \"All\"\r\n| where InDeferredDelete == \"{InDeferredDelete}\" or strcat(InDeferredDelete,\"{InDeferredDelete}\") contains \"All\"\r\n| where HealthCheck == \"{HealthCheck}\" or strcat(HealthCheck,\"{HealthCheck}\") contains \"All\"\r\n| where LastBackup == \"{LastBackup}\" or strcat(LastBackup,\"{LastBackup}\") contains \"All\"\r\n| join kind = leftouter (\r\n\tRecoveryServicesResources\r\n\t| where type == \"microsoft.recoveryservices/vaults/backuppolicies\"\r\n\t| where properties.backupManagementType == \"AzureIaasVM\"\r\n\t| extend policyId = tolower(id)\r\n\t| project policyId, DailyRetention = tostring(properties.retentionPolicy.dailySchedule.retentionDuration.['count']),\r\n\t InstantRpRetention = iff(isempty(tostring(properties.instantRpRetentionRangeInDays)), \"2\", tostring(properties.instantRpRetentionRangeInDays)), schedulePolicy = properties.schedulePolicy, retentionPolicy = properties.retentionPolicy \r\n) on policyId\r\n| project backupItemId,\r\n\t\t Name,\r\n Item = tostring(split(Name,\";\")[1]),\r\n ResourceGroup = tostring(split(Name,\";\")[0]),\r\n ProtectionState,\r\n\t\t InDeferredDelete,\r\n\t\t HealthCheck,\r\n\t\t LastBackup, \r\n\t\t LastBackupTime = todatetime(LastBackupTime),\r\n LastRecoveryPoint = todatetime(LastRecoveryPoint),\r\n ResourceState,\r\n\t\t Host = iff(ResourceState == \"VM Active\",backupItemHostId,\"\"),\r\n\t\t DailyRetention,\r\n\t\t InstantRpRetention,\r\n\t\t PolicyName,\r\n\t\t vaultId,\r\n\t\t Info = \"Details\",\r\n\t\t InfoDetails = pack(\"deferredDeleteTimeInUTC\",deferredDeleteTimeInUTC,\"deferredDeleteTimeRemaining\",deferredDeleteTimeRemaining,\"healthDetails\",healthDetails,\"schedulePolicy\",schedulePolicy,\"retentionPolicy\",retentionPolicy,\"InstantRpRetentionInDays\",tolong(InstantRpRetention))\r\n| where (tolong(DailyRetention) >= {MinDailyRetention} and tolong(DailyRetention) <= {MaxDailyRetention}) or (isempty(DailyRetention) and tolong({MinDailyRetention}) <= 0)\r\n| where InstantRpRetention == \"{SnapshotRetention}\" or strcat(InstantRpRetention,\"{SnapshotRetention}\") contains \"All\" or (isempty(InstantRpRetention) and strcat(InstantRpRetention,\"{SnapshotRetention}\") contains \"0\")\r\n| sort by tolower(Item) asc, backupItemId asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{RowsPerPage} + 1))\r\n| where page_num has ('{BackupItemPageNumber}') or '*' in ('{BackupItemPageNumber}')", + "size": 3, + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "backupItemId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Item", + "formatter": 16, + "formatOptions": { + "linkColumn": "backupItemId", + "linkTarget": "Resource", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Item" + } + }, + { + "columnMatch": "ResourceGroup", + "formatter": 14, + "formatOptions": { + "linkTarget": null, + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Resource Group of the Backup Item" + } + }, + { + "columnMatch": "ProtectionState", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Stopped", + "representation": "disabled", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Protected", + "representation": "Blank", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Pending", + "representation": "pending", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + }, + "tooltipFormat": { + "tooltip": "Protection State of the Backup Item" + } + }, + { + "columnMatch": "InDeferredDelete", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Whether the Backup Item is in soft-deleted state or not" + } + }, + { + "columnMatch": "HealthCheck", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Passed", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "ActionSuggested", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "ActionRequired", + "representation": "critical", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + }, + "tooltipFormat": { + "tooltip": "Health Check Status of the Backup Item" + } + }, + { + "columnMatch": "LastBackup", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Status of the last backup job on the Backup Item" + } + }, + { + "columnMatch": "LastBackupTime", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "dateFormat": { + "showUtcTime": true, + "formatName": "shortDateTimePattern" + } + }, + { + "columnMatch": "LastRecoveryPoint", + "formatter": 6, + "formatOptions": { + "showIcon": true + }, + "dateFormat": { + "showUtcTime": true, + "formatName": "shortDateTimePattern" + }, + "tooltipFormat": { + "tooltip": "Latest Recovery Point of the Backup Item" + } + }, + { + "columnMatch": "ResourceState", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": " Active", + "representation": "Blank", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Not Found", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + }, + "tooltipFormat": { + "tooltip": "State of the Resource being backed up" + } + }, + { + "columnMatch": "Host", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Link to the Azure VM being backed up" + } + }, + { + "columnMatch": "DailyRetention", + "formatter": 2, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Number of days the daily backup is retained in the vault" + } + }, + { + "columnMatch": "InstantRpRetention", + "formatter": 2, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Number of days the backup snapshot is retained for fast restores" + } + }, + { + "columnMatch": "PolicyName", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Policy associated with the Backup Item" + } + }, + { + "columnMatch": "vaultId", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Vault associated with the Backup Item" + } + }, + { + "columnMatch": "Info", + "formatter": 1, + "formatOptions": { + "linkColumn": "InfoDetails", + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "More details about the Backup Item" + } + }, + { + "columnMatch": "InfoDetails", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "row_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "page_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "backupItemHostId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 1000, + "labelSettings": [ + { + "columnId": "Item", + "label": "Backup Item" + }, + { + "columnId": "ResourceGroup", + "label": "Resource Group" + }, + { + "columnId": "ProtectionState", + "label": "Protection State" + }, + { + "columnId": "InDeferredDelete", + "label": "Soft-Deleted?" + }, + { + "columnId": "HealthCheck", + "label": "Health Check Status" + }, + { + "columnId": "LastBackup", + "label": "Last Backup Status" + }, + { + "columnId": "LastBackupTime", + "label": "Last Backup Time [UTC]" + }, + { + "columnId": "LastRecoveryPoint", + "label": "Latest Recovery Point [UTC]" + }, + { + "columnId": "ResourceState", + "label": "Resource State" + }, + { + "columnId": "Host", + "label": "Azure Resource" + }, + { + "columnId": "DailyRetention", + "label": "Daily Retention" + }, + { + "columnId": "InstantRpRetention", + "label": "Snapshot Retention" + }, + { + "columnId": "PolicyName", + "label": "Policy" + }, + { + "columnId": "vaultId", + "label": "Vault" + }, + { + "columnId": "row_num" + }, + { + "columnId": "page_num" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Backup Items" + }, + { + "parameterName": "BackupItemView", + "comparison": "isEqualTo", + "value": "Enhanced" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Backup Items" + }, + "showPin": true, + "name": "BackupItemsAdvanced", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "showBorder": true + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "a29464c3-34f0-4d60-82bb-614b8128b7f9", + "version": "KqlParameterItem/1.0", + "name": "BackupItemName", + "label": "Search Item or RG", + "type": 1, + "description": "Use to filter by Backup Item or Resource Group.
To filter for a specific item in a specific resource group use <resourceGroup>;<backupItem>", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "" + }, + { + "id": "db5ab575-14f6-44d0-bbb9-71c59d0d86b2", + "version": "KqlParameterItem/1.0", + "name": "PolicyName", + "label": "Search Vault", + "type": 1, + "description": "Use to filter by Vault", + "value": "", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "2fd2f893-b2e3-44d8-9326-5f6b9564b3c4", + "version": "KqlParameterItem/1.0", + "name": "ProtectionState", + "label": "Protection State", + "type": 2, + "description": "Use to filter by Protection State of the Backup Item", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Actively Protected\", \"label\":\"Actively Protected\" },\r\n { \"value\":\"Protection Stopped\", \"label\":\"Protection Stopped\" },\r\n { \"value\":\"Initial Backup Pending\", \"label\":\"Initial Backup Pending\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "ad30973f-5071-4ce4-9f2b-df9a93955879", + "version": "KqlParameterItem/1.0", + "name": "ResourceState", + "label": "Resource State", + "type": 2, + "description": "Use to filter by the current state of the resource being backed up", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"VM Active\", \"label\":\"VM Active\" },\r\n { \"value\":\"VM Not Found\", \"label\":\"VM Not Found\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "2a76174a-d5a5-41bb-99d2-9d2fce0e3167", + "version": "KqlParameterItem/1.0", + "name": "HealthCheck", + "label": "Health Check Status", + "type": 2, + "description": "Use to filter by Health Check Status of the Backup Item", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Passed\", \"label\":\"Passed\" },\r\n { \"value\":\"ActionRequired\", \"label\":\"ActionRequired\" },\r\n { \"value\":\"ActionSuggested\", \"label\":\"ActionSuggested\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "41c16426-7f19-4cbc-b72d-f65aaee5c034", + "version": "KqlParameterItem/1.0", + "name": "BackupItemPageNumber", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupFabrics.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend a = split(tolower(tostring(properties.containerName)),\";\")\r\n| extend a = iff(array_length(a) == 4, tostring(hash(strcat(tolower(subscriptionId), tostring(a[2]), tostring(a[3])))), tostring(hash(strcat(tolower(subscriptionId), tostring(a[1]), tostring(a[2])))))\r\n| extend ResourceState = iff(a in ({VMHash}), \"VM Active\", \"VM Not Found\")\r\n| project backupItemId = id,\r\n\t\t Name = replace(\"iaasvmcontainer;\",\"\",replace(\"iaasvmcontainerv2;\",\"\",tolower(tostring(properties.containerName)))),\r\n ProtectionState = iff(tostring(properties.protectionState) == \"IRPending\", \"Initial Backup Pending\", iff(tostring(properties.protectionState) == \"Protected\", \"Actively Protected\", iff(tostring(properties.protectionState) == \"ProtectionStopped\", \"Protection Stopped\", \"Actively Protected\"))),\r\n ResourceState,\r\n\t\t HealthCheck = tostring(properties.healthStatus),\r\n\t\t LastBackup = iff(isempty(tostring(properties.lastBackupStatus)),\"Unknown\",tostring(properties.lastBackupStatus)), \r\n\t\t LastBackupTime = properties.lastBackupTime,\r\n LastRecoveryPoint = properties.lastRecoveryPoint,\r\n\t\t backupItemHostId = properties.sourceResourceId,\r\n\t\t Host = iff(tostring(properties.protectedItemType) contains \"classic\", \"Classic VM\", \"VM\"),\r\n\t\t policyId = tolower(tostring(properties.policyId)),\r\n\t\t VaultName = replace(\".*\\\\/vaults\\\\/\",\"\",replace(\"\\\\/backupFabrics.*\",\"\",id)),\r\n\t\t vaultId = replace(\"\\\\/backupFabrics.*\",\"\",id)\r\n| where Name contains (@\"{BackupItemName}\") \r\n| where VaultName contains (@\"{PolicyName}\")\r\n| where ProtectionState == \"{ProtectionState}\" or strcat(ProtectionState,\"{ProtectionState}\") contains \"All\"\r\n| where ResourceState == \"{ResourceState}\" or strcat(ResourceState,\"{ResourceState}\") contains \"All\"\r\n| where HealthCheck == \"{HealthCheck}\" or strcat(HealthCheck,\"{HealthCheck}\") contains \"All\"\r\n| project backupItemId,\r\n\t\t Name,\r\n Item = tostring(split(Name,\";\")[1]),\r\n ResourceGroup = tostring(split(Name,\";\")[0]),\r\n ProtectionState,\r\n ResourceState,\r\n\t\t HealthCheck,\r\n\t\t LastBackup, \r\n\t\t LastBackupTime = todatetime(LastBackupTime),\r\n LastRecoveryPoint = todatetime(LastRecoveryPoint),\r\n\t\t Host = iff(ResourceState == \"VM Active\",backupItemHostId,\"\"),\r\n\t\t vaultId\r\n| summarize c = count()\r\n| project num = (c-1)/{RowsPerPage} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Backup Items" + }, + { + "parameterName": "BackupItemView", + "comparison": "isEqualTo", + "value": "Standard" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Backup Items" + }, + "customWidth": "100", + "name": "BackupItemsStandardParameterBlock" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupFabrics.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend a = split(tolower(tostring(properties.containerName)),\";\")\r\n| extend a = iff(array_length(a) == 4, tostring(hash(strcat(tolower(subscriptionId), tostring(a[2]), tostring(a[3])))), tostring(hash(strcat(tolower(subscriptionId), tostring(a[1]), tostring(a[2])))))\r\n| extend ResourceState = iff(a in ({VMHash}), \"VM Active\", \"VM Not Found\")\r\n| project backupItemId = id,\r\n\t\t Name = replace(\"iaasvmcontainer;\",\"\",replace(\"iaasvmcontainerv2;\",\"\",tolower(tostring(properties.containerName)))),\r\n ProtectionState = iff(tostring(properties.protectionState) == \"IRPending\", \"Initial Backup Pending\", iff(tostring(properties.protectionState) == \"Protected\", \"Actively Protected\", iff(tostring(properties.protectionState) == \"ProtectionStopped\", \"Protection Stopped\", \"Actively Protected\"))),\r\n ResourceState,\r\n\t\t HealthCheck = tostring(properties.healthStatus),\r\n\t\t LastBackup = iff(isempty(tostring(properties.lastBackupStatus)),\"Unknown\",tostring(properties.lastBackupStatus)), \r\n\t\t LastBackupTime = properties.lastBackupTime,\r\n LastRecoveryPoint = properties.lastRecoveryPoint,\r\n\t\t backupItemHostId = properties.sourceResourceId,\r\n\t\t Host = iff(tostring(properties.protectedItemType) contains \"classic\", \"Classic VM\", \"VM\"),\r\n\t\t policyId = tolower(tostring(properties.policyId)),\r\n\t\t VaultName = replace(\".*\\\\/vaults\\\\/\",\"\",replace(\"\\\\/backupFabrics.*\",\"\",id)),\r\n\t\t vaultId = replace(\"\\\\/backupFabrics.*\",\"\",id)\r\n| where Name contains (@\"{BackupItemName}\") \r\n| where VaultName contains (@\"{PolicyName}\")\r\n| where ProtectionState == \"{ProtectionState}\" or strcat(ProtectionState,\"{ProtectionState}\") contains \"All\"\r\n| where ResourceState == \"{ResourceState}\" or strcat(ResourceState,\"{ResourceState}\") contains \"All\"\r\n| where HealthCheck == \"{HealthCheck}\" or strcat(HealthCheck,\"{HealthCheck}\") contains \"All\"\r\n| project backupItemId,\r\n\t\t Name,\r\n Item = tostring(split(Name,\";\")[1]),\r\n ResourceGroup = tostring(split(Name,\";\")[0]),\r\n ProtectionState,\r\n\t\t HealthCheck,\r\n\t\t LastBackup, \r\n\t\t LastBackupTime = todatetime(LastBackupTime),\r\n LastRecoveryPoint = todatetime(LastRecoveryPoint),\r\n ResourceState,\r\n\t\t Host = iff(ResourceState == \"VM Active\",backupItemHostId,\"\"),\r\n\t\t vaultId\r\n| sort by tolower(Item) asc, backupItemId asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{RowsPerPage} + 1))\r\n| where page_num has ('{BackupItemPageNumber}') or '*' in ('{BackupItemPageNumber}')", + "size": 3, + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "backupItemId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Item", + "formatter": 16, + "formatOptions": { + "linkColumn": "backupItemId", + "linkTarget": "Resource", + "subTarget": "", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Item" + } + }, + { + "columnMatch": "ResourceGroup", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Resource Group of the Backup Item" + } + }, + { + "columnMatch": "ProtectionState", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Stopped", + "representation": "disabled", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Protected", + "representation": "Blank", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Pending", + "representation": "pending", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + }, + "tooltipFormat": { + "tooltip": "Protection State of the Backup Item" + } + }, + { + "columnMatch": "HealthCheck", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Passed", + "representation": "Blank", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "ActionSuggested", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "ActionRequired", + "representation": "critical", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + }, + "tooltipFormat": { + "tooltip": "Health Check Status of the Backup Item" + } + }, + { + "columnMatch": "LastBackup", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "LastBackupTime", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "dateFormat": { + "showUtcTime": true, + "formatName": "shortDateTimePattern" + } + }, + { + "columnMatch": "LastRecoveryPoint", + "formatter": 6, + "formatOptions": { + "showIcon": true + }, + "dateFormat": { + "showUtcTime": true, + "formatName": "shortDateTimePattern" + }, + "tooltipFormat": { + "tooltip": "Latest Recovery Point of the Backup Item" + } + }, + { + "columnMatch": "ResourceState", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Active", + "representation": "Blank", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Not Found", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + }, + "tooltipFormat": { + "tooltip": "State of the Resource being backed up" + } + }, + { + "columnMatch": "Host", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Link to the Azure VM being backed up" + } + }, + { + "columnMatch": "vaultId", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Vault associated with the Backup Item" + } + }, + { + "columnMatch": "row_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "page_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "PolicyName", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Policy associated with the Backup Item" + } + }, + { + "columnMatch": "backupItemHostId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 1000, + "labelSettings": [ + { + "columnId": "Item", + "label": "Backup Item" + }, + { + "columnId": "ResourceGroup", + "label": "Resource Group" + }, + { + "columnId": "ProtectionState", + "label": "Protection State" + }, + { + "columnId": "HealthCheck", + "label": "Health Check Status" + }, + { + "columnId": "LastBackup", + "label": "Last Backup Status" + }, + { + "columnId": "LastBackupTime", + "label": "Last Backup Time [UTC]" + }, + { + "columnId": "LastRecoveryPoint", + "label": "Latest Recovery Point [UTC]" + }, + { + "columnId": "ResourceState", + "label": "Resource State" + }, + { + "columnId": "Host", + "label": "Azure Resource" + }, + { + "columnId": "vaultId", + "label": "Vault" + }, + { + "columnId": "row_num" + }, + { + "columnId": "page_num" + } + ] + }, + "sortBy": [] + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Backup Items" + }, + { + "parameterName": "BackupItemView", + "comparison": "isEqualTo", + "value": "Standard" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Backup Items" + }, + "showPin": true, + "name": "BackupItemsStandard", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "showBorder": true + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "a29464c3-34f0-4d60-82bb-614b8128b7f9", + "version": "KqlParameterItem/1.0", + "name": "BackupItemName", + "label": "Search Item or RG", + "type": 1, + "description": "Use to filter by Backup Item and/or Resource Group", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "" + }, + { + "id": "2fd2f893-b2e3-44d8-9326-5f6b9564b3c4", + "version": "KqlParameterItem/1.0", + "name": "Operation", + "type": 2, + "description": "Use to filter by Job Operation", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Backup\", \"label\":\"Backup\" },\r\n { \"value\":\"Restore\", \"label\":\"Restore\" },\r\n { \"value\":\"ConfigureBackup\", \"label\":\"ConfigureBackup\" },\r\n { \"value\":\"DeleteBackupData\", \"label\":\"DeleteBackupData\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "ad30973f-5071-4ce4-9f2b-df9a93955879", + "version": "KqlParameterItem/1.0", + "name": "Status", + "type": 2, + "description": "Use to filter by Job Status", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Completed\", \"label\":\"Completed\" },\r\n { \"value\":\"CompletedWithWarnings\", \"label\":\"CompletedWithWarnings\" },\r\n { \"value\":\"Failed\", \"label\":\"Failed\" },\r\n { \"value\":\"Cancelled\", \"label\":\"Cancelled\" },\r\n { \"value\":\"InProgress\", \"label\":\"InProgress\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "Failed" + }, + { + "id": "2a76174a-d5a5-41bb-99d2-9d2fce0e3167", + "version": "KqlParameterItem/1.0", + "name": "Error", + "type": 2, + "description": "Use to filter by Job Error Code", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupjobs\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| where todatetime(properties.startTime) {TimeRange}\r\n| extend vaultId = tolower(replace(\"\\\\/backupJobs.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| where properties.entityFriendlyName contains (@\"{BackupItemName}\") \r\n| where tostring(properties.operation) == \"{Operation}\" or strcat(tostring(properties.operation),\"{Operation}\") contains \"All\"\r\n| where tostring(properties.status) == \"{Status}\" or strcat(tostring(properties.status),\"{Status}\") contains \"All\"\r\n| summarize by x = tostring(properties.errorDetails[0].errorTitle)\r\n| where isnotempty(x)\r\n| sort by x asc", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "All", + "showDefault": false + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "778135da-147b-4ea6-915e-218ff195521a", + "version": "KqlParameterItem/1.0", + "name": "JobPageNumber", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupjobs\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| where todatetime(properties.startTime) {TimeRange}\r\n| extend vaultId = tolower(replace(\"\\\\/backupJobs.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| where properties.entityFriendlyName contains (@\"{BackupItemName}\") \r\n| where tostring(properties.operation) == \"{Operation}\" or strcat(tostring(properties.operation),\"{Operation}\") contains \"All\"\r\n| where tostring(properties.status) == \"{Status}\" or strcat(tostring(properties.status),\"{Status}\") contains \"All\"\r\n| where tostring(properties.errorDetails[0].errorTitle) in ({Error}) or \"All\" in ({Error})\r\n| summarize c = count()\r\n| project num = (c-1)/{RowsPerPage} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 1, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Jobs" + }, + "customWidth": "100", + "name": "JobsParameterBlock", + "styleSettings": { + "margin": "-10px 0% 0% 0%" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupjobs\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| where todatetime(properties.startTime) {TimeRange}\r\n| extend vaultId = tolower(replace(\"\\\\/backupJobs.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| where properties.containerName contains (@\"{BackupItemName}\") \r\n| where tostring(properties.operation) == \"{Operation}\" or strcat(tostring(properties.operation),\"{Operation}\") contains \"All\"\r\n| where tostring(properties.status) == \"{Status}\" or strcat(tostring(properties.status),\"{Status}\") contains \"All\"\r\n| where tostring(properties.errorDetails[0].errorTitle) in ({Error}) or \"All\" in ({Error})\r\n| extend x = split(tolower(tostring(properties.containerName)),\";\")\r\n| extend y = array_length(x)\r\n| project Name = tostring(properties.entityFriendlyName),\r\n id = tolower(id),\r\n Operation = properties.operation,\r\n\t Status = properties.status,\r\n\t StartTime = todatetime(properties.startTime),\r\n\t Duration = format_timespan(todatetime(properties.endTime) - todatetime(properties.startTime),\"hh:mm:ss\"),\r\n\t\t Error = properties.errorDetails[0].errorTitle,\r\n\t\t errorDetails = pack(\"Error\",properties.errorDetails[0].errorTitle,\"ErrorString\",properties.errorDetails[0].errorString,\"Recommendations\",properties.errorDetails[0].recommendations),\r\n Host = \"VM\",\r\n vaultId,\r\n ContainerName = iff(y == 3, strcat(x[0],\";\",x[1],\";\",x[2]), iff(y == 4, strcat(x[1],\";\",x[2],\";\",x[3]), \"\") ),\r\n\t\t subscriptionId\r\n| project Name, jobId = id, Operation, Status, StartTime, Duration, Error, errorDetails, Host, vaultId,\t\t \r\n\t\t backupItemId = strcat(vaultId,\"/backupFabrics/Azure/protectionContainers/IaasVMContainer;\",ContainerName,\"/protectedItems/VM;\",ContainerName),\r\n\t\t backupItemHostId = strcat(\r\n\t\t replace(\"\\\\/resourcegroups.*\",\"\",id),\"/resourceGroups/\",tostring(split(ContainerName,\";\")[1]),\r\n\t\t \"/providers/Microsoft.\",\r\n\t\t iff(ContainerName contains \"iaasvmcontainerv2;\", \"Compute/virtualMachines/\", \"ClassicCompute/virtualMachines/\"), tostring(split(ContainerName,\";\")[2])),\r\n\t\t HostHash = hash(tolower(strcat(subscriptionId, tolower(tostring(split(ContainerName,\";\")[1])), tolower(tostring(split(ContainerName,\";\")[2]))))), ContainerName\r\n| project Name, jobId, Operation, Status, StartTime, Duration, Error, errorDetails, backupItemId = iff(ContainerName == \"\",\"\",backupItemId), Host = iff(HostHash in ({VMHash}), backupItemHostId, \"\"), vaultId\r\n| sort by tolower(Name) asc, jobId asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{RowsPerPage} + 1))\r\n| where page_num has ('{JobPageNumber}') or '*' in ('{JobPageNumber}')", + "size": 3, + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Name", + "formatter": 16, + "formatOptions": { + "linkColumn": "backupItemId", + "linkTarget": "Resource", + "subTarget": "", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Item" + } + }, + { + "columnMatch": "jobId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Operation", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Job Operation" + } + }, + { + "columnMatch": "Status", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Completed", + "representation": "Blank", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Failed", + "representation": "error", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "CompletedWithWarnings", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + }, + "tooltipFormat": { + "tooltip": "Job Status" + } + }, + { + "columnMatch": "StartTime", + "formatter": 6, + "formatOptions": { + "showIcon": true + }, + "dateFormat": { + "showUtcTime": true, + "formatName": "shortDateTimePattern" + }, + "tooltipFormat": { + "tooltip": "Start date and time of the job" + } + }, + { + "columnMatch": "Duration", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Job Duration" + } + }, + { + "columnMatch": "Error", + "formatter": 1, + "formatOptions": { + "linkColumn": "errorDetails", + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Error Details (if the job has failed)" + } + }, + { + "columnMatch": "errorDetails", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "backupItemId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Host", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Link to the Azure VM being backed up" + } + }, + { + "columnMatch": "vaultId", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Vault associated with the Backup Item" + } + }, + { + "columnMatch": "row_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "page_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "backupItemHostId", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 1000, + "labelSettings": [ + { + "columnId": "Name", + "label": "Backup Item" + }, + { + "columnId": "StartTime", + "label": "Start Time [UTC]" + }, + { + "columnId": "Duration", + "label": "Duration [hh:mm:ss]" + }, + { + "columnId": "Host", + "label": "Azure Resource" + }, + { + "columnId": "vaultId", + "label": "Vault" + } + ] + }, + "sortBy": [] + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Jobs" + }, + "showPin": true, + "name": "Jobs", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "showBorder": true + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "a29464c3-34f0-4d60-82bb-614b8128b7f9", + "version": "KqlParameterItem/1.0", + "name": "BackupItemName", + "label": "Search Item or RG", + "type": 1, + "description": "Use to filter by BackupItem or Resource Group.
To filter for a specific item in a specific resource group use <resourceGroup>;<backupItem>", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "2fd2f893-b2e3-44d8-9326-5f6b9564b3c4", + "version": "KqlParameterItem/1.0", + "name": "AlertName", + "label": "Alert Type", + "type": 2, + "description": "Use to filter by Type of Alert", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Backup failure\", \"label\":\"Backup failure\" },\r\n { \"value\":\"Restore failure\", \"label\":\"Restore failure\" },\r\n { \"value\":\"Delete Backup Data\", \"label\":\"Delete Backup Data\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "ad30973f-5071-4ce4-9f2b-df9a93955879", + "version": "KqlParameterItem/1.0", + "name": "Status", + "type": 2, + "description": "Use to filter by Alert Status", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"1\", \"label\":\"Active\" },\r\n { \"value\":\"2\", \"label\":\"Resolved\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "1" + }, + { + "id": "2a76174a-d5a5-41bb-99d2-9d2fce0e3167", + "version": "KqlParameterItem/1.0", + "name": "Severity", + "type": 2, + "description": "Use to filter by Alert Severity", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"1\", \"label\":\"Critical\" },\r\n { \"value\":\"2\", \"label\":\"Warning\" },\r\n { \"value\":\"3\", \"label\":\"Info\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "39fac540-0eff-4d71-9192-44e1880f713e", + "version": "KqlParameterItem/1.0", + "name": "AlertPageNumber", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/alerts\"\r\n| where properties.sourceType == \"IaaSVM\"\r\n| where todatetime(properties.initialOccurrenceTime) {TimeRange}\r\n| extend vaultId = tolower(replace(\"\\\\/alerts.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| where replace(\"iaasvmcontainer;\",\"\",replace(\"iaasvmcontainerv2;\",\"\",tostring(properties.firstLevelContainerId))) contains (@\"{BackupItemName}\") \r\n| where tostring(properties.alertTitle) == \"{AlertName}\" or strcat(tostring(properties.alertTitle),\"{AlertName}\") contains \"All\"\r\n| where tostring(properties.status) == \"{Status}\" or strcat(tostring(properties.status),\"{Status}\") contains \"All\"\r\n| where tostring(properties.severity) == \"{Severity}\" or strcat(tostring(properties.severity),\"{Severity}\") contains \"All\"\r\n| project backupItemId = strcat(vaultId,\"/backupFabrics/Azure/protectionContainers/IaasVMContainer;\",tostring(properties.firstLevelContainerId),\"/protectedItems/VM;\",tostring(properties.firstLevelContainerId)),\r\n Item = tostring(split(tostring(properties.firstLevelContainerId),\";\")[2]),\r\n ResourceGroup = tostring(split(tostring(properties.firstLevelContainerId),\";\")[1]),\r\n\t\t HostHash = hash(tolower(strcat(subscriptionId, tostring(split(tostring(properties.firstLevelContainerId),\";\")[1]), tostring(split(tostring(properties.firstLevelContainerId),\";\")[2])))),\r\n alertId = id, \r\n\t\t backupItemHostId = strcat(\r\n\t\t replace(\"\\\\/resourceGroups.*\",\"\",id),\"/resourceGroups/\",tostring(split(tostring(properties.firstLevelContainerId),\";\")[1]),\r\n\t\t \"/providers/Microsoft.\",\r\n\t\t iff(tostring(properties.firstLevelContainerId) contains \"iaasvmcontainerv2;\", \"Compute/virtualMachines/\", \"ClassicCompute/virtualMachines/\"), tostring(split(tostring(properties.firstLevelContainerId),\";\")[2])\r\n\t\t ),\r\n\t\t AlertName = tostring(properties.alertTitle),\r\n CreationTime = todatetime(properties.initialOccurrenceTime),\r\n\t\t Duration = replace(\"\\\\..*\",\"\",tostring(properties.duration)),\r\n\t\t Severity = iff(tolong(properties.severity) == 1, \"Critical\", iff(tolong(properties.severity) == 2, \"Warining\", \"Info\")),\r\n\t\t Status = iff(tolong(properties.status) == 1, \"Active\", \"Resolved\"),\r\n\t\t ResolutionTime = todatetime(properties.resolutionTime),\r\n\t\t vaultId\r\n| project backupItemId, Item, ResourceGroup, alertId, AlertName, CreationTime, Duration, Severity, Status, \r\n Host = iff(HostHash in ({VMHash}), backupItemHostId, \"\"), vaultId\r\n| summarize c = count()\r\n| project num = (c-1)/{RowsPerPage} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Alerts" + }, + "customWidth": "100", + "name": "AlertsParameterBlock", + "styleSettings": { + "margin": "-10px 0% 0% 0%" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/alerts\"\r\n| where properties.sourceType == \"IaaSVM\"\r\n| where todatetime(properties.initialOccurrenceTime) {TimeRange}\r\n| extend vaultId = tolower(replace(\"\\\\/alerts.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| where replace(\"iaasvmcontainer;\",\"\",replace(\"iaasvmcontainerv2;\",\"\",tostring(properties.firstLevelContainerId))) contains (@\"{BackupItemName}\") \r\n| where tostring(properties.alertTitle) == \"{AlertName}\" or strcat(tostring(properties.alertTitle),\"{AlertName}\") contains \"All\"\r\n| where tostring(properties.status) == \"{Status}\" or strcat(tostring(properties.status),\"{Status}\") contains \"All\"\r\n| where tostring(properties.severity) == \"{Severity}\" or strcat(tostring(properties.severity),\"{Severity}\") contains \"All\"\r\n| project backupItemId = strcat(vaultId,\"/backupFabrics/Azure/protectionContainers/IaasVMContainer;\",tostring(properties.firstLevelContainerId),\"/protectedItems/VM;\",tostring(properties.firstLevelContainerId)),\r\n Item = tostring(split(tostring(properties.firstLevelContainerId),\";\")[2]),\r\n ResourceGroup = tostring(split(tostring(properties.firstLevelContainerId),\";\")[1]),\r\n\t\t HostHash = hash(tolower(strcat(subscriptionId, tostring(split(tostring(properties.firstLevelContainerId),\";\")[1]), tostring(split(tostring(properties.firstLevelContainerId),\";\")[2])))),\r\n alertId = id, \r\n\t\t backupItemHostId = strcat(\r\n\t\t replace(\"\\\\/resourcegroups.*\",\"\",tolower(id)),\"/resourceGroups/\",tostring(split(tostring(properties.firstLevelContainerId),\";\")[1]),\r\n\t\t \"/providers/Microsoft.\",\r\n\t\t iff(tostring(properties.firstLevelContainerId) contains \"iaasvmcontainerv2;\", \"Compute/virtualMachines/\", \"ClassicCompute/virtualMachines/\"), tostring(split(tostring(properties.firstLevelContainerId),\";\")[2])\r\n\t\t ),\r\n\t\t AlertName = tostring(properties.alertTitle),\r\n CreationTime = todatetime(properties.initialOccurrenceTime),\r\n\t\t Duration = replace(\"\\\\..*\",\"\",tostring(properties.duration)),\r\n\t\t Severity = iff(tolong(properties.severity) == 1, \"Critical\", iff(tolong(properties.severity) == 2, \"Warining\", \"Info\")),\r\n\t\t Status = iff(tolong(properties.status) == 1, \"Active\", \"Resolved\"),\r\n\t\t ResolutionTime = todatetime(properties.resolutionTime),\r\n\t\t vaultId\r\n| project backupItemId, Item, ResourceGroup, alertId, AlertName, CreationTime, Duration, Severity, Status, \r\n Host = iff(HostHash in ({VMHash}), backupItemHostId, \"\"), vaultId\r\n| sort by Item asc, alertId asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{RowsPerPage} + 1))\r\n| where page_num has ('{AlertPageNumber}') or '*' in ('{AlertPageNumber}')", + "size": 3, + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "backupItemId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Item", + "formatter": 16, + "formatOptions": { + "linkColumn": "backupItemId", + "linkTarget": "Resource", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Item" + } + }, + { + "columnMatch": "ResourceGroup", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Resource Group of the Backup Item" + } + }, + { + "columnMatch": "alertId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "AlertName", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Alert Name" + } + }, + { + "columnMatch": "CreationTime", + "formatter": 6, + "formatOptions": { + "showIcon": true + }, + "dateFormat": { + "showUtcTime": true, + "formatName": "shortDateTimePattern" + }, + "tooltipFormat": { + "tooltip": "Alert Creation Time" + } + }, + { + "columnMatch": "Duration", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Alert Duration" + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Critical", + "representation": "4", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Warning", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Info", + "representation": "1", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + }, + "tooltipFormat": { + "tooltip": "Alert Severity" + } + }, + { + "columnMatch": "Status", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Active", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Resolved", + "representation": "Blank", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + }, + "tooltipFormat": { + "tooltip": "Alert Status" + } + }, + { + "columnMatch": "Host", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Link to the Azure VM being backed up" + } + }, + { + "columnMatch": "vaultId", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Vault associated with the Backup Item" + } + }, + { + "columnMatch": "row_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "page_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "a", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "linkColumn": "backupItemId", + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "backupItemHostId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ResolutionTime", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 1000, + "labelSettings": [ + { + "columnId": "Item", + "label": "Backup Item" + }, + { + "columnId": "ResourceGroup", + "label": "Resource Group" + }, + { + "columnId": "AlertName", + "label": "Alert Type" + }, + { + "columnId": "CreationTime", + "label": "Creation Time [UTC]" + }, + { + "columnId": "Duration", + "label": "Duration [hh:mm:ss]" + }, + { + "columnId": "Host", + "label": "Azure Resource" + }, + { + "columnId": "vaultId", + "label": "Vault" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Alerts" + }, + "showPin": true, + "name": "Alerts", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "showBorder": true + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "a29464c3-34f0-4d60-82bb-614b8128b7f9", + "version": "KqlParameterItem/1.0", + "name": "VMName", + "label": "Search Machine", + "type": 1, + "description": "Use to filter by Machine", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "6bfd6bdc-12c5-4e9d-9ed3-58fc3c790334", + "version": "KqlParameterItem/1.0", + "name": "Tags", + "label": "Search Tags", + "type": 1, + "description": "Use to filter by Resource Tags", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "6911ecd2-a87e-404e-b562-f8b8a6e4635b", + "version": "KqlParameterItem/1.0", + "name": "NotProtectedPageNumber", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "Resources\r\n| where type in (\"microsoft.compute/virtualmachines\", \"microsoft.classiccompute/virtualmachines\")\r\n| where tostring(hash(strcat(tolower(subscriptionId), tolower(resourceGroup), tolower(name)))) !in ({BackupItemHostHash})\r\n| where strcat(name,resourceGroup) contains (@\"{VMName}\") \r\n| where tostring(tags) contains ('{Tags}') \r\n| project id,\r\n Name = name,\r\n\t\t Type = replace(\"\\\\/virtualmachines\",\"\",replace(\"microsoft.\",\"\",type)),\r\n ResourceGroup = resourceGroup,\r\n\t\t Location = location,\r\n\t\t Tags = iff(isempty(tags),tags,\"Tags\"),\r\n TagDetails = tags,\r\n VmSize = iff(type == \"microsoft.classiccompute/virtualmachines\",properties.hardwareProfile.size, properties.hardwareProfile.vmSize),\r\n\t\t OsType = iff(type == \"microsoft.classiccompute/virtualmachines\", properties.storageProfile.operatingSystemDisk.operatingSystem, properties.storageProfile.osDisk.osType)\r\n| summarize c = count()\r\n| project num = (c-1)/{RowsPerPage} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Backup Not Enabled" + }, + "customWidth": "100", + "name": "BackupNotEnabledParameterBlock", + "styleSettings": { + "margin": "-10px 0% 0% 0%" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Resources\r\n| where type in (\"microsoft.compute/virtualmachines\", \"microsoft.classiccompute/virtualmachines\")\r\n| where tostring(hash(strcat(tolower(subscriptionId), tolower(resourceGroup), tolower(name)))) !in ({BackupItemHostHash})\r\n| where location in ({VMLocation}) or '*' in ({VMLocation})\r\n| where strcat(name,resourceGroup) contains (@\"{VMName}\") \r\n| where tostring(tags) contains ('{Tags}') \r\n| project id,\r\n Name = name,\r\n\t\t Type = replace(\"\\\\/virtualmachines\",\"\",replace(\"microsoft.\",\"\",type)),\r\n ResourceGroup = resourceGroup,\r\n\t\t Location = location,\r\n\t\t Tags = iff(isempty(tags),tags,\"Tags\"),\r\n TagDetails = tags,\r\n VmSize = iff(type == \"microsoft.classiccompute/virtualmachines\",properties.hardwareProfile.size, properties.hardwareProfile.vmSize),\r\n\t\t OsType = iff(type == \"microsoft.classiccompute/virtualmachines\", properties.storageProfile.operatingSystemDisk.operatingSystem, properties.storageProfile.osDisk.osType)\r\n| sort by Name asc, id asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{RowsPerPage} + 1))\r\n| where page_num has ('{NotProtectedPageNumber}') or '*' in ('{NotProtectedPageNumber}')\r\n", + "size": 3, + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the VM" + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": false + } + }, + { + "columnMatch": "Type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ResourceGroup", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Resource Group of the VM" + } + }, + { + "columnMatch": "Location", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Location of the VM" + } + }, + { + "columnMatch": "Tags", + "formatter": 1, + "formatOptions": { + "linkColumn": "TagDetails", + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Tags associated with the VM" + } + }, + { + "columnMatch": "TagDetails", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "VmSize", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Size of the VM" + } + }, + { + "columnMatch": "OsType", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "OS running on the VM" + } + }, + { + "columnMatch": "row_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "page_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 1000, + "sortBy": [ + { + "itemKey": "ResourceGroup", + "sortOrder": 1 + } + ], + "labelSettings": [ + { + "columnId": "id", + "label": "Name" + }, + { + "columnId": "Name", + "label": "VM Name" + }, + { + "columnId": "Type", + "label": "VM Type" + }, + { + "columnId": "ResourceGroup", + "label": "Resource Group" + }, + { + "columnId": "TagDetails", + "label": "Tag Details" + }, + { + "columnId": "VmSize", + "label": "VM Size" + }, + { + "columnId": "OsType", + "label": "OS Type" + } + ] + }, + "sortBy": [ + { + "itemKey": "ResourceGroup", + "sortOrder": 1 + } + ] + }, + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Backup Not Enabled" + }, + "showPin": true, + "name": "BackupNotEnabled", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "showBorder": true + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "db5ab575-14f6-44d0-bbb9-71c59d0d86b2", + "version": "KqlParameterItem/1.0", + "name": "PolicyName", + "label": "Search Vault or Policy", + "type": 1, + "description": "Use to filter by Vault or Policy name.
To filter for a specific policy in a specific vault use <vault>;<policy>", + "value": "", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "0588c964-1b62-424b-aef3-34f05435548a", + "version": "KqlParameterItem/1.0", + "name": "HasProtectedItems", + "label": "Has Protected Items?", + "type": 2, + "description": "Use to filter the results only for policies associated with one or more protected items", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Yes\", \"label\":\"Yes\" },\r\n { \"value\":\"No\", \"label\":\"No\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "2fd2f893-b2e3-44d8-9326-5f6b9564b3c4", + "version": "KqlParameterItem/1.0", + "name": "ScheduleFrequency", + "label": "Schedule Frequency", + "type": 2, + "description": "Use to filter by Backup Frequency of the policy", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Daily\", \"label\":\"Daily\" },\r\n { \"value\":\"Weekly\", \"label\":\"Weekly\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "0b064ac9-d8fa-4985-83e7-8f41dca55f02", + "version": "KqlParameterItem/1.0", + "name": "RetentionSchedule", + "label": "Retention Type", + "type": 2, + "description": "Use to filter policies where selected Retention Type has been defined", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"1 == 1\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"isnotempty(DailyRetention)\", \"label\":\"Daily\" },\r\n { \"value\":\"isnotempty(WeeklyRetention)\", \"label\":\"Weekly\" },\r\n { \"value\":\"isnotempty(MonthlyRetention)\", \"label\":\"Monthly\" },\r\n { \"value\":\"isnotempty(YearlyRetention)\", \"label\":\"Yearly\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "dd894ccd-2ec7-456b-941a-f3ca616ad9e3", + "version": "KqlParameterItem/1.0", + "name": "MinRetention", + "label": "Min Retention", + "type": 1, + "description": "Specify minimum number of days/weeks/months/years the backup is retained in the vault. Use MinMaxRetentionType filter to choose the RetentionType daily/weekly/monthly/yearly to apply the filter on. Use zero to not apply any filter on min retention irrespective of the choice of MinMaxRetentionType filter value", + "isRequired": true, + "value": "0", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "1fc96995-297e-476d-8964-83b0d0e3687c", + "version": "KqlParameterItem/1.0", + "name": "MaxRetention", + "label": "Max Retention", + "type": 1, + "description": "Specify maximum number of days/weeks/months/years the backup is retained in the vault. Use MinMaxRetentionType filter to choose the RetentionType daily/weekly/monthly/yearly to apply the filter on. Use a large value to not apply any filter on max retention", + "isRequired": true, + "value": "3650", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "4c20879b-cb6e-4c9c-8923-0af5a1c063bd", + "version": "KqlParameterItem/1.0", + "name": "RetentionFilterType", + "label": "Min Max Retention Filter Type", + "type": 2, + "description": "Use to specify on which retention type the min and max retention filters apply", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"Daily\", \"label\":\"Days\", \"selected\": true },\r\n { \"value\":\"Weekly\", \"label\":\"Weeks\" },\r\n { \"value\":\"Monthly\", \"label\":\"Months\" },\r\n { \"value\":\"Yearly\", \"label\":\"Years\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "1d767e68-5daf-4741-afa5-1dd017d68ba2", + "version": "KqlParameterItem/1.0", + "name": "SnapshotRetention", + "type": 2, + "description": "To filter by number of days the backup snapshot is retained for fast restores. Use zero to view rows with no snapshot retention.", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"0\", \"label\":\"0\" },\r\n { \"value\":\"1\", \"label\":\"1\" },\r\n { \"value\":\"2\", \"label\":\"2\" },\r\n { \"value\":\"3\", \"label\":\"3\" },\r\n { \"value\":\"4\", \"label\":\"4\" },\r\n { \"value\":\"5\", \"label\":\"5\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "label": "Snapshot Retention" + }, + { + "id": "ad30973f-5071-4ce4-9f2b-df9a93955879", + "version": "KqlParameterItem/1.0", + "name": "RunDays", + "label": "Scheduled day(s) of week", + "type": 1, + "description": "Filter for days of the week the backup is scheduled to run. Use when schedule frequency is weekly", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "26872b3b-57d6-4f51-8d2a-52bd24811f1b", + "version": "KqlParameterItem/1.0", + "name": "PolicyPageNumber", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "recoveryservicesresources\r\n| where type == \"microsoft.recoveryservices/vaults/backuppolicies\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupPolicies.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend PolicyId = tolower(id)\r\n| join kind = leftouter\r\n(\r\n recoveryservicesresources\r\n | where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n\t| where properties.backupManagementType == \"AzureIaasVM\"\r\n | summarize ProtectedItems = count() by PolicyId = tolower(tostring(properties.policyId))\r\n) on PolicyId\r\n| project id,\r\n PolicyName = replace(\".*\\\\/backupPolicies\\\\/\",\"\",id),\r\n\t\t vaultId,\r\n\t\t VaultName = replace(\".*\\\\/vaults\\\\/\",\"\",vaultId),\r\n\t\t ProtectedItems,\r\n RunTime = strcat(tostring(properties.schedulePolicy.scheduleRunTimes[0]),\" \",iff(isempty(tostring(properties.timeZone)),\"UTC\",tostring(properties.timeZone))),\r\n Frequency = tostring(properties.schedulePolicy.scheduleRunFrequency),\r\n RunDays = tostring(properties.schedulePolicy.scheduleRunDays),\r\n \t SnapshotRetention = iff(isempty(tostring(properties.instantRpRetentionRangeInDays)),\"2\",tostring(properties.instantRpRetentionRangeInDays)),\r\n DailyRetention = tostring(properties.retentionPolicy.dailySchedule.retentionDuration.['count']),\r\n WeeklyRetention = tostring(properties.retentionPolicy.weeklySchedule.retentionDuration.['count']),\r\n MonthlyRetention = tostring(properties.retentionPolicy.monthlySchedule.retentionDuration.['count']),\r\n YearlyRetention = tostring(properties.retentionPolicy.yearlySchedule.retentionDuration.['count']),\r\n\t\t Daily = \"Daily\", Weekly = \"Weekly\", Monthly = \"Monthly\", Yearly = \"Yearly\"\r\n| where strcat(VaultName,\";\",PolicyName) contains (@\"{PolicyName}\")\r\n| where (isnull(ProtectedItems) and \"{HasProtectedItems}\" == \"No\") or (isnotnull(ProtectedItems) and \"{HasProtectedItems}\" == \"Yes\") or (strcat(tostring(ProtectedItems),\"{HasProtectedItems}\") contains \"All\") \r\n| where Frequency == \"{ScheduleFrequency}\" or strcat(Frequency,\"{ScheduleFrequency}\") contains \"All\"\r\n| where {RetentionSchedule}\r\n| where ((Daily == \"{RetentionFilterType}\") and ((tolong(DailyRetention) >= {MinRetention} and tolong(DailyRetention) <= {MaxRetention}) \r\n or (isempty(DailyRetention) and tolong({MinRetention}) <= 0)))\r\n\tor \r\n\t ((Weekly == \"{RetentionFilterType}\") and ((tolong(WeeklyRetention) >= {MinRetention} and tolong(WeeklyRetention) <= {MaxRetention}) \r\n or (isempty(WeeklyRetention) and tolong({MinRetention}) <= 0)))\r\n\tor \r\n\t ((Monthly == \"{RetentionFilterType}\") and ((tolong(MonthlyRetention) >= {MinRetention} and tolong(MonthlyRetention) <= {MaxRetention}) \r\n or (isempty(MonthlyRetention) and tolong({MinRetention}) <= 0)))\r\n\tor \r\n\t ((Yearly == \"{RetentionFilterType}\") and ((tolong(YearlyRetention) >= {MinRetention} and tolong(YearlyRetention) <= {MaxRetention}) \r\n or (isempty(YearlyRetention) and tolong({MinRetention}) <= 0)))\r\n| where SnapshotRetention == \"{SnapshotRetention}\" or strcat(SnapshotRetention,\"{SnapshotRetention}\") contains \"All\" or (isempty(SnapshotRetention) and strcat(SnapshotRetention,\"{SnapshotRetention}\") contains \"0\")\r\n| where RunDays contains (@\"{RunDays}\")\r\n| project id, PolicyName, vaultId, ProtectedItems, RunTime, BackupFrequency = Frequency, RunDays, SnapshotRetention,\r\n DailyRetention = iff(isnotempty(DailyRetention),strcat(DailyRetention,\" days \"),DailyRetention),\r\n\t\t WeeklyRetention = iff(isnotempty(WeeklyRetention),strcat(WeeklyRetention,\" weeks \"),WeeklyRetention),\r\n\t\t MonthlyRetention = iff(isnotempty(MonthlyRetention),strcat(MonthlyRetention,\" months \"),MonthlyRetention),\r\n\t\t YearlyRetention = iff(isnotempty(YearlyRetention),strcat(YearlyRetention,\" years \"),YearlyRetention)\r\n| project id, PolicyName, vaultId, ProtectedItems, SnapshotRetention,\r\n MaxRetention = iff(isempty(YearlyRetention),iff(isempty(MonthlyRetention),iff(isempty(WeeklyRetention),DailyRetention,WeeklyRetention),MonthlyRetention),YearlyRetention),\r\n\t\t Retention = strcat(DailyRetention,WeeklyRetention,MonthlyRetention,YearlyRetention), RunTime, BackupFrequency, RunDays\r\n| summarize c = count()\r\n| project num = (c-1)/{RowsPerPage} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "bfe11186-998c-4f54-8e1d-6a58f0c3630a", + "version": "KqlParameterItem/1.0", + "name": "SelectedPolicyId", + "label": "Search Policy", + "type": 1, + "description": "Search by Policy", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + { + "parameterName": "PolicyView", + "comparison": "isEqualTo", + "value": "Enhanced" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + "customWidth": "100", + "name": "PoliciesAdvancedParameterBlock", + "styleSettings": { + "margin": "-10px 0% 0% 0%" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "recoveryservicesresources\r\n| where type == \"microsoft.recoveryservices/vaults/backuppolicies\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupPolicies.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend PolicyId = tolower(id)\r\n| join kind = leftouter\r\n(\r\n recoveryservicesresources\r\n | where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n\t| where properties.backupManagementType == \"AzureIaasVM\"\r\n | summarize ProtectedItems = count() by PolicyId = tolower(tostring(properties.policyId))\r\n) on PolicyId\r\n| project id,\r\n PolicyName = replace(\".*\\\\/backupPolicies\\\\/\",\"\",id),\r\n\t\t vaultId,\r\n\t\t VaultName = replace(\".*\\\\/vaults\\\\/\",\"\",vaultId),\r\n\t\t ProtectedItems,\r\n RunTime = strcat(replace(\":00\\\\.00.*\",\"\",replace(\".*T\",\"\",tostring(properties.schedulePolicy.scheduleRunTimes[0]))),\" \",iff(isempty(tostring(properties.timeZone)),\"UTC\",tostring(properties.timeZone))),\r\n Frequency = tostring(properties.schedulePolicy.scheduleRunFrequency),\r\n RunDays = tostring(properties.schedulePolicy.scheduleRunDays),\r\n \t SnapshotRetention = iff(isempty(tostring(properties.instantRpRetentionRangeInDays)),\"2\",tostring(properties.instantRpRetentionRangeInDays)),\r\n DailyRetention = tostring(properties.retentionPolicy.dailySchedule.retentionDuration.['count']),\r\n WeeklyRetention = tostring(properties.retentionPolicy.weeklySchedule.retentionDuration.['count']),\r\n MonthlyRetention = tostring(properties.retentionPolicy.monthlySchedule.retentionDuration.['count']),\r\n YearlyRetention = tostring(properties.retentionPolicy.yearlySchedule.retentionDuration.['count']),\r\n\t\t Daily = \"Daily\", Weekly = \"Weekly\", Monthly = \"Monthly\", Yearly = \"Yearly\"\r\n| where strcat(VaultName,\";\",PolicyName) contains (@\"{PolicyName}\")\r\n| where (isnull(ProtectedItems) and \"{HasProtectedItems}\" == \"No\") or (isnotnull(ProtectedItems) and \"{HasProtectedItems}\" == \"Yes\") or (strcat(tostring(ProtectedItems),\"{HasProtectedItems}\") contains \"All\") \r\n| where Frequency == \"{ScheduleFrequency}\" or strcat(Frequency,\"{ScheduleFrequency}\") contains \"All\"\r\n| where {RetentionSchedule}\r\n| where ((Daily == \"{RetentionFilterType}\") and ((tolong(DailyRetention) >= {MinRetention} and tolong(DailyRetention) <= {MaxRetention}) \r\n or (isempty(DailyRetention) and tolong({MinRetention}) <= 0)))\r\n\tor \r\n\t ((Weekly == \"{RetentionFilterType}\") and ((tolong(WeeklyRetention) >= {MinRetention} and tolong(WeeklyRetention) <= {MaxRetention}) \r\n or (isempty(WeeklyRetention) and tolong({MinRetention}) <= 0)))\r\n\tor \r\n\t ((Monthly == \"{RetentionFilterType}\") and ((tolong(MonthlyRetention) >= {MinRetention} and tolong(MonthlyRetention) <= {MaxRetention}) \r\n or (isempty(MonthlyRetention) and tolong({MinRetention}) <= 0)))\r\n\tor \r\n\t ((Yearly == \"{RetentionFilterType}\") and ((tolong(YearlyRetention) >= {MinRetention} and tolong(YearlyRetention) <= {MaxRetention}) \r\n or (isempty(YearlyRetention) and tolong({MinRetention}) <= 0)))\r\n| where SnapshotRetention == \"{SnapshotRetention}\" or strcat(SnapshotRetention,\"{SnapshotRetention}\") contains \"All\" or (isempty(SnapshotRetention) and strcat(SnapshotRetention,\"{SnapshotRetention}\") contains \"0\")\r\n| where RunDays contains (@\"{RunDays}\")\r\n| project id, PolicyName, vaultId, ProtectedItems, RunTime, BackupFrequency = Frequency, RunDays, SnapshotRetention,\r\n DailyRetention = iff(isnotempty(DailyRetention),strcat(DailyRetention,\" days \"),DailyRetention),\r\n\t\t WeeklyRetention = iff(isnotempty(WeeklyRetention),strcat(WeeklyRetention,\" weeks \"),WeeklyRetention),\r\n\t\t MonthlyRetention = iff(isnotempty(MonthlyRetention),strcat(MonthlyRetention,\" months \"),MonthlyRetention),\r\n\t\t YearlyRetention = iff(isnotempty(YearlyRetention),strcat(YearlyRetention,\" years \"),YearlyRetention)\r\n| project id, PolicyName, vaultId, ProtectedItems, SnapshotRetention,\r\n MaxRetention = iff(isempty(YearlyRetention),iff(isempty(MonthlyRetention),iff(isempty(WeeklyRetention),DailyRetention,WeeklyRetention),MonthlyRetention),YearlyRetention),\r\n\t\t Retention = strcat(DailyRetention,WeeklyRetention,MonthlyRetention,YearlyRetention), RunTime, BackupFrequency, RunDays\r\n| sort by ProtectedItems desc, tolower(PolicyName) asc, id asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{RowsPerPage} + 1))\r\n| where page_num has ('{PolicyPageNumber}') or '*' in ('{PolicyPageNumber}')", + "size": 3, + "exportFieldName": "id", + "exportParameterName": "SelectedPolicyId", + "exportDefaultValue": "*", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "PolicyName", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Policy" + } + }, + { + "columnMatch": "vaultId", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Vault associated with the Policy" + } + }, + { + "columnMatch": "ProtectedItems", + "formatter": 2, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Number of Protected Items associated with the Policy" + } + }, + { + "columnMatch": "SnapshotRetention", + "formatter": 2, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Number of days the backup snapshot is retained for fast restores, as per the Policy" + } + }, + { + "columnMatch": "MaxRetention", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Maximum amount of time a retention point can exist in the vault, whether it is a daily, weekly, monthly or yearly retention point" + } + }, + { + "columnMatch": "Retention", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Retention period as specified by the policy" + } + }, + { + "columnMatch": "RunTime", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Time at which the Policy is scheduled to run" + } + }, + { + "columnMatch": "BackupFrequency", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Frequency of backup as per the Policy" + } + }, + { + "columnMatch": "RunDays", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Days of the week on which the Policy is scheduled to run" + } + }, + { + "columnMatch": "row_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "page_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 1000, + "sortBy": [ + { + "itemKey": "SnapshotRetention", + "sortOrder": 1 + } + ], + "labelSettings": [ + { + "columnId": "PolicyName", + "label": "Policy" + }, + { + "columnId": "vaultId", + "label": "Vault" + }, + { + "columnId": "ProtectedItems", + "label": "# Protected Items" + }, + { + "columnId": "SnapshotRetention", + "label": "Snapshot Retention" + }, + { + "columnId": "MaxRetention", + "label": "Max Retention" + }, + { + "columnId": "Retention", + "label": "Retention [Daily Weekly Monthly Yearly]" + }, + { + "columnId": "RunTime", + "label": "Scheduled Time" + }, + { + "columnId": "BackupFrequency", + "label": "Backup Frequency" + }, + { + "columnId": "RunDays", + "label": "Scheduled Day(s) Of Week" + } + ] + }, + "sortBy": [ + { + "itemKey": "SnapshotRetention", + "sortOrder": 1 + } + ] + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + { + "parameterName": "PolicyView", + "comparison": "isEqualTo", + "value": "Enhanced" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + "showPin": true, + "name": "PoliciesAdvanced", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "showBorder": true + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "db5ab575-14f6-44d0-bbb9-71c59d0d86b2", + "version": "KqlParameterItem/1.0", + "name": "PolicyName", + "label": "Search Vault or Policy", + "type": 1, + "description": "Use to filter by Vault or Policy name.
To filter for a specific policy in a specific vault use <vault>;<policy>", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "0588c964-1b62-424b-aef3-34f05435548a", + "version": "KqlParameterItem/1.0", + "name": "HasProtectedItems", + "label": "Has Protected Items?", + "type": 2, + "description": "Use to filter the results only for policies associated with one or more protected items", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Yes\", \"label\":\"Yes\" },\r\n { \"value\":\"No\", \"label\":\"No\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "2fd2f893-b2e3-44d8-9326-5f6b9564b3c4", + "version": "KqlParameterItem/1.0", + "name": "ScheduleFrequency", + "label": "Schedule Frequency", + "type": 2, + "description": "Use to filter by Backup Frequency of the policy", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"Daily\", \"label\":\"Daily\" },\r\n { \"value\":\"Weekly\", \"label\":\"Weekly\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "0b064ac9-d8fa-4985-83e7-8f41dca55f02", + "version": "KqlParameterItem/1.0", + "name": "RetentionSchedule", + "label": "Retention Type", + "type": 2, + "description": "Use to filter policies where selected Retention Type has been defined", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"1 == 1\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"isnotempty(DailyRetention)\", \"label\":\"Daily\" },\r\n { \"value\":\"isnotempty(WeeklyRetention)\", \"label\":\"Weekly\" },\r\n { \"value\":\"isnotempty(MonthlyRetention)\", \"label\":\"Monthly\" },\r\n { \"value\":\"isnotempty(YearlyRetention)\", \"label\":\"Yearly\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "1d767e68-5daf-4741-afa5-1dd017d68ba2", + "version": "KqlParameterItem/1.0", + "name": "SnapshotRetention", + "type": 2, + "description": "To filter by number of days the backup snapshot is retained for fast restores. Use zero to view rows with no snapshot retention.", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"All\", \"label\":\"All\", \"selected\": true },\r\n { \"value\":\"0\", \"label\":\"0\" },\r\n { \"value\":\"1\", \"label\":\"1\" },\r\n { \"value\":\"2\", \"label\":\"2\" },\r\n { \"value\":\"3\", \"label\":\"3\" },\r\n { \"value\":\"4\", \"label\":\"4\" },\r\n { \"value\":\"5\", \"label\":\"5\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "label": "Snapshot Retention" + }, + { + "id": "e43d08b8-4fe9-44a0-9360-aa34ecd4823d", + "version": "KqlParameterItem/1.0", + "name": "PolicyPageNumber", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "recoveryservicesresources\r\n| where type == \"microsoft.recoveryservices/vaults/backuppolicies\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupPolicies.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend PolicyId = tolower(id)\r\n| join kind = leftouter\r\n(\r\n recoveryservicesresources\r\n | where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n\t| where properties.backupManagementType == \"AzureIaasVM\"\r\n | summarize ProtectedItems = count() by PolicyId = tolower(tostring(properties.policyId))\r\n) on PolicyId\r\n| project id,\r\n PolicyName = replace(\".*\\\\/backupPolicies\\\\/\",\"\",id),\r\n\t\t vaultId,\r\n\t\t VaultName = replace(\".*\\\\/vaults\\\\/\",\"\",vaultId),\r\n\t\t ProtectedItems,\r\n RunTime = strcat(tostring(properties.schedulePolicy.scheduleRunTimes[0]),\" \",iff(isempty(tostring(properties.timeZone)),\"UTC\",tostring(properties.timeZone))),\r\n Frequency = tostring(properties.schedulePolicy.scheduleRunFrequency),\r\n RunDays = tostring(properties.schedulePolicy.scheduleRunDays),\r\n \t SnapshotRetention = iff(isempty(tostring(properties.instantRpRetentionRangeInDays)),\"2\",tostring(properties.instantRpRetentionRangeInDays)),\r\n DailyRetention = tostring(properties.retentionPolicy.dailySchedule.retentionDuration.['count']),\r\n WeeklyRetention = tostring(properties.retentionPolicy.weeklySchedule.retentionDuration.['count']),\r\n MonthlyRetention = tostring(properties.retentionPolicy.monthlySchedule.retentionDuration.['count']),\r\n YearlyRetention = tostring(properties.retentionPolicy.yearlySchedule.retentionDuration.['count']),\r\n\t\t Daily = \"Daily\", Weekly = \"Weekly\", Monthly = \"Monthly\", Yearly = \"Yearly\"\r\n| where strcat(VaultName,\";\",PolicyName) contains (@\"{PolicyName}\")\r\n| where (isnull(ProtectedItems) and \"{HasProtectedItems}\" == \"No\") or (isnotnull(ProtectedItems) and \"{HasProtectedItems}\" == \"Yes\") or (strcat(tostring(ProtectedItems),\"{HasProtectedItems}\") contains \"All\") \r\n| where Frequency == \"{ScheduleFrequency}\" or strcat(Frequency,\"{ScheduleFrequency}\") contains \"All\"\r\n| where {RetentionSchedule}\r\n| where SnapshotRetention == \"{SnapshotRetention}\" or strcat(SnapshotRetention,\"{SnapshotRetention}\") contains \"All\" or (isempty(SnapshotRetention) and strcat(SnapshotRetention,\"{SnapshotRetention}\") contains \"0\")\r\n| project id, PolicyName, vaultId, ProtectedItems, RunTime, BackupFrequency = Frequency, RunDays, SnapshotRetention,\r\n DailyRetention = iff(isnotempty(DailyRetention),strcat(DailyRetention,\" days \"),DailyRetention),\r\n\t\t WeeklyRetention = iff(isnotempty(WeeklyRetention),strcat(WeeklyRetention,\" weeks \"),WeeklyRetention),\r\n\t\t MonthlyRetention = iff(isnotempty(MonthlyRetention),strcat(MonthlyRetention,\" months \"),MonthlyRetention),\r\n\t\t YearlyRetention = iff(isnotempty(YearlyRetention),strcat(YearlyRetention,\" years \"),YearlyRetention)\r\n| project id, PolicyName, vaultId, ProtectedItems, SnapshotRetention,\r\n MaxRetention = iff(isempty(YearlyRetention),iff(isempty(MonthlyRetention),iff(isempty(WeeklyRetention),DailyRetention,WeeklyRetention),MonthlyRetention),YearlyRetention),\r\n\t\t Retention = strcat(DailyRetention,WeeklyRetention,MonthlyRetention,YearlyRetention), BackupFrequency\r\n| summarize c = count()\r\n| project num = (c-1)/{RowsPerPage} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + { + "parameterName": "PolicyView", + "comparison": "isEqualTo", + "value": "Standard" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + "customWidth": "100", + "name": "PoliciesStandardParameterBlock", + "styleSettings": { + "margin": "-10px 0% 0% 0%" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "recoveryservicesresources\r\n| where type == \"microsoft.recoveryservices/vaults/backuppolicies\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| extend vaultId = tolower(replace(\"\\\\/backupPolicies.*\",\"\",id))\r\n| where vaultId in ({Vault}) or (\"*\" in ({Vault}) and tostring(hash(vaultId)) in ({AllVaultHash}))\r\n| extend PolicyId = tolower(id)\r\n| join kind = leftouter\r\n(\r\n recoveryservicesresources\r\n | where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n\t| where properties.backupManagementType == \"AzureIaasVM\"\r\n | summarize ProtectedItems = count() by PolicyId = tolower(tostring(properties.policyId))\r\n) on PolicyId\r\n| project id,\r\n PolicyName = replace(\".*\\\\/backupPolicies\\\\/\",\"\",id),\r\n\t\t vaultId,\r\n\t\t VaultName = replace(\".*\\\\/vaults\\\\/\",\"\",vaultId),\r\n\t\t ProtectedItems,\r\n RunTime = strcat(tostring(properties.schedulePolicy.scheduleRunTimes[0]),\" \",iff(isempty(tostring(properties.timeZone)),\"UTC\",tostring(properties.timeZone))),\r\n Frequency = tostring(properties.schedulePolicy.scheduleRunFrequency),\r\n RunDays = tostring(properties.schedulePolicy.scheduleRunDays),\r\n \t SnapshotRetention = iff(isempty(tostring(properties.instantRpRetentionRangeInDays)),\"2\",tostring(properties.instantRpRetentionRangeInDays)),\r\n DailyRetention = tostring(properties.retentionPolicy.dailySchedule.retentionDuration.['count']),\r\n WeeklyRetention = tostring(properties.retentionPolicy.weeklySchedule.retentionDuration.['count']),\r\n MonthlyRetention = tostring(properties.retentionPolicy.monthlySchedule.retentionDuration.['count']),\r\n YearlyRetention = tostring(properties.retentionPolicy.yearlySchedule.retentionDuration.['count']),\r\n\t\t Daily = \"Daily\", Weekly = \"Weekly\", Monthly = \"Monthly\", Yearly = \"Yearly\"\r\n| where strcat(VaultName,\";\",PolicyName) contains (@\"{PolicyName}\")\r\n| where (isnull(ProtectedItems) and \"{HasProtectedItems}\" == \"No\") or (isnotnull(ProtectedItems) and \"{HasProtectedItems}\" == \"Yes\") or (strcat(tostring(ProtectedItems),\"{HasProtectedItems}\") contains \"All\") \r\n| where Frequency == \"{ScheduleFrequency}\" or strcat(Frequency,\"{ScheduleFrequency}\") contains \"All\"\r\n| where {RetentionSchedule}\r\n| where SnapshotRetention == \"{SnapshotRetention}\" or strcat(SnapshotRetention,\"{SnapshotRetention}\") contains \"All\" or (isempty(SnapshotRetention) and strcat(SnapshotRetention,\"{SnapshotRetention}\") contains \"0\")\r\n| project id, PolicyName, vaultId, ProtectedItems, RunTime, BackupFrequency = Frequency, RunDays, SnapshotRetention,\r\n DailyRetention = iff(isnotempty(DailyRetention),strcat(DailyRetention,\" days \"),DailyRetention),\r\n\t\t WeeklyRetention = iff(isnotempty(WeeklyRetention),strcat(WeeklyRetention,\" weeks \"),WeeklyRetention),\r\n\t\t MonthlyRetention = iff(isnotempty(MonthlyRetention),strcat(MonthlyRetention,\" months \"),MonthlyRetention),\r\n\t\t YearlyRetention = iff(isnotempty(YearlyRetention),strcat(YearlyRetention,\" years \"),YearlyRetention)\r\n| project id, PolicyName, vaultId, ProtectedItems, SnapshotRetention,\r\n MaxRetention = iff(isempty(YearlyRetention),iff(isempty(MonthlyRetention),iff(isempty(WeeklyRetention),DailyRetention,WeeklyRetention),MonthlyRetention),YearlyRetention),\r\n\t\t Retention = strcat(DailyRetention,WeeklyRetention,MonthlyRetention,YearlyRetention), BackupFrequency\r\n| sort by ProtectedItems desc, tolower(PolicyName) asc, id asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{RowsPerPage} + 1))\r\n| where page_num has ('{PolicyPageNumber}') or '*' in ('{PolicyPageNumber}')", + "size": 3, + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "PolicyName", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Policy" + } + }, + { + "columnMatch": "vaultId", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Vault associated with the Policy" + } + }, + { + "columnMatch": "ProtectedItems", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Number of Protected Items associated with the Policy" + } + }, + { + "columnMatch": "SnapshotRetention", + "formatter": 2, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Number of days the backup snapshot is retained for fast restores, as per the policy" + } + }, + { + "columnMatch": "MaxRetention", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Maximum amount of time a retention point can exist in the vault, whether it is a daily, weekly, monthly or yearly retention point" + } + }, + { + "columnMatch": "Retention", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Retention period as specified by the Policy" + } + }, + { + "columnMatch": "BackupFrequency", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Frequency of backup as per the Policy" + } + }, + { + "columnMatch": "row_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "page_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "RunTime", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "RunDays", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 1000, + "labelSettings": [ + { + "columnId": "PolicyName", + "label": "Policy" + }, + { + "columnId": "vaultId", + "label": "Vault" + }, + { + "columnId": "ProtectedItems", + "label": "# Protected Items" + }, + { + "columnId": "SnapshotRetention", + "label": "Snapshot Retention" + }, + { + "columnId": "MaxRetention", + "label": "Max Retention" + }, + { + "columnId": "Retention", + "label": "Retention [Daily Weekly Monthly Yearly]" + }, + { + "columnId": "BackupFrequency", + "label": "Backup Frequency" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + { + "parameterName": "PolicyView", + "comparison": "isEqualTo", + "value": "Standard" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + "showPin": true, + "name": "PoliciesStandard", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "showBorder": true + } + }, + { + "type": 1, + "content": { + "json": "
 
Backup Items managed by above selected policy
" + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + { + "parameterName": "SelectedPolicyId", + "comparison": "isNotEqualTo", + "value": "*" + }, + { + "parameterName": "PolicyView", + "comparison": "isEqualTo", + "value": "Enhanced" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + "customWidth": "0", + "name": "RelatedBackupItemsTitle" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "93005650-7d74-4d70-8048-01749a5fb6f6", + "version": "KqlParameterItem/1.0", + "name": "RelatedBackupItemPageNumber", + "label": "Page", + "type": 2, + "isRequired": true, + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| where tolower(properties.policyId) == tolower(\"{SelectedPolicyId}\")\r\n| extend vaultId = tolower(replace(\"\\\\/backupFabrics.*\",\"\",id))\r\n| extend a = split(tolower(tostring(properties.containerName)),\";\")\r\n| extend a = iff(array_length(a) == 4, tostring(hash(strcat(tolower(subscriptionId), tostring(a[2]), tostring(a[3])))), tostring(hash(strcat(tolower(subscriptionId), tostring(a[1]), tostring(a[2])))))\r\n| extend ResourceState = iff(a in ({VMHash}), \"VM Active\", \"VM Not Found\")\r\n| project backupItemId = id,\r\n\t\t Name = replace(\"iaasvmcontainer;\",\"\",replace(\"iaasvmcontainerv2;\",\"\",tolower(tostring(properties.containerName)))),\r\n ProtectionState = iff(tostring(properties.protectionState) == \"IRPending\", \"Initial Backup Pending\", iff(tostring(properties.protectionState) == \"Protected\", \"Actively Protected\", iff(tostring(properties.protectionState) == \"ProtectionStopped\", \"Protection Stopped\", \"Actively Protected\"))),\r\n ResourceState,\r\n\t\t HealthCheck = tostring(properties.healthStatus),\r\n\t\t LastBackup = iff(isempty(tostring(properties.lastBackupStatus)),\"Unknown\",tostring(properties.lastBackupStatus)), \r\n\t\t LastBackupTime = properties.lastBackupTime,\r\n LastRecoveryPoint = properties.lastRecoveryPoint,\r\n\t\t backupItemHostId = properties.sourceResourceId,\r\n\t\t Host = iff(tostring(properties.protectedItemType) contains \"classic\", \"Classic VM\", \"VM\"),\r\n\t\t policyId = tolower(tostring(properties.policyId)),\r\n\t\t VaultName = replace(\".*\\\\/vaults\\\\/\",\"\",replace(\"\\\\/backupFabrics.*\",\"\",id)),\r\n\t\t vaultId = replace(\"\\\\/backupFabrics.*\",\"\",id)\r\n| project backupItemId,\r\n\t\t Name,\r\n Item = tostring(split(Name,\";\")[1]),\r\n ResourceGroup = tostring(split(Name,\";\")[0]),\r\n ProtectionState,\r\n ResourceState,\r\n\t\t HealthCheck,\r\n\t\t LastBackup, \r\n\t\t LastBackupTime = todatetime(LastBackupTime),\r\n LastRecoveryPoint = todatetime(LastRecoveryPoint),\r\n\t\t Host = iff(ResourceState == \"VM Active\",backupItemHostId,\"\"),\r\n\t\t vaultId\r\n| summarize c = count()\r\n| project num = (c-1)/{RowsPerPage} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + { + "parameterName": "SelectedPolicyId", + "comparison": "isNotEqualTo", + "value": "*" + }, + { + "parameterName": "PolicyView", + "comparison": "isEqualTo", + "value": "Enhanced" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + "customWidth": "0", + "name": "RelatedBackupItemsPageNumberParameterBlock" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "RecoveryServicesResources\r\n| where type == \"microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems\"\r\n| where properties.backupManagementType == \"AzureIaasVM\"\r\n| where tolower(properties.policyId) == tolower(\"{SelectedPolicyId}\")\r\n| extend vaultId = tolower(replace(\"\\\\/backupFabrics.*\",\"\",id))\r\n| extend a = split(tolower(tostring(properties.containerName)),\";\")\r\n| extend a = iff(array_length(a) == 4, tostring(hash(strcat(tolower(subscriptionId), tostring(a[2]), tostring(a[3])))), tostring(hash(strcat(tolower(subscriptionId), tostring(a[1]), tostring(a[2])))))\r\n| extend ResourceState = iff(a in ({VMHash}), \"VM Active\", \"VM Not Found\")\r\n| project backupItemId = id,\r\n\t\t Name = replace(\"iaasvmcontainer;\",\"\",replace(\"iaasvmcontainerv2;\",\"\",tolower(tostring(properties.containerName)))),\r\n ProtectionState = iff(tostring(properties.protectionState) == \"IRPending\", \"Initial Backup Pending\", iff(tostring(properties.protectionState) == \"Protected\", \"Actively Protected\", iff(tostring(properties.protectionState) == \"ProtectionStopped\", \"Protection Stopped\", \"Actively Protected\"))),\r\n ResourceState,\r\n\t\t HealthCheck = tostring(properties.healthStatus),\r\n\t\t LastBackup = iff(isempty(tostring(properties.lastBackupStatus)),\"Unknown\",tostring(properties.lastBackupStatus)), \r\n\t\t LastBackupTime = properties.lastBackupTime,\r\n LastRecoveryPoint = properties.lastRecoveryPoint,\r\n\t\t backupItemHostId = properties.sourceResourceId,\r\n\t\t Host = iff(tostring(properties.protectedItemType) contains \"classic\", \"Classic VM\", \"VM\"),\r\n\t\t policyId = tolower(tostring(properties.policyId)),\r\n\t\t VaultName = replace(\".*\\\\/vaults\\\\/\",\"\",replace(\"\\\\/backupFabrics.*\",\"\",id)),\r\n\t\t vaultId = replace(\"\\\\/backupFabrics.*\",\"\",id)\r\n| project backupItemId,\r\n\t\t Name,\r\n Item = tostring(split(Name,\";\")[1]),\r\n ResourceGroup = tostring(split(Name,\";\")[0]),\r\n ProtectionState,\r\n\t\t HealthCheck,\r\n\t\t LastBackup, \r\n\t\t LastBackupTime = todatetime(LastBackupTime),\r\n LastRecoveryPoint = todatetime(LastRecoveryPoint),\r\n ResourceState,\r\n\t\t Host = iff(ResourceState == \"VM Active\",backupItemHostId,\"\"),\r\n\t\t vaultId\r\n| sort by tolower(Name) asc, backupItemId asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{RowsPerPage} + 1))\r\n| where page_num has ('{RelatedBackupItemPageNumber}') or '*' in ('{RelatedBackupItemPageNumber}')", + "size": 3, + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscriptions}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "backupItemId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Item", + "formatter": 18, + "formatOptions": { + "linkColumn": "backupItemId", + "linkTarget": "Resource", + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "resource", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ResourceGroup", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ProtectionState", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Stopped", + "representation": "disabled", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Protected", + "representation": "Blank", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Pending", + "representation": "pending", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "HealthCheck", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Passed", + "representation": "Blank", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "ActionSuggested", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "ActionRequired", + "representation": "4", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "LastBackup", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "LastBackupTime", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "dateFormat": { + "showUtcTime": true, + "formatName": "shortDateTimePattern" + } + }, + { + "columnMatch": "LastRecoveryPoint", + "formatter": 6, + "formatOptions": { + "showIcon": true + }, + "dateFormat": { + "showUtcTime": true, + "formatName": "shortDateTimePattern" + } + }, + { + "columnMatch": "ResourceState", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Active", + "representation": "Blank", + "text": "{0}{1}" + }, + { + "operator": "contains", + "thresholdValue": "Not Found", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "more", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Host", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "vaultId", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "row_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "page_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "PolicyName", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "backupItemHostId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 1000, + "labelSettings": [ + { + "columnId": "Item", + "label": "Backup Item" + }, + { + "columnId": "ResourceGroup", + "label": "Resource Group" + }, + { + "columnId": "ProtectionState", + "label": "Protection State" + }, + { + "columnId": "HealthCheck", + "label": "Health Check" + }, + { + "columnId": "LastBackupTime", + "label": "LastBackupTime [UTC]" + }, + { + "columnId": "LastRecoveryPoint", + "label": "LastRecoveryPoint [UTC]" + }, + { + "columnId": "ResourceState", + "label": "Resource State" + }, + { + "columnId": "Host", + "label": "Azure Resource" + }, + { + "columnId": "vaultId", + "label": "Vault" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + { + "parameterName": "SelectedPolicyId", + "comparison": "isNotEqualTo", + "value": "*" + }, + { + "parameterName": "PolicyView", + "comparison": "isEqualTo", + "value": "Enhanced" + } + ], + "conditionalVisibility": { + "parameterName": "Tabname", + "comparison": "isEqualTo", + "value": "Policies" + }, + "showPin": true, + "name": "RelatedBackupItems", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "showBorder": true + } + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/Backup Explorer/settings.json b/Azure Backup/Workbooks/Backup Explorer/settings.json new file mode 100644 index 0000000..7115946 --- /dev/null +++ b/Azure Backup/Workbooks/Backup Explorer/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Backup Explorer", + "author": "Microsoft", + "galleries": [{ "type": "backup-insights", "resourceType": "Azure Monitor", "order": 200 }] +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/Backup Report/Backup Report.workbook b/Azure Backup/Workbooks/Backup Report/Backup Report.workbook new file mode 100644 index 0000000..efe9a95 --- /dev/null +++ b/Azure Backup/Workbooks/Backup Report/Backup Report.workbook @@ -0,0 +1,770 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "TabName", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "TabName", + "linkTarget": "parameter", + "linkLabel": "Summary", + "subTarget": "Summary", + "style": "primary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "13bf0ff5-c132-4c85-910e-9de00bb3d26e", + "typeSource": "workbook", + "gallerySource": "workbook" + } + }, + { + "cellValue": "TabName", + "linkTarget": "parameter", + "linkLabel": "Backup Items", + "subTarget": "BackupItems", + "style": "secondary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Azure Backup/Storage", + "typeSource": "default", + "gallerySource": "static", + "gallery": "Azure Monitor" + } + }, + { + "cellValue": "TabName", + "linkTarget": "parameter", + "linkLabel": "Usage", + "subTarget": "Usage", + "style": "secondary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Azure Backup/Protected Instances", + "typeSource": "default", + "gallerySource": "static", + "gallery": "Azure Monitor" + } + }, + { + "cellValue": "TabName", + "linkTarget": "parameter", + "linkLabel": "Jobs", + "subTarget": "JobDistribution", + "style": "secondary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Azure Backup/Job Distribution", + "typeSource": "default", + "gallerySource": "static", + "gallery": "Azure Monitor" + } + }, + { + "cellValue": "TabName", + "linkTarget": "parameter", + "linkLabel": "Policies", + "subTarget": "PolicyDetails", + "style": "link" + } + ] + }, + "name": "Tabs" + }, + { + "type": 1, + "content": { + "json": " " + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview-InstructionText" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "d1f42f81-eb8f-4653-a0ff-38564d7487b4", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "description": "Subscriptions to filter the list of workspaces", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "includeAll": false, + "selectAllValue": "" + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "2373a24f-ad32-4909-a7f6-59b373dcde6c", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "description": "LA Workspaces configured in vault diagnostic settings", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.operationalinsights/workspaces' | project id", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": [], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "64dd748f-d528-4912-a3bf-4a503e0b17f6", + "version": "KqlParameterItem/1.0", + "name": "VaultsUsingAzureDiagnostics", + "type": 1, + "query": "let RangeStart = startofday(ago(3d));\r\nlet VaultUnderAzureDiagnostics = (){\r\nAzureDiagnostics\r\n| where TimeGenerated >= RangeStart | where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| project ResourceId, Category};\r\nlet VaultUnderResourceSpecific = (){\r\nCoreAzureBackup\r\n| where TimeGenerated >= RangeStart | where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| project ResourceId, Category};\r\n// Some Workspaces will not have AzureDiagnostics Table, hence it has to be combined using isFuzzy\r\nlet CombinedVaultTable = ()\r\n{CombinedTable | union isfuzzy = true \r\n(VaultUnderAzureDiagnostics() ),\r\n(VaultUnderResourceSpecific() )\r\n| distinct ResourceId, Category};\r\nCombinedVaultTable | where Category == \"AzureBackupReport\"\r\n| join kind = leftanti ( \r\nCombinedVaultTable | where Category == \"CoreAzureBackup\"\r\n) on ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" * \"MICROSOFT.RECOVERYSERVICES/VAULTS/\" VaultName:string\r\n//| project ResourceId, SubscriptionId, VaultName\r\n| count ", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "d894d309-7e5f-488e-afde-73796c84b711", + "version": "KqlParameterItem/1.0", + "name": "AzureStorageCutOffDate", + "type": 1, + "description": "Cut-off Date To Enable AzureStorage", + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"5/14/2020, 12:00:00.000 AM\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8, + "value": "6/01/2020, 12:00:00.000 AM" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 8 + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Overview" + }, + "customWidth": "50", + "name": "Overview-WorkspaceParameterBlock" + }, + { + "type": 1, + "content": { + "json": "

You have vault(s) using **legacy diagnostics settings**. Please use the latest diagnostics settings for all your vaults to make them eligible for reporting upgrades. Learn More

" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Overview" + }, + { + "parameterName": "VaultsUsingAzureDiagnostics", + "comparison": "isNotEqualTo", + "value": "" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "ResourceSpecificTextBox1", + "styleSettings": { + "margin": "-20px 0% 0% 0%" + } + }, + { + "type": 1, + "content": { + "json": "_____" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Overview" + } + ], + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "name": "Overview-DividingLine1" + }, + { + "type": 1, + "content": { + "json": "
Report Filters
" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "name": "Overview-ReportFiltersTitle" + }, + { + "type": 1, + "content": { + "json": "

Filters are applied left to right and top to bottom on each page. Learn More

" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "name": "Overview-InstructionText2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "8c4ae44c-fa9a-4498-aedc-736a56e64b43", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "description": "Time Range", + "value": { + "durationMs": 604800000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "bb7c8d78-cf0c-4b47-af95-1c07ac0f6829", + "version": "KqlParameterItem/1.0", + "name": "ErrorHandle", + "label": "Error Handle", + "type": 1, + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// BMSTypeWithBackupItemType MappingTable\r\nlet BMSTypeWithBackupItemTypeMappingTable = datatable (BMSTypeWithBackupItemType:string, CustomBMSTypeWithBackupItemType:string)\r\n [ \"AzureWorkload/SAPHanaDatabase\", \"SAP HANA in Azure VM/SAP HANA in Azure VM\",\r\n \"AzureWorkload/SQLDataBase\", \"SQL in Azure VM/SQL Database\",\r\n\t \"AzureStorage/AzureFileShare\", \"Azure Storage (Azure Files)/Azure File Share\",\r\n \"IaaSVM/VM\", \"Azure Virtual Machine/Azure VM\",\r\n\t \"MAB/FileFolder\", \"Azure Backup Agent/Files and Folder\",\r\n\t \"DPM/SQLDB\", \"DPM/SQL Database\",\r\n\t \"DPM/VMwareVM\", \"DPM/VMWare VM\",\r\n\t \"DPM/HyperVVM\", \"DPM/Hyper-V VM\",\r\n\t \"DPM/FileFolder\", \"DPM/Files and Folder\",\r\n\t \"DPM/Client\", \"DPM/Client\",\r\n\t \"DPM/SystemState\", \"DPM/System State\",\r\n\t \"DPM/Sharepoint\", \"DPM/Sharepoint Database\",\r\n\t \"DPM/Exchange\", \"DPM/Exchange Mailbox Database\",\r\n\t \"AzureBackupServer/SQLDB\", \"Azure Backup Server/SQL Database\",\r\n\t \"AzureBackupServer/VMwareVM\", \"Azure Backup Server/VMWare VM\",\r\n\t \"AzureBackupServer/HyperVVM\", \"Azure Backup Server/Hyper-V VM\",\r\n\t \"AzureBackupServer/FileFolder\", \"Azure Backup Server/Files and Folder\",\r\n\t \"AzureBackupServer/Client\", \"Azure Backup Server/Client\",\r\n\t \"AzureBackupServer/SystemState\", \"Azure Backup Server/System State\",\r\n\t \"AzureBackupServer/Sharepoint\", \"Azure Backup Server/Sharepoint Database\",\r\n\t \"AzureBackupServer/Exchange\", \"Azure Backup Server/Exchange Mailbox Database\"];\r\n// Fetch data from AzureDiagnostics\r\nlet BackupItemUnderAzureDiagnostics = ( ) \r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), BackupItemType = columnifexists(\"BackupItemType_s\", \"\") \r\n};\r\n// Fetch data from ResourceSpecific\r\nlet BackupItemUnderResourceSpecific = ( ) \r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n| project BackupManagementType, BackupItemType \r\n};\r\nlet OutputTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| distinct BackupManagementType, BackupItemType\r\n| distinct strcat(BackupManagementType, \"/\", BackupItemType)\r\n| project BMSTypeWithBackupItemType = Column1};\r\nlet CustomOutputTable = () {BMSTypeWithBackupItemTypeMappingTable\r\n| join kind= inner (OutputTable) \r\non BMSTypeWithBackupItemType\r\n| project BMSTypeWithBackupItemType1, CustomBMSTypeWithBackupItemType};\r\nCustomOutputTable\r\n| where isnotempty(CustomBMSTypeWithBackupItemType)", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "customWidth": "18", + "name": "Overview-TimeRangeParameterBlock", + "styleSettings": { + "maxWidth": "100%" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "9d94255b-5726-41c5-ab7c-4e13187c5de5", + "version": "KqlParameterItem/1.0", + "name": "CustomBackupManagementTypeParam", + "label": "Backup Management Type", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "MAB/*,IaaSVM/*,DPM/*,AzureBackupServer/*,AzureWorkload/SAPHanaDatabase,AzureWorkload/SQLDataBase,AzureStorage/*" + }, + "jsonData": "\r\n[ \r\n{ \"value\": \"MAB/*\", \t\t\t\t\t\t\"label\": \"Azure Backup Agent\" },\r\n{ \"value\": \"AzureBackupServer/*\", \t\t\t\"label\": \"Azure Backup Server\" },\r\n{ \"value\": \"AzureStorage/*\", \t\t\t\t\"label\": \"Azure Storage (Azure Files)\" },\r\n{ \"value\": \"IaaSVM/*\", \t\t\t\t\t\t\"label\": \"Azure Virtual Machine\" },\r\n{ \"value\": \"DPM/*\", \t\t\t\t\t\t\"label\": \"DPM\" },\r\n{ \"value\": \"AzureWorkload/SAPHanaDatabase\", \"label\": \"SAP HANA in Azure VM\" },\r\n{ \"value\": \"AzureWorkload/SQLDataBase\", \"label\": \"SQL in Azure VM\" }\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "678680e5-76b5-4db8-bbef-5f73942caf2e", + "version": "KqlParameterItem/1.0", + "name": "VaultSubscription", + "label": "Subscription Name", + "type": 6, + "description": "Subscription(s) under which the vault(s) exist", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\n// Fetch data from AzureDiagnostics\r\nlet BackupItemUnderAzureDiagnostics = ( ) \r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), BackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ResourceId \r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" * \r\n};\r\n// Fetch data from ResourceSpecific\r\nlet BackupItemUnderResourceSpecific = ( ) \r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n| project BackupManagementType, BackupItemType, ResourceId \r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n};\r\nCombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| project BackupManagementType, SubscriptionId, BackupItemType \r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| distinct SubscriptionId", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*", + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "2a83acc5-2123-476f-8a4c-da2fddf231a1", + "version": "KqlParameterItem/1.0", + "name": "Location", + "label": "Vault Location", + "type": 2, + "description": "Location(s) in which the vault(s) were created", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// Parameter Used - BMSTypeWithBackupItemType\r\n// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, TimeGenerated\r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" * \r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| project ResourceId, AzureDataCenter, VaultName\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" * \r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| project ResourceId, AzureDataCenter, VaultName;\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), BackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ResourceId\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n| project BackupManagementType, BackupItemType, BMSTypeWithBackupItemType = strcat(BackupManagementType, \"/\", BackupItemType), ResourceId\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet LatestBackupItemTable = ()\r\n{CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics() | project AzureDataCenter),\r\n(BackupItemUnderResourceSpecific() | project AzureDataCenter)\r\n| distinct AzureDataCenter};\r\nLatestBackupItemTable", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "fefd31fa-2774-43ca-8cc3-44d477c969f0", + "version": "KqlParameterItem/1.0", + "name": "Vault", + "label": "Vault Name", + "type": 2, + "description": "Name(s) of the vault(s)", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\"));\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, TimeGenerated\r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" * \r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| project ResourceId, AzureDataCenter, VaultName\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" * \r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| project ResourceId, AzureDataCenter, VaultName;\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), BackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ResourceId\r\n| extend BMSTypeWithBackupItemType = strcat(BackupManagementType, \"/\", BackupItemType)\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n| project BackupManagementType, BackupItemType, BMSTypeWithBackupItemType = strcat(BackupManagementType, \"/\", BackupItemType), ResourceId\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet LatestBackupItemTable = ()\r\n{CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics() | project VaultName),\r\n(BackupItemUnderResourceSpecific() | project VaultName)\r\n| distinct VaultName};\r\nLatestBackupItemTable", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo", + "value": "" + } + ], + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "customWidth": "60", + "name": "Overview-ReportParameterBlock", + "styleSettings": { + "maxWidth": "100%" + } + }, + { + "type": 1, + "content": { + "json": " All datetimes are in UTC. Data for the current partial day is not shown in the reports. Learn More" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "name": "Overview-InstructionText2", + "styleSettings": { + "margin": "0% 0% 0% 0%", + "padding": "0% 0% 0% 0%" + } + }, + { + "type": 1, + "content": { + "json": "

You have vault(s) using **legacy diagnostics settings**. Please use the latest diagnostics settings for all your vaults to make them eligible for reporting upgrades. Learn More

" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isNotEqualTo", + "value": "Overview" + }, + { + "parameterName": "VaultsUsingAzureDiagnostics", + "comparison": "isNotEqualTo", + "value": "" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isNotEqualTo", + "value": "Overview" + }, + "name": "ResourceSpecificTextBox2", + "styleSettings": { + "margin": "-20px 0% 0% 0%" + } + }, + { + "type": 1, + "content": { + "json": "
Note - There is no backup data in the selected Log Analytics workspace(s) for the selected time range. Learn More
" + }, + "conditionalVisibilities": [ + { + "parameterName": "ErrorHandle", + "comparison": "isEqualTo" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "ErrorHandle", + "comparison": "isEqualTo" + }, + "name": "Overview-ErrorMessage1" + }, + { + "type": 1, + "content": { + "json": "__________________________________________________________________________________________" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "name": "Overview-DividingLine2", + "styleSettings": { + "padding": "0px 0px 10px 0px" + } + }, + { + "type": 1, + "content": { + "json": "
Welcome to Azure Backup Reports!

Select your Workspace(s) and click the Summary Tab above to get started
" + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview-WelcomeText" + }, + { + "type": 1, + "content": { + "json": "
Salient Features

View reports across workload types, subscriptions and regions

View reports across your tenants using Azure Lighthouse

Track and forecast usage both at a vault and backup item level

Analyze trends on jobs, backup items, policies, and more

Audit backups and restores for all your backup items\r\n
" + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "text - 66" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Azure Backup/summary-tab", + "items": [] + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Summary" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Summary" + }, + "name": "summary-group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Azure Backup/policydetails-tab", + "items": [] + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + "name": "policy-group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Azure Backup/backupitems-tab", + "items": [] + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + "name": "backupitems-group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Azure Backup/usage-tab", + "items": [] + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + "name": "usage-group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Azure Backup/jobdistribution-tab", + "items": [] + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "name": "jobs-group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/Backup Report/settings.json b/Azure Backup/Workbooks/Backup Report/settings.json new file mode 100644 index 0000000..40661cb --- /dev/null +++ b/Azure Backup/Workbooks/Backup Report/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Backup Report", + "author": "Microsoft", + "galleries": [{ "type": "backup-insights", "resourceType": "Azure Monitor", "order": 100 }] +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/backupitems-tab/backupitems-tab.workbook b/Azure Backup/Workbooks/backupitems-tab/backupitems-tab.workbook new file mode 100644 index 0000000..34c48ac --- /dev/null +++ b/Azure Backup/Workbooks/backupitems-tab/backupitems-tab.workbook @@ -0,0 +1,777 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "2520d604-c6eb-48f8-aac4-665294faae82", + "version": "KqlParameterItem/1.0", + "name": "ContainerNameWithBackupItemNameInStorage", + "label": "Search Item or Container", + "type": 1, + "description": "Use to search for a Backup Item by name.
To search for a specific item in a container, use the syntax [container name];[item name]
To search for all items in a container, use the syntax [container name];", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "90", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "BackupItems-SearchParameterBlock", + "styleSettings": { + "margin": "0% 0% 0% 0%" + } + }, + { + "type": 1, + "content": { + "json": "______________" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "text - 74" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Parameter Used - Vault, Location, BMSTypeWithBackupItemType, BackupItemProtectionState, PolicyName\r\n// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\")); \r\nlet Item_search = @\"{ContainerNameWithBackupItemNameInStorage}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\"); \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\n// BusinessLogic\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet LatestBackupItemWithProtectedContainerTable = () \r\n{\r\nLatestBackupItemDimensionTable\r\n| join (CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics()),\r\n(BackupItemAssociationWithProtectedContainerUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId) on BackupItemUniqueId\r\n| project ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, ResourceId, BackupItemProtectionState\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, ResourceId, BackupItemProtectionState\r\n| summarize count(BackupItemUniqueId) by CustomBackupItemProtectionState = iff(BackupItemProtectionState in (\"Protected\", \"ActivelyProtected\",\"ProtectionError\"), \"Protected\", iff(BackupItemProtectionState in (\"IRPending\"), \"InitialBackupPending\", iff(isnotempty(BackupItemProtectionState),\"ProtectionStopped\",BackupItemProtectionState)))};\r\nlet ProtectionStatusEnum = datatable (CustomBackupItemProtectionState:string, statusOrder:int)\r\n [ \"Protected\", 1,\r\n \"ProtectionStopped\", 2,\r\n \"InitialBackupPending\", 3];\r\nlet ProtectionStatusTable = ProtectionStatusEnum\r\n| join kind= leftouter (LatestBackupItemWithProtectedContainerTable) \r\non CustomBackupItemProtectionState == CustomBackupItemProtectionState\r\n| project CustomBackupItemProtectionState, count_BackupItemUniqueId = (iff(isempty(count_BackupItemUniqueId), 0, count_BackupItemUniqueId)), statusOrder\r\n| order by statusOrder asc;\t \r\nProtectionStatusTable", + "size": 3, + "noDataMessage": "No records found for the selected time range and scope", + "exportFieldName": "CustomBackupItemProtectionState", + "exportParameterName": "BackupItemProtectionState", + "exportDefaultValue": "*", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "CustomBackupItemProtectionState", + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubTitle", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "count_BackupItemUniqueId", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + } + }, + "showBorder": true + } + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "BackupItems-Tiles", + "styleSettings": { + "margin": "-30px 0% 0% -15px" + } + }, + { + "type": 1, + "content": { + "json": "_________________" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "text - 73" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Parameter Used - Vault, Location, BMSTypeWithBackupItemType, BackupItemProtectionState, BillingEntityName\r\n// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\")); \r\nlet BackupItemProtectionStateParam = @\"{BackupItemProtectionState}\";\r\nlet Item_search = @\"{ContainerNameWithBackupItemNameInStorage}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\"); \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationHistoryUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationHistoryUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeHistoryUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeHistoryUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationHistoryUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationHistoryUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today \r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderAzureDiagnostics = ()\r\n{\r\nlet PolicyTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where OperationName == \"Policy\" and SchemaVersion_s == \"V2\"\r\n| project PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"), PolicyName = PolicyName_s, ResourceId, TimeGenerated\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), PolicyName, ResourceId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderAzureDiagnostics | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderResourceSpecific = ()\r\n{\r\nlet PolicyTable = AddonAzureBackupPolicy\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Policy\" \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderResourceSpecific | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState};\r\nlet BackupItemAssociationAndStorageConsumptionHistoryUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationHistoryUnderAzureDiagnostics | project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n// To-do: Figure out why ResourceId is needed for policy join\r\n PolicyUnderAzureDiagnostics | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId , TimeRangeEndDay\r\n | join kind= leftouter (\r\n BackupItemFrontEndSizeHistoryUnderAzureDiagnostics | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId \r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeGenerated, TimeRangeEndDay, BackupItemUniqueId, BackupItemFrontEndSize, PolicyUniqueId, PolicyName, ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay\r\n| join kind= leftouter (\r\n StorageAssociationHistoryUnderAzureDiagnostics | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project BackupItemUniqueId,TimeGenerated, TimeRangeEndDay,ResourceId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, PolicyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs \r\n};\r\nlet BackupItemAssociationAndStorageConsumptionHistoryUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationHistoryUnderResourceSpecific | project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n// To-do: Figure out why ResourceId is needed for policy join\r\n PolicyUnderResourceSpecific | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay \r\n | join kind= leftouter (\r\n BackupItemFrontEndSizeHistoryUnderResourceSpecific | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId \r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeGenerated, TimeRangeEndDay, BackupItemUniqueId, BackupItemFrontEndSize, PolicyUniqueId, PolicyName, ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay\r\n| join kind= leftouter (\r\n StorageAssociationHistoryUnderResourceSpecific | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project BackupItemUniqueId,TimeGenerated, TimeRangeEndDay,ResourceId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, PolicyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs \r\n};\r\n//LatestBackupItemAssociationAndStorageConsumptionHistoryTable\r\nlet partition_data = (p:long, n:long)\r\n{\r\nTotalBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionHistoryUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionHistoryUnderResourceSpecific())\r\n| where hash(BackupItemUniqueId, n) == p\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay)\r\n on BackupItemUniqueId\r\n| project TimeGenerated, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, PolicyUniqueId, PolicyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState, ResourceId, BackupItemUniqueId, TimeRangeEndDay\r\n};\r\nlet StorageHistoryMetric = ()\r\n{\r\n//LatestBackupItemAssociationAndStorageConsumptionHistoryTable\r\nunion hint.spread=5 hint.concurrency=5 (partition_data(0,5)), (partition_data(1,5)), (partition_data(2,5)), (partition_data(3,5)), (partition_data(4,5))\r\n| project CustomBackupItemProtectionState = iff(BackupItemProtectionState in (\"Protected\", \"ActivelyProtected\",\"ProtectionError\"), \"Protected\", iff(BackupItemProtectionState in (\"IRPending\"), \"InitialBackupPending\", iff(isnotempty(BackupItemProtectionState),\"ProtectionStopped\",BackupItemProtectionState))), ProtectedContainerFriendlyName, BackupItemFriendlyName, TimeRangeEndDay, BackupItemUniqueId\r\n| where CustomBackupItemProtectionState in (BackupItemProtectionStateParam) or '*' in (BackupItemProtectionStateParam)\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n};\r\nStorageHistoryMetric\r\n| summarize BackupItemCount = count(BackupItemUniqueId) by TimeRangeEndDay", + "size": 0, + "aggregation": 5, + "title": "Backup Items Trend", + "noDataMessage": "No records found for the selected time range and scope", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "gridSettings": { + "sortBy": [ + { + "itemKey": "TimeRangeEndDay", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "TimeRangeEndDay", + "sortOrder": 2 + } + ], + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "BackupItemCount", + "label": "# Backup Items" + } + ] + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "BackupItems-BackupItemsTrendGraph" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Parameter Used - Vault, Location, BMSTypeWithBackupItemType, BackupItemProtectionState, BillingEntityName\r\n// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\")); \r\nlet BackupItemProtectionStateParam = @\"{BackupItemProtectionState}\";\r\nlet Item_search = @\"{ContainerNameWithBackupItemNameInStorage}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\"); \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationHistoryUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationHistoryUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeHistoryUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeHistoryUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationHistoryUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationHistoryUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today \r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderAzureDiagnostics = ()\r\n{\r\nlet PolicyTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where OperationName == \"Policy\" and SchemaVersion_s == \"V2\"\r\n| project PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"), PolicyName = PolicyName_s, ResourceId, TimeGenerated\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), PolicyName, ResourceId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderAzureDiagnostics | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderResourceSpecific = ()\r\n{\r\nlet PolicyTable = AddonAzureBackupPolicy\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Policy\" \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderResourceSpecific | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState};\r\nlet BackupItemAssociationAndStorageConsumptionHistoryUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationHistoryUnderAzureDiagnostics | project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n// To-do: Figure out why ResourceId is needed for policy join\r\n PolicyUnderAzureDiagnostics | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId , TimeRangeEndDay\r\n | join kind= leftouter (\r\n BackupItemFrontEndSizeHistoryUnderAzureDiagnostics | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId \r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeGenerated, TimeRangeEndDay, BackupItemUniqueId, BackupItemFrontEndSize, PolicyUniqueId, PolicyName, ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay\r\n| join kind= leftouter (\r\n StorageAssociationHistoryUnderAzureDiagnostics | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project BackupItemUniqueId,TimeGenerated, TimeRangeEndDay,ResourceId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, PolicyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs \r\n};\r\nlet BackupItemAssociationAndStorageConsumptionHistoryUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationHistoryUnderResourceSpecific | project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n// To-do: Figure out why ResourceId is needed for policy join\r\n PolicyUnderResourceSpecific | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay \r\n | join kind= leftouter (\r\n BackupItemFrontEndSizeHistoryUnderResourceSpecific | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId \r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeGenerated, TimeRangeEndDay, BackupItemUniqueId, BackupItemFrontEndSize, PolicyUniqueId, PolicyName, ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay\r\n| join kind= leftouter (\r\n StorageAssociationHistoryUnderResourceSpecific | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project BackupItemUniqueId,TimeGenerated, TimeRangeEndDay,ResourceId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, PolicyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs \r\n};\r\n//LatestBackupItemAssociationAndStorageConsumptionHistoryTable\r\nlet partition_data = (p:long, n:long)\r\n{\r\nTotalBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionHistoryUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionHistoryUnderResourceSpecific())\r\n| where hash(BackupItemUniqueId, n) == p\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay)\r\n on BackupItemUniqueId\r\n| project TimeGenerated, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, PolicyUniqueId, PolicyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState, ResourceId, BackupItemUniqueId, TimeRangeEndDay\r\n};\r\nlet StorageHistoryMetric = ()\r\n{\r\n//LatestBackupItemAssociationAndStorageConsumptionHistoryTable\r\nunion hint.spread=5 hint.concurrency=5 (partition_data(0,5)), (partition_data(1,5)), (partition_data(2,5)), (partition_data(3,5)), (partition_data(4,5))\r\n| project CustomBackupItemProtectionState = iff(BackupItemProtectionState in (\"Protected\", \"ActivelyProtected\",\"ProtectionError\"), \"Protected\", iff(BackupItemProtectionState in (\"IRPending\"), \"InitialBackupPending\", iff(isnotempty(BackupItemProtectionState),\"ProtectionStopped\",BackupItemProtectionState))), ProtectedContainerFriendlyName, BackupItemFriendlyName, TimeRangeEndDay, StorageConsumedInMBs\r\n| where CustomBackupItemProtectionState in (BackupItemProtectionStateParam) or '*' in (BackupItemProtectionStateParam)\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n};\r\nStorageHistoryMetric\r\n| summarize StorageConsumedInGBs = sum(StorageConsumedInMBs)/(1024) by TimeRangeEndDay", + "size": 0, + "aggregation": 5, + "title": "Cloud Storage Trend", + "noDataMessage": "No records found for the selected time range and scope", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "gridSettings": { + "sortBy": [ + { + "itemKey": "TimeRangeEndDay", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "TimeRangeEndDay", + "sortOrder": 2 + } + ], + "chartSettings": { + "xAxis": "TimeRangeEndDay", + "seriesLabelSettings": [ + { + "seriesName": "StorageConsumedInMBs", + "label": "Cloud Storage (MB)" + }, + { + "seriesName": "StorageConsumedInGBs", + "label": "Cloud Storage (GB)" + } + ], + "ySettings": { + "unit": 17, + "min": null, + "max": null + } + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo", + "value": "" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "BackupItems-CloudStorageTrendGraph" + }, + { + "type": 1, + "content": { + "json": "____________________" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "BackupItems-DividingLine" + }, + { + "type": 1, + "content": { + "json": "
Storage by BackupItem
" + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "BackupItems-Grid1Title", + "styleSettings": { + "margin": "0% 0% 10px 0%" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "f40045ea-499d-46af-bc77-3df8c3b691a6", + "version": "KqlParameterItem/1.0", + "name": "PolicyNameInStorage", + "label": "Search Policy Name", + "type": 1, + "description": "Use to search by Policy Name", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "", + "resourceType": "microsoft.insights/components" + }, + { + "id": "7bb4a71d-d932-4737-8715-d378be7ffba5", + "version": "KqlParameterItem/1.0", + "name": "BillingMetricSortBy2", + "label": "Sort By", + "type": 2, + "description": "Use to sort by a certain column", + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n{ \\\"value\\\": \\\"StorageConsumedInMBs\\\", \\\"label\\\": \\\"Cloud Storage (MB)\\\", \\\"selected\\\": \\\"true\\\" }]\"}", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "595e5629-4f64-4038-bff5-5f3371259caa", + "version": "KqlParameterItem/1.0", + "name": "BillingMetricOrder2", + "label": "Order", + "type": 2, + "description": "Use to specify sort order: Ascending/Descending", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"Ascending\"},\r\n { \"value\":\"Descending\", \"selected\":true}\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "0e4b3406-91aa-452e-90b2-6b22e71f0b82", + "version": "KqlParameterItem/1.0", + "name": "StorageMetricRowsPerGrid2", + "label": "Rows Per Page", + "type": 2, + "description": "Number of rows to display in grid view", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":10, \"label\":\"10\", \"selected\":true },\r\n { \"value\":25, \"label\":\"25\" },\r\n { \"value\":50, \"label\":\"50\" },\r\n { \"value\":100, \"label\":\"100\" },\r\n { \"value\":250, \"label\":\"250\" },\r\n { \"value\":500, \"label\":\"500\" },\r\n { \"value\":1000, \"label\":\"1000\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "d1b7fe67-8c02-431c-904c-f82238dd112e", + "version": "KqlParameterItem/1.0", + "name": "StorageMetricPageNumber2", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// BMSTypeWithBackupItemType MappingTable\r\nlet BMSTypeWithBackupItemTypeMappingTable = datatable (BMSTypeWithBackupItemType:string, CustomBMSTypeWithBackupItemType:string)\r\n [ \"AzureWorkload/SAPHanaDatabase\", \"SAP HANA in Azure VM/SAP HANA in Azure VM\",\r\n \"AzureWorkload/SQLDataBase\", \"SQL in Azure VM/SQL Database\",\r\n \"IaaSVM/VM\", \"Azure Virtual Machine/Azure VM\",\r\n \"AzureStorage/AzureFileShare\", \"Azure Storage (Azure Files)/Azure File Share\",\r\n\t \"MAB/FileFolder\", \"Azure Backup Agent/Files and Folder\",\r\n\t \"DPM/SQLDB\", \"DPM/SQL Database\",\r\n\t \"DPM/VMwareVM\", \"DPM/VMWare VM\",\r\n\t \"DPM/HyperVVM\", \"DPM/Hyper-V VM\",\r\n\t \"DPM/FileFolder\", \"DPM/Files and Folder\",\r\n\t \"DPM/Client\", \"DPM/Client\",\r\n\t \"DPM/SystemState\", \"DPM/System State\",\r\n\t \"DPM/Sharepoint\", \"DPM/Sharepoint Database\",\r\n\t \"DPM/Exchange\", \"DPM/Exchange Mailbox Database\",\r\n\t \"AzureBackupServer/SQLDB\", \"Azure Backup Server/SQL Database\",\r\n\t \"AzureBackupServer/VMwareVM\", \"Azure Backup Server/VMWare VM\",\r\n\t \"AzureBackupServer/HyperVVM\", \"Azure Backup Server/Hyper-V VM\",\r\n\t \"AzureBackupServer/FileFolder\", \"Azure Backup Server/Files and Folder\",\r\n\t \"AzureBackupServer/Client\", \"Azure Backup Server/Client\",\r\n\t \"AzureBackupServer/SystemState\", \"Azure Backup Server/System State\",\r\n\t \"AzureBackupServer/Sharepoint\", \"Azure Backup Server/Sharepoint Database\",\r\n\t \"AzureBackupServer/Exchange\", \"Azure Backup Server/Exchange Mailbox Database\"];\r\n// Params\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\")); \r\nlet BackupItemProtectionStateParam = @\"{BackupItemProtectionState}\";\r\nlet PolicyNameInStorageParam = @\"{PolicyNameInStorage}\";\r\nlet Item_search = @\"{ContainerNameWithBackupItemNameInStorage}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\");\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId, BackupManagementServerUniqueId, StorageUniqueId, StorageConsumedInMBs, StorageAllocatedInMBs, TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderAzureDiagnostics = ()\r\n{\r\nlet PolicyTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where OperationName == \"Policy\" and SchemaVersion_s == \"V2\"\r\n| project PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"), PolicyName = PolicyName_s, ResourceId, TimeGenerated\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), PolicyName, ResourceId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderAzureDiagnostics | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderResourceSpecific = ()\r\n{\r\nlet PolicyTable = AddonAzureBackupPolicy\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Policy\" \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderResourceSpecific | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderAzureDiagnostics | project PolicyUniqueId, PolicyName, ResourceId) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet BackupItemAssociationAndStorageConsumptionUnderResourceSpecific = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderResourceSpecific | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet LatestBackupItemAssociationAndStorageConsumptionTable = ()\r\n{\r\nLatestBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n)on BackupItemUniqueId\r\n| project ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState,PolicyName, ResourceId, TimeGenerated, StorageReplicationType\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState,PolicyName, ResourceId, TimeGenerated, StorageReplicationType\r\n};\r\nlet OutputTable = (){LatestBackupItemAssociationAndStorageConsumptionTable\r\n| project CustomBackupItemProtectionState = iff(BackupItemProtectionState in (\"Protected\", \"ActivelyProtected\",\"ProtectionError\"), \"Protected\", iff(BackupItemProtectionState in (\"IRPending\"), \"InitialBackupPending\", iff(isnotempty(BackupItemProtectionState),\"ProtectionStopped\",BackupItemProtectionState))),\r\n BackupManagementType, BackupItemType, BackupItemFrontEndSize, StorageConsumedInMBs = todouble(StorageConsumedInMBs / 1), ResourceId, PolicyName, ProtectedContainerName, BackupItemName, BackupItemFriendlyName, ProtectedContainerFriendlyName, BackupItemUniqueId, StorageReplicationType\r\n| where CustomBackupItemProtectionState in (BackupItemProtectionStateParam) or '*' in (BackupItemProtectionStateParam)\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n| project BackupItemName, BackupItemFriendlyName, PolicyName = iff(CustomBackupItemProtectionState == \"ProtectionStopped\", \"(none)\", PolicyName), BackupManagementType, BackupItemType, BackupItemFrontEndSize, StorageConsumedInMBs = iff(isempty(StorageConsumedInMBs), todouble(0), StorageConsumedInMBs), ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemUniqueId, StorageReplicationType\r\n| where PolicyName contains (PolicyNameInStorageParam) or '*' in (PolicyNameInStorageParam)\r\n| project BackupItemUniqueId\r\n};\r\nOutputTable\r\n| summarize c=count()\r\n| project num = (c-1)/{StorageMetricRowsPerGrid2} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "BackupItems-Grid1ParameterBlock", + "styleSettings": { + "margin": "-23px 0% 0% 0%" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// BMSTypeWithBackupItemType MappingTable\r\nlet BMSTypeWithBackupItemTypeMappingTable = datatable (BMSTypeWithBackupItemType:string, CustomBMSTypeWithBackupItemType:string)\r\n [ \"AzureWorkload/SAPHanaDatabase\", \"SAP HANA in Azure VM/SAP HANA in Azure VM\",\r\n \"AzureWorkload/SQLDataBase\", \"SQL in Azure VM/SQL Database\",\r\n \"IaaSVM/VM\", \"Azure Virtual Machine/Azure VM\",\r\n \"AzureStorage/AzureFileShare\", \"Azure Storage (Azure Files)/Azure File Share\",\r\n\t \"MAB/FileFolder\", \"Azure Backup Agent/Files and Folder\",\r\n\t \"DPM/SQLDB\", \"DPM/SQL Database\",\r\n\t \"DPM/VMwareVM\", \"DPM/VMWare VM\",\r\n\t \"DPM/HyperVVM\", \"DPM/Hyper-V VM\",\r\n\t \"DPM/FileFolder\", \"DPM/Files and Folder\",\r\n\t \"DPM/Client\", \"DPM/Client\",\r\n\t \"DPM/SystemState\", \"DPM/System State\",\r\n\t \"DPM/Sharepoint\", \"DPM/Sharepoint Database\",\r\n\t \"DPM/Exchange\", \"DPM/Exchange Mailbox Database\",\r\n\t \"AzureBackupServer/SQLDB\", \"Azure Backup Server/SQL Database\",\r\n\t \"AzureBackupServer/VMwareVM\", \"Azure Backup Server/VMWare VM\",\r\n\t \"AzureBackupServer/HyperVVM\", \"Azure Backup Server/Hyper-V VM\",\r\n\t \"AzureBackupServer/FileFolder\", \"Azure Backup Server/Files and Folder\",\r\n\t \"AzureBackupServer/Client\", \"Azure Backup Server/Client\",\r\n\t \"AzureBackupServer/SystemState\", \"Azure Backup Server/System State\",\r\n\t \"AzureBackupServer/Sharepoint\", \"Azure Backup Server/Sharepoint Database\",\r\n\t \"AzureBackupServer/Exchange\", \"Azure Backup Server/Exchange Mailbox Database\"];\r\n// Params\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\")); \r\nlet BackupItemProtectionStateParam = @\"{BackupItemProtectionState}\";\r\nlet PolicyNameInStorageParam = @\"{PolicyNameInStorage}\";\r\nlet Item_search = @\"{ContainerNameWithBackupItemNameInStorage}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\");\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId, BackupManagementServerUniqueId, StorageUniqueId, StorageConsumedInMBs, StorageAllocatedInMBs, TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderAzureDiagnostics = ()\r\n{\r\nlet PolicyTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where OperationName == \"Policy\" and SchemaVersion_s == \"V2\"\r\n| project PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"), PolicyName = PolicyName_s, ResourceId, TimeGenerated\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), PolicyName, ResourceId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderAzureDiagnostics | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderResourceSpecific = ()\r\n{\r\nlet PolicyTable = AddonAzureBackupPolicy\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Policy\" \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderResourceSpecific | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderAzureDiagnostics | project PolicyUniqueId, PolicyName, ResourceId) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet BackupItemAssociationAndStorageConsumptionUnderResourceSpecific = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderResourceSpecific | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet LatestBackupItemAssociationAndStorageConsumptionTable = ()\r\n{\r\nLatestBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n)on BackupItemUniqueId\r\n| project ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState,PolicyName, ResourceId, TimeGenerated, StorageReplicationType\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState,PolicyName, ResourceId, TimeGenerated, StorageReplicationType\r\n};\r\nlet OutputTable = (){LatestBackupItemAssociationAndStorageConsumptionTable\r\n| project CustomBackupItemProtectionState = iff(BackupItemProtectionState in (\"Protected\", \"ActivelyProtected\",\"ProtectionError\"), \"Protected\", iff(BackupItemProtectionState in (\"IRPending\"), \"InitialBackupPending\", iff(isnotempty(BackupItemProtectionState),\"ProtectionStopped\",BackupItemProtectionState))),\r\n BackupManagementType, BackupItemType, BackupItemFrontEndSize, StorageConsumedInMBs = todouble(StorageConsumedInMBs / 1), ResourceId, PolicyName, ProtectedContainerName, BackupItemName, BackupItemFriendlyName, ProtectedContainerFriendlyName, BackupItemUniqueId, StorageReplicationType\r\n| where CustomBackupItemProtectionState in (BackupItemProtectionStateParam) or '*' in (BackupItemProtectionStateParam)\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n| project BackupItemName, BackupItemFriendlyName, PolicyName = iff(CustomBackupItemProtectionState == \"ProtectionStopped\", \"(none)\", PolicyName), BackupManagementType, BackupItemType, BackupItemFrontEndSize, StorageConsumedInMBs = iff(isempty(StorageConsumedInMBs), todouble(0), StorageConsumedInMBs), ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemUniqueId, StorageReplicationType\r\n| where PolicyName contains (PolicyNameInStorageParam) or '*' in (PolicyNameInStorageParam)\r\n| extend PolicyLink = strcat(ResourceId, \"/backupPolicies/\", PolicyName)\r\n| project BackupItemName, BackupItemFriendlyName, PolicyName, BackupManagementType, BackupItemType, BackupItemFrontEndSize, StorageConsumedInMBs = iff(isempty(StorageConsumedInMBs), todouble(0), StorageConsumedInMBs), ResourceId, PolicyLink, ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemUniqueId, StorageReplicationType \r\n| extend TempColumn = column_ifexists(tostring('{BillingMetricSortBy2}'), \"StorageConsumedInMBs\")\r\n| extend ColumnToBeSorted = iff(tostring('{BillingMetricOrder2}') == \"Ascending\", todouble(TempColumn) - 90000000, 90000000 - todouble(TempColumn))\r\n| sort by ColumnToBeSorted asc nulls last, BackupItemUniqueId asc \r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{StorageMetricRowsPerGrid2} + 1))\r\n| where page_num has ('{StorageMetricPageNumber2}') or '*' in ('{StorageMetricPageNumber2}')\r\n| extend prefix = array_strcat(array_split(split(ResourceId,\"/\"), 4)[0] ,\"/\")\r\n| extend containerNameString = iff(array_length(split(ProtectedContainerName,\";\")) == 3, ProtectedContainerName, \"\")\r\n| parse containerNameString with entityType:string \";\" rgName:string \";\" entityName:string\r\n| extend entityTypeForAzureStorageUrl = iff((BackupManagementType == \"AzureStorage\" and BackupItemType == \"AzureFileShare\"), iff(entityType == \"storage\", \"/Microsoft.Storage/storageAccounts/\", \"/Microsoft.ClassicStorage/storageAccounts/\"), \"\")\r\n| extend entityTypeForIaaSVMUrl = iff((BackupManagementType == \"IaaSVM\" and BackupItemType == \"VM\"), iff(entityType =~ \"iaasvmcontainerv2\", \"/Microsoft.Compute/virtualMachines/\", \"/Microsoft.ClassicCompute/virtualMachines/\"), \"\")\r\n| extend entityTypeForAzureWorkloadUrl = iff(((BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SAPHanaDatabase\") or (BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SQLDataBase\")), iff(entityType =~ \"compute\", \"/Microsoft.Compute/virtualMachines/\", \"/Microsoft.ClassicCompute/virtualMachines/\"), \"\")\r\n| extend AzureResource = iff(BackupManagementType in (\"DPM\", \"AzureBackupServer\", \"MAB\"), \"\" , iff(containerNameString != \"\", strcat(prefix, \"/\", rgName, \"/providers\", entityTypeForAzureStorageUrl, entityTypeForIaaSVMUrl, entityTypeForAzureWorkloadUrl, entityName), ResourceId))\r\n| extend BackupItemLink = iff ((BackupManagementType == \"IaaSVM\" and BackupItemType == \"VM\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/IaasVMContainer;\", ProtectedContainerName, \"/protectedItems/VM;\", ProtectedContainerName),\r\niff((BackupManagementType == \"AzureStorage\" and BackupItemType == \"AzureFileShare\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/StorageContainer;\", ProtectedContainerName, \"/protectedItems/AzureFileShare;\", BackupItemName) , \r\niff((BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SQLDataBase\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/VMAppContainer;\", ProtectedContainerName, \"/protectedItems/SQLDataBase;\", BackupItemName) , \r\niff((BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SAPHanaDatabase\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/VMAppContainer;\", ProtectedContainerName, \"/protectedItems/SAPHanaDatabase;\", BackupItemName), \"\"))))\r\n| extend container_array = split(ProtectedContainerName,\";\")\r\n| extend container_arraylen = array_length(container_array)\r\n| project BackupItemName = BackupItemFriendlyName, ProtectedContainerName = ProtectedContainerFriendlyName, ContainerResourceGroup = iff(container_arraylen == 3, container_array[(container_arraylen-2)], \"(none)\"), PolicyName, BMSTypeWithBackupItemType = strcat(BackupManagementType, \"/\", BackupItemType), StorageConsumedInMBs, ResourceId, StorageReplicationType, AzureResource, PolicyLink, BackupItemLink}; \r\n// To change BMSTypeWithBackupItemType to standard names\r\nlet CustomOutputTable = BMSTypeWithBackupItemTypeMappingTable\r\n| join kind= rightouter (OutputTable) \r\non BMSTypeWithBackupItemType\r\n| project BackupItemName, ProtectedContainerName, ContainerResourceGroup, PolicyName, BMSTypeWithBackupItemType = iff(CustomBMSTypeWithBackupItemType == \"\",BMSTypeWithBackupItemType1 ,CustomBMSTypeWithBackupItemType ), StorageConsumedInMBs, ResourceId, StorageReplicationType, AzureResource, PolicyLink, BackupItemLink\r\n| parse BMSTypeWithBackupItemType with ExtractedBMSType:string \"/\" ExtractedBackupItemType:string\r\n| project BackupItemName, ProtectedContainerName, ContainerResourceGroup, PolicyName, StorageConsumedInGBs = StorageConsumedInMBs/1024, ResourceId, StorageReplicationType, AzureResource, PolicyLink, BackupItemLink, ExtractedBMSType, ExtractedBackupItemType \r\n;\r\nCustomOutputTable", + "size": 3, + "noDataMessage": "No records found for the selected time range and scope", + "exportFieldName": "BackupItemUniqueId", + "exportParameterName": "SelectedBackupItemUniqueId", + "exportDefaultValue": "*", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "BackupItemName", + "formatter": 16, + "formatOptions": { + "linkColumn": "BackupItemLink", + "linkTarget": "Resource", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Backup Item" + } + }, + { + "columnMatch": "ProtectedContainerName", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Protected Container associated with the Backup Item" + } + }, + { + "columnMatch": "ContainerResourceGroup", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Resource Group of the Backup Item" + } + }, + { + "columnMatch": "PolicyName", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Policy associated with the Backup Item" + } + }, + { + "columnMatch": "StorageConsumedInGBs", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumFractionDigits": 2, + "maximumFractionDigits": 2 + } + }, + "tooltipFormat": { + "tooltip": "Total Cloud Storage consumed by the Backup Item, as of the end of the selected time range" + } + }, + { + "columnMatch": "ResourceId", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Vault associated with the Backup Item" + } + }, + { + "columnMatch": "StorageReplicationType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Storage Replication Type associated with the Backup Item" + } + }, + { + "columnMatch": "AzureResource", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Azure Resource associated with the Backup Item. For Azure VM Backup, SQL in Azure VM backup and SAP database in Azure VM backup, the Azure Resource is the Azure VM. For Azure Files Share backup, the Azure Resource is the Azure Storage account. For on-premises Backup Items, this field is blank." + } + }, + { + "columnMatch": "PolicyLink", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "BackupItemLink", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ExtractedBMSType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Management Type" + } + }, + { + "columnMatch": "ExtractedBackupItemType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Item Type" + } + } + ], + "labelSettings": [ + { + "columnId": "BackupItemName", + "label": "Backup Item" + }, + { + "columnId": "ProtectedContainerName", + "label": "Container" + }, + { + "columnId": "ContainerResourceGroup", + "label": "Resource Group" + }, + { + "columnId": "PolicyName", + "label": "Policy" + }, + { + "columnId": "StorageConsumedInGBs", + "label": "Cloud Storage (GB)" + }, + { + "columnId": "ResourceId", + "label": "Vault" + }, + { + "columnId": "StorageReplicationType", + "label": "Storage Replication Type" + }, + { + "columnId": "AzureResource", + "label": "Azure Resource" + }, + { + "columnId": "PolicyLink" + }, + { + "columnId": "BackupItemLink" + }, + { + "columnId": "ExtractedBMSType", + "label": "Backup Management Type" + }, + { + "columnId": "ExtractedBackupItemType", + "label": "Backup Item Type" + } + ] + }, + "sortBy": [] + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "BackupItems" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "BackupItems-Grid1", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "showBorder": true + } + } + ] + }, + "name": "group - 0" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/backupitems-tab/settings.json b/Azure Backup/Workbooks/backupitems-tab/settings.json new file mode 100644 index 0000000..722dd44 --- /dev/null +++ b/Azure Backup/Workbooks/backupitems-tab/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Backup Items Report", + "author": "Microsoft", + "galleries": [] +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/categoryResources.json b/Azure Backup/Workbooks/categoryResources.json new file mode 100644 index 0000000..4b726f2 --- /dev/null +++ b/Azure Backup/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Azure Backup", "description": "Provides insights from Azure Backup", "order": 100} +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/jobdistribution-tab/jobdistribution-tab.workbook b/Azure Backup/Workbooks/jobdistribution-tab/jobdistribution-tab.workbook new file mode 100644 index 0000000..0a4aeae --- /dev/null +++ b/Azure Backup/Workbooks/jobdistribution-tab/jobdistribution-tab.workbook @@ -0,0 +1,1420 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "24608a3f-634b-4f4f-87cc-998a00636eeb", + "version": "KqlParameterItem/1.0", + "name": "ContainerNameWithBackupItemName", + "label": "Search Item or Container", + "type": 1, + "description": "Use to search for a Backup Item by name.
To search for a specific item in a container, use the syntax [container name];[item name]
To search for all items in a container, use the syntax [container name];", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "", + "resourceType": "microsoft.insights/components" + }, + { + "id": "71c5a2f9-67e4-48d4-aec3-4c4116f04acd", + "version": "KqlParameterItem/1.0", + "name": "JobOperation", + "label": "Job Operation", + "type": 2, + "description": "Use to filter by Job Operation", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// Time variable used ******************** Using ExtRange For artifacts ******************************\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet ExtRangeStart = RangeStart - 2d;\r\nlet ExtRangeEnd = RangeEnd + 2d;\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\n\r\n//search\r\nlet Item_search = @\"{ContainerNameWithBackupItemName}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\"); \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderAzureDiagnostics = ()\r\n{\r\nlet BackupManagementServerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupManagementServer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not projecting BackupManagementServerVersion, BackupManagementServerOSVersion due to special handling like NewBackupManagementServerUniqueId\r\n| project OldBackupManagementServerUniqueId = columnifexists(\"BackupManagmentServerUniqueId_s\", \"\"), NewBackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), BackupManagementServerName = columnifexists(\"BackupManagementServerName_s\", \"\"), AzureBackupAgentVersion = columnifexists(\"AzureBackupAgentVersion_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), ResourceId, TimeGenerated\r\n| extend BackupManagementServerUniqueId = iff(NewBackupManagementServerUniqueId == \"\", OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId) \r\n| project-away OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderResourceSpecific = ()\r\n{\r\nlet BackupManagementServerTable =CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"BackupManagementServer\" and State != \"Deleted\"\r\n| project BackupManagementServerUniqueId, BackupManagementServerName, AzureBackupAgentVersion, BackupManagementType, ResourceId, TimeGenerated\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet JobUnderAzureDiagnostics = ()\r\n{\r\nlet JobTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Job\" and SchemaVersion_s == \"V2\"\r\n// Exclude Log Jobs and InProgress Jobs\r\n| project JobOperation = columnifexists(\"JobOperation_s\", \"\") , JobOperationSubType = columnifexists(\"JobOperationSubType_s\", \"\"), JobUniqueIdGuid = columnifexists(\"JobUniqueId_g\", \"\") , JobUniqueIdStr = columnifexists(\"JobUniqueId_s\", \"\"),\r\nProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\",\"\"), AdHocOrScheduledJob = columnifexists(\"AdHocOrScheduledJob_s\",\"\"), RecoveryJobDestination = columnifexists(\"RecoveryJobDestination_s\",\"\"),\r\nRecoveryJobRPDateTime = todatetime(columnifexists(\"RecoveryJobRPDateTime_s\",\"\")), RecoveryJobRPLocation = columnifexists(\"RecoveryJobRPLocation_s\",\"\"), RecoveryLocationType = columnifexists(\"RecoveryLocationType_s\",\"\"),\r\nBackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\",\"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\",\"\"), VaultUniqueId = columnifexists(\"VaultUniqueId_s\",\"\"),\r\nJobStatus = columnifexists(\"JobStatus_s\",\"\"), JobFailureCode = columnifexists(\"JobFailureCode_s\",\"\"), JobStartDateTime = todatetime(columnifexists(\"JobStartDateTime_s\",\"\")), JobDurationInSecs = todouble(columnifexists(\"JobDurationInSecs_s\", \"\")),\r\nDataTransferredInMB = todouble(columnifexists(\"DataTransferredInMB_s\",\"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\",\"\"), TimeGenerated, ResourceId\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\")) \r\n| extend JobUniqueId = iff(JobUniqueIdGuid == \"\", JobUniqueIdStr, JobUniqueIdGuid) \r\n| project-away JobUniqueIdGuid, JobUniqueIdStr\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId ;\r\nVaultUnderAzureDiagnostics | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderResourceSpecific = ()\r\n{\r\nlet JobTable = AddonAzureBackupJobs \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Job\" \r\n// Exclude Log Jobs and InProgress Jobs\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\"))\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| where BackupItemUniqueId != \"\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet LatestBackupItemWithProtectedContainerTable = () \r\n{\r\nTotalBackupItemDimensionTable\r\n| join (CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics()),\r\n(BackupItemAssociationWithProtectedContainerUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId) on BackupItemUniqueId\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\nLatestBackupItemWithProtectedContainerTable | distinct BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestJobTableBasedOnBackupItem = (){\r\n CombinedTable | union isfuzzy = true \r\n(JobUnderAzureDiagnostics()\r\n| where BackupItemUniqueId != \"\"\r\n),\r\n(JobUnderResourceSpecific()\r\n| where BackupItemUniqueId != \"\"\r\n)\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId\r\n| join kind= rightouter (LatestBackupItemInfoTable) on BackupItemUniqueId\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId = BackupItemUniqueId1, ResourceId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n};\r\nlet LatestJobTable = () { \r\nLatestJobTableBasedOnBackupItem()\r\n| where JobUniqueId != \"\"\r\n| distinct JobOperation}; \r\nLatestJobTable", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "49be13b9-6869-4cb2-94e0-b122508d1efb", + "version": "KqlParameterItem/1.0", + "name": "JobStatus", + "label": "Job Status", + "type": 2, + "description": "Use to filter by Job Status", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*", + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"Completed\", \"label\":\"Succeeded\" },\r\n { \"value\":\"Failed\", \"label\":\"Failed\" },\r\n { \"value\":\"CompletedWithWarnings\", \"label\":\"SucceededWithWarnings\" },\r\n { \"value\":\"Cancelled\", \"label\":\"Cancelled\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "84fef06a-bc14-40e3-a6c5-68647b3f5474", + "version": "KqlParameterItem/1.0", + "name": "JobFailureCode", + "label": "Job Failure Code", + "type": 2, + "description": "Use to filter by Job Failure Code", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// Time variable used ******************** Using ExtRange For artifacts ******************************\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\nlet ExtRangeStart = RangeStart - 2d;\r\nlet ExtRangeEnd = RangeEnd + 2d;\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\n\r\n//search\r\nlet Item_search = @\"{ContainerNameWithBackupItemName}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\"); \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderAzureDiagnostics = ()\r\n{\r\nlet BackupManagementServerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupManagementServer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not projecting BackupManagementServerVersion, BackupManagementServerOSVersion due to special handling like NewBackupManagementServerUniqueId\r\n| project OldBackupManagementServerUniqueId = columnifexists(\"BackupManagmentServerUniqueId_s\", \"\"), NewBackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), BackupManagementServerName = columnifexists(\"BackupManagementServerName_s\", \"\"), AzureBackupAgentVersion = columnifexists(\"AzureBackupAgentVersion_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), ResourceId, TimeGenerated\r\n| extend BackupManagementServerUniqueId = iff(NewBackupManagementServerUniqueId == \"\", OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId) \r\n| project-away OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderResourceSpecific = ()\r\n{\r\nlet BackupManagementServerTable =CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupManagementServer\" and State != \"Deleted\"\r\n| project BackupManagementServerUniqueId, BackupManagementServerName, AzureBackupAgentVersion, BackupManagementType, ResourceId, TimeGenerated\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet JobUnderAzureDiagnostics = ()\r\n{\r\nlet JobTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Job\" and SchemaVersion_s == \"V2\"\r\n// Exclude Log Jobs and InProgress Jobs\r\n| project JobOperation = columnifexists(\"JobOperation_s\", \"\") , JobOperationSubType = columnifexists(\"JobOperationSubType_s\", \"\"), JobUniqueIdGuid = columnifexists(\"JobUniqueId_g\", \"\") , JobUniqueIdStr = columnifexists(\"JobUniqueId_s\", \"\"),\r\nProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\",\"\"), AdHocOrScheduledJob = columnifexists(\"AdHocOrScheduledJob_s\",\"\"), RecoveryJobDestination = columnifexists(\"RecoveryJobDestination_s\",\"\"),\r\nRecoveryJobRPDateTime = todatetime(columnifexists(\"RecoveryJobRPDateTime_s\",\"\")), RecoveryJobRPLocation = columnifexists(\"RecoveryJobRPLocation_s\",\"\"), RecoveryLocationType = columnifexists(\"RecoveryLocationType_s\",\"\"),\r\nBackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\",\"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\",\"\"), VaultUniqueId = columnifexists(\"VaultUniqueId_s\",\"\"),\r\nJobStatus = columnifexists(\"JobStatus_s\",\"\"), JobFailureCode = columnifexists(\"JobFailureCode_s\",\"\"), JobStartDateTime = todatetime(columnifexists(\"JobStartDateTime_s\",\"\")), JobDurationInSecs = todouble(columnifexists(\"JobDurationInSecs_s\", \"\")),\r\nDataTransferredInMB = todouble(columnifexists(\"DataTransferredInMB_s\",\"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\",\"\"), TimeGenerated, ResourceId\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\")) \r\n| extend JobUniqueId = iff(JobUniqueIdGuid == \"\", JobUniqueIdStr, JobUniqueIdGuid) \r\n| project-away JobUniqueIdGuid, JobUniqueIdStr\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId ;\r\nVaultUnderAzureDiagnostics | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderResourceSpecific = ()\r\n{\r\nlet JobTable = AddonAzureBackupJobs \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Job\" \r\n// Exclude Log Jobs and InProgress Jobs\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\"))\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| where BackupItemUniqueId != \"\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet LatestBackupItemWithProtectedContainerTable = () \r\n{\r\nTotalBackupItemDimensionTable\r\n| join (CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics()),\r\n(BackupItemAssociationWithProtectedContainerUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId) on BackupItemUniqueId\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\nLatestBackupItemWithProtectedContainerTable | distinct BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestJobTableBasedOnBackupItem = (){\r\n CombinedTable | union isfuzzy = true \r\n(JobUnderAzureDiagnostics()\r\n| where BackupItemUniqueId != \"\"\r\n),\r\n(JobUnderResourceSpecific()\r\n| where BackupItemUniqueId != \"\"\r\n)\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId\r\n| where JobOperation in ({JobOperation}) or '*' in ({JobOperation})\r\n| where JobStatus in ({JobStatus}) or '*' in ({JobStatus})\r\n| join kind= rightouter (LatestBackupItemInfoTable) on BackupItemUniqueId\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId = BackupItemUniqueId1, ResourceId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n};\r\nlet LatestJobTable = () { \r\nLatestJobTableBasedOnBackupItem()\r\n| where JobUniqueId != \"\"\r\n| distinct JobFailureCode\r\n| where not (JobFailureCode == \"Success\" or JobFailureCode == \"\")}; \r\nLatestJobTable ", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "JobDistribution-TopParameterBlock" + }, + { + "type": 1, + "content": { + "json": "________________________" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "JobDistribution-DividingLine1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used ******************** Using ExtRange For artifacts ******************************\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet ExtRangeStart = RangeStart - 2d;\r\nlet ExtRangeEnd = RangeEnd + 2d;\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet JobOperationParam = todynamic(strcat( \"[\", @\"{JobOperation}\", \"]\")); \r\nlet JobStatusParam = todynamic(strcat( \"[\", @\"{JobStatus}\", \"]\"));\r\nlet JobFailureCodeParam = todynamic(strcat( \"[\", @\"{JobFailureCode}\", \"]\"));\r\n//search\r\nlet Item_search = @\"{ContainerNameWithBackupItemName}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\"); \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderAzureDiagnostics = ()\r\n{\r\nlet BackupManagementServerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupManagementServer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not projecting BackupManagementServerVersion, BackupManagementServerOSVersion due to special handling like NewBackupManagementServerUniqueId\r\n| project OldBackupManagementServerUniqueId = columnifexists(\"BackupManagmentServerUniqueId_s\", \"\"), NewBackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), BackupManagementServerName = columnifexists(\"BackupManagementServerName_s\", \"\"), AzureBackupAgentVersion = columnifexists(\"AzureBackupAgentVersion_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), ResourceId, TimeGenerated\r\n| extend BackupManagementServerUniqueId = iff(NewBackupManagementServerUniqueId == \"\", OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId) \r\n| project-away OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderResourceSpecific = ()\r\n{\r\nlet BackupManagementServerTable =CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"BackupManagementServer\" and State != \"Deleted\"\r\n| project BackupManagementServerUniqueId, BackupManagementServerName, AzureBackupAgentVersion, BackupManagementType, ResourceId, TimeGenerated\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet JobUnderAzureDiagnostics = ()\r\n{\r\nlet JobTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Job\" and SchemaVersion_s == \"V2\"\r\n// Exclude Log Jobs and InProgress Jobs\r\n| project JobOperation = columnifexists(\"JobOperation_s\", \"\") , JobOperationSubType = columnifexists(\"JobOperationSubType_s\", \"\"), JobUniqueIdGuid = columnifexists(\"JobUniqueId_g\", \"\") , JobUniqueIdStr = columnifexists(\"JobUniqueId_s\", \"\"),\r\nProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\",\"\"), AdHocOrScheduledJob = columnifexists(\"AdHocOrScheduledJob_s\",\"\"), RecoveryJobDestination = columnifexists(\"RecoveryJobDestination_s\",\"\"),\r\nRecoveryJobRPDateTime = todatetime(columnifexists(\"RecoveryJobRPDateTime_s\",\"\")), RecoveryJobRPLocation = columnifexists(\"RecoveryJobRPLocation_s\",\"\"), RecoveryLocationType = columnifexists(\"RecoveryLocationType_s\",\"\"),\r\nBackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\",\"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\",\"\"), VaultUniqueId = columnifexists(\"VaultUniqueId_s\",\"\"),\r\nJobStatus = columnifexists(\"JobStatus_s\",\"\"), JobFailureCode = columnifexists(\"JobFailureCode_s\",\"\"), JobStartDateTime = todatetime(columnifexists(\"JobStartDateTime_s\",\"\")), JobDurationInSecs = todouble(columnifexists(\"JobDurationInSecs_s\", \"\")),\r\nDataTransferredInMB = todouble(columnifexists(\"DataTransferredInMB_s\",\"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\",\"\"), TimeGenerated, ResourceId\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\")) \r\n| extend JobUniqueId = iff(JobUniqueIdGuid == \"\", JobUniqueIdStr, JobUniqueIdGuid) \r\n| project-away JobUniqueIdGuid, JobUniqueIdStr\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId ;\r\nVaultUnderAzureDiagnostics | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderResourceSpecific = ()\r\n{\r\nlet JobTable = AddonAzureBackupJobs \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Job\" \r\n// Exclude Log Jobs and InProgress Jobs\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\"))\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| where BackupItemUniqueId != \"\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet LatestBackupItemWithProtectedContainerTable = () \r\n{\r\nTotalBackupItemDimensionTable\r\n| join (CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics()),\r\n(BackupItemAssociationWithProtectedContainerUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId) on BackupItemUniqueId\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\nLatestBackupItemWithProtectedContainerTable | distinct BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestJobTableBasedOnBackupItem = (){\r\n CombinedTable | union isfuzzy = true \r\n(JobUnderAzureDiagnostics()\r\n| where BackupItemUniqueId != \"\"\r\n),\r\n(JobUnderResourceSpecific()\r\n| where BackupItemUniqueId != \"\"\r\n)\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId\r\n| where JobOperation in (JobOperationParam) or '*' in (JobOperationParam)\r\n| where JobStatus in (JobStatusParam) or '*' in (JobStatusParam)\r\n| where JobFailureCode in (JobFailureCodeParam) or '*' in (JobFailureCodeParam)\r\n| join kind= rightouter (LatestBackupItemInfoTable) on BackupItemUniqueId\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId = BackupItemUniqueId1, ResourceId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n};\r\nlet LatestJobTable = materialize(\r\nLatestJobTableBasedOnBackupItem()\r\n| where JobUniqueId != \"\"\r\n| distinct JobStatus, JobUniqueId); \r\nlet JobSuccessPercent = LatestJobTable\r\n| extend success=iff((JobStatus == \"Completed\" or JobStatus == \"CompletedWithWarnings\") , 1 , 0)\r\n| extend record = 1 // to be used for total row count\r\n| summarize SuccessfulCount =sum(success), TotalCount=sum(record)\r\n| extend JobSuccessPercentage = (SuccessfulCount*100)/todouble(TotalCount)\r\n| project JobSuccessPercentage = iff( (isnan(JobSuccessPercentage) or isinf(JobSuccessPercentage) or isempty(JobSuccessPercentage)), \"-\", tostring(JobSuccessPercentage)) \r\n| extend Key = pack_array(\"Success %\"), Value = pack_array( JobSuccessPercentage), Row = pack_array(0)\r\n| project Key, Value, Row\r\n| mvexpand Key, Value, Row; \r\nlet JobStatusEnum = datatable (JobStatus:string, statusOrder:int, CustomJobStatus:string)\r\n [ \"Completed\", 1, \"Succeeded\",\r\n \"CompletedWithWarnings\", 2, \"SucceededWithWarnings\",\r\n \"Failed\", 3, \"Failed\",\r\n \"Cancelled\", 4, \"Cancelled\"];\r\nlet JobStatusTable = JobStatusEnum\r\n| join kind= leftouter (LatestJobTable | summarize dcount(JobUniqueId, 4) by JobStatus) \r\non JobStatus == JobStatus\r\n| project CustomJobStatus, JobStatus, JobCount = (iff(isempty(dcount_JobUniqueId), 0, dcount_JobUniqueId)), statusOrder\r\n| project-away JobStatus\r\n| order by statusOrder asc\r\n| extend Key = pack_array(CustomJobStatus), Value = pack_array( JobCount), Row = pack_array(statusOrder)\r\n| project Key, Value, Row\r\n| mvexpand Key, Value, Row;\r\nunion JobStatusTable, JobSuccessPercent \r\n| order by toint(Row) asc", + "size": 3, + "noDataMessage": "No records found for the selected time range and scope", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Key", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubTitle", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + "showBorder": true, + "sortCriteriaField": "Key", + "sortOrderField": 2 + } + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "JobDistribution-Tiles", + "styleSettings": { + "margin": "-10px 0% 0% -15px" + } + }, + { + "type": 1, + "content": { + "json": "_____________________________" + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "JobDistribution-DividingLine2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used ******************** Using ExtRange For artifacts ******************************\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\nlet ExtRangeStart = RangeStart - 2d;\r\nlet ExtRangeEnd = RangeEnd + 2d;\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet JobOperationParam = todynamic(strcat( \"[\", @\"{JobOperation}\", \"]\")); \r\nlet JobStatusParam = todynamic(strcat( \"[\", @\"{JobStatus}\", \"]\"));\r\nlet JobFailureCodeParam = todynamic(strcat( \"[\", @\"{JobFailureCode}\", \"]\"));\r\n//search\r\nlet Item_search = @\"{ContainerNameWithBackupItemName}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\"); \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderAzureDiagnostics = ()\r\n{\r\nlet BackupManagementServerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupManagementServer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not projecting BackupManagementServerVersion, BackupManagementServerOSVersion due to special handling like NewBackupManagementServerUniqueId\r\n| project OldBackupManagementServerUniqueId = columnifexists(\"BackupManagmentServerUniqueId_s\", \"\"), NewBackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), BackupManagementServerName = columnifexists(\"BackupManagementServerName_s\", \"\"), AzureBackupAgentVersion = columnifexists(\"AzureBackupAgentVersion_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), ResourceId, TimeGenerated\r\n| extend BackupManagementServerUniqueId = iff(NewBackupManagementServerUniqueId == \"\", OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId) \r\n| project-away OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderResourceSpecific = ()\r\n{\r\nlet BackupManagementServerTable =CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupManagementServer\" and State != \"Deleted\"\r\n| project BackupManagementServerUniqueId, BackupManagementServerName, AzureBackupAgentVersion, BackupManagementType, ResourceId, TimeGenerated\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet JobUnderAzureDiagnostics = ()\r\n{\r\nlet JobTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Job\" and SchemaVersion_s == \"V2\"\r\n// Exclude Log Jobs and InProgress Jobs\r\n| project JobOperation = columnifexists(\"JobOperation_s\", \"\") , JobOperationSubType = columnifexists(\"JobOperationSubType_s\", \"\"), JobUniqueIdGuid = columnifexists(\"JobUniqueId_g\", \"\") , JobUniqueIdStr = columnifexists(\"JobUniqueId_s\", \"\"),\r\nProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\",\"\"), AdHocOrScheduledJob = columnifexists(\"AdHocOrScheduledJob_s\",\"\"), RecoveryJobDestination = columnifexists(\"RecoveryJobDestination_s\",\"\"),\r\nRecoveryJobRPDateTime = todatetime(columnifexists(\"RecoveryJobRPDateTime_s\",\"\")), RecoveryJobRPLocation = columnifexists(\"RecoveryJobRPLocation_s\",\"\"), RecoveryLocationType = columnifexists(\"RecoveryLocationType_s\",\"\"),\r\nBackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\",\"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\",\"\"), VaultUniqueId = columnifexists(\"VaultUniqueId_s\",\"\"),\r\nJobStatus = columnifexists(\"JobStatus_s\",\"\"), JobFailureCode = columnifexists(\"JobFailureCode_s\",\"\"), JobStartDateTime = todatetime(columnifexists(\"JobStartDateTime_s\",\"\")), JobDurationInSecs = todouble(columnifexists(\"JobDurationInSecs_s\", \"\")),\r\nDataTransferredInMB = todouble(columnifexists(\"DataTransferredInMB_s\",\"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\",\"\"), TimeGenerated, ResourceId\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\")) \r\n| extend JobUniqueId = iff(JobUniqueIdGuid == \"\", JobUniqueIdStr, JobUniqueIdGuid) \r\n| project-away JobUniqueIdGuid, JobUniqueIdStr\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId ;\r\nVaultUnderAzureDiagnostics | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderResourceSpecific = ()\r\n{\r\nlet JobTable = AddonAzureBackupJobs \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Job\" \r\n// Exclude Log Jobs and InProgress Jobs\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\"))\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| where BackupItemUniqueId != \"\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet LatestBackupItemWithProtectedContainerTable = () \r\n{\r\nTotalBackupItemDimensionTable\r\n| join (CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics()),\r\n(BackupItemAssociationWithProtectedContainerUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId) on BackupItemUniqueId\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\nLatestBackupItemWithProtectedContainerTable | distinct BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestJobTableBasedOnBackupItem = (){\r\n CombinedTable | union isfuzzy = true \r\n(JobUnderAzureDiagnostics()\r\n| where BackupItemUniqueId != \"\"\r\n),\r\n(JobUnderResourceSpecific()\r\n| where BackupItemUniqueId != \"\"\r\n)\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId\r\n| where JobOperation in (JobOperationParam) or '*' in (JobOperationParam)\r\n| where JobStatus in (JobStatusParam) or '*' in (JobStatusParam)\r\n| where JobFailureCode in (JobFailureCodeParam) or '*' in (JobFailureCodeParam)\r\n| join kind= rightouter (LatestBackupItemInfoTable) on BackupItemUniqueId\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId = BackupItemUniqueId1, ResourceId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n};\r\nlet LatestJobTable = \r\nLatestJobTableBasedOnBackupItem()\r\n// Only When JobCount is >= 1\r\n| where JobUniqueId != \"\"; \r\nLatestJobTable\r\n| summarize arg_max(TimeGenerated, JobStatus) by JobUniqueId\r\n| summarize count(JobStatus) by JobStatus, bin(TimeGenerated, 1d)\r\n| project TimeGenerated, count_JobStatus, JobStatus = ( iff(JobStatus == \"Completed\", \"Succeeded\", iff(JobStatus == \"CompletedWithWarnings\", \"SucceededWithWarnings\", JobStatus)))\r\n| sort by count_JobStatus", + "size": 0, + "title": "Jobs by Status over Time", + "noDataMessage": "No records found for the selected time range and scope", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "barchart", + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "Failed", + "color": "red" + }, + { + "seriesName": "SucceededWithWarnings", + "color": "yellow" + }, + { + "seriesName": "Succeeded", + "color": "green" + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "JobDistribution-JobByStatusGraph" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used ******************** Using ExtRange For artifacts ******************************\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\nlet ExtRangeStart = RangeStart - 2d;\r\nlet ExtRangeEnd = RangeEnd + 2d;\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet JobOperationParam = todynamic(strcat( \"[\", @\"{JobOperation}\", \"]\")); \r\nlet JobStatusParam = todynamic(strcat( \"[\", @\"{JobStatus}\", \"]\"));\r\nlet JobFailureCodeParam = todynamic(strcat( \"[\", @\"{JobFailureCode}\", \"]\"));\r\n//search\r\nlet Item_search = @\"{ContainerNameWithBackupItemName}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\"); \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderAzureDiagnostics = ()\r\n{\r\nlet BackupManagementServerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupManagementServer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not projecting BackupManagementServerVersion, BackupManagementServerOSVersion due to special handling like NewBackupManagementServerUniqueId\r\n| project OldBackupManagementServerUniqueId = columnifexists(\"BackupManagmentServerUniqueId_s\", \"\"), NewBackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), BackupManagementServerName = columnifexists(\"BackupManagementServerName_s\", \"\"), AzureBackupAgentVersion = columnifexists(\"AzureBackupAgentVersion_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), ResourceId, TimeGenerated\r\n| extend BackupManagementServerUniqueId = iff(NewBackupManagementServerUniqueId == \"\", OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId) \r\n| project-away OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderResourceSpecific = ()\r\n{\r\nlet BackupManagementServerTable =CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupManagementServer\" and State != \"Deleted\"\r\n| project BackupManagementServerUniqueId, BackupManagementServerName, AzureBackupAgentVersion, BackupManagementType, ResourceId, TimeGenerated\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet JobUnderAzureDiagnostics = ()\r\n{\r\nlet JobTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Job\" and SchemaVersion_s == \"V2\"\r\n// Exclude Log Jobs and InProgress Jobs\r\n| project JobOperation = columnifexists(\"JobOperation_s\", \"\") , JobOperationSubType = columnifexists(\"JobOperationSubType_s\", \"\"), JobUniqueIdGuid = columnifexists(\"JobUniqueId_g\", \"\") , JobUniqueIdStr = columnifexists(\"JobUniqueId_s\", \"\"),\r\nProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\",\"\"), AdHocOrScheduledJob = columnifexists(\"AdHocOrScheduledJob_s\",\"\"), RecoveryJobDestination = columnifexists(\"RecoveryJobDestination_s\",\"\"),\r\nRecoveryJobRPDateTime = todatetime(columnifexists(\"RecoveryJobRPDateTime_s\",\"\")), RecoveryJobRPLocation = columnifexists(\"RecoveryJobRPLocation_s\",\"\"), RecoveryLocationType = columnifexists(\"RecoveryLocationType_s\",\"\"),\r\nBackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\",\"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\",\"\"), VaultUniqueId = columnifexists(\"VaultUniqueId_s\",\"\"),\r\nJobStatus = columnifexists(\"JobStatus_s\",\"\"), JobFailureCode = columnifexists(\"JobFailureCode_s\",\"\"), JobStartDateTime = todatetime(columnifexists(\"JobStartDateTime_s\",\"\")), JobDurationInSecs = todouble(columnifexists(\"JobDurationInSecs_s\", \"\")),\r\nDataTransferredInMB = todouble(columnifexists(\"DataTransferredInMB_s\",\"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\",\"\"), TimeGenerated, ResourceId\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\")) \r\n| extend JobUniqueId = iff(JobUniqueIdGuid == \"\", JobUniqueIdStr, JobUniqueIdGuid) \r\n| project-away JobUniqueIdGuid, JobUniqueIdStr\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId ;\r\nVaultUnderAzureDiagnostics | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderResourceSpecific = ()\r\n{\r\nlet JobTable = AddonAzureBackupJobs \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Job\" \r\n// Exclude Log Jobs and InProgress Jobs\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\"))\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| where BackupItemUniqueId != \"\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet LatestBackupItemWithProtectedContainerTable = () \r\n{\r\nTotalBackupItemDimensionTable\r\n| join (CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics()),\r\n(BackupItemAssociationWithProtectedContainerUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId) on BackupItemUniqueId\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\nLatestBackupItemWithProtectedContainerTable | distinct BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestJobTableBasedOnBackupItem = (){\r\n CombinedTable | union isfuzzy = true \r\n(JobUnderAzureDiagnostics()\r\n| where BackupItemUniqueId != \"\"\r\n),\r\n(JobUnderResourceSpecific()\r\n| where BackupItemUniqueId != \"\"\r\n)\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId\r\n| where JobOperation in (JobOperationParam) or '*' in (JobOperationParam)\r\n| where JobStatus in (JobStatusParam) or '*' in (JobStatusParam)\r\n| where JobFailureCode in (JobFailureCodeParam) or '*' in (JobFailureCodeParam)\r\n| join kind= rightouter (LatestBackupItemInfoTable) on BackupItemUniqueId\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId = BackupItemUniqueId1, ResourceId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n};\r\nlet LatestJobTable = \r\nLatestJobTableBasedOnBackupItem()\r\n// Only When JobCount is >= 1\r\n| where JobUniqueId != \"\"; \r\nLatestJobTable\r\n| summarize JobStatus = any(JobStatus), JobOperation = any(JobOperation) by JobUniqueId\r\n| summarize count(JobStatus) by JobOperation, JobStatus\r\n| sort by count_JobStatus", + "size": 0, + "title": "Jobs by Job Operation", + "noDataMessage": "No records found for the selected time range and scope", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "categoricalbar", + "gridSettings": { + "sortBy": [ + { + "itemKey": "JobOperation", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "JobOperation", + "sortOrder": 1 + } + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "JobStatus", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_JobStatus", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "JobStatus", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "count_JobStatus", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "Backup", + "color": "grayBlue" + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "JobDistribution-JobsByOperationGraph" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used ******************** Using ExtRange For artifacts ******************************\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\nlet ExtRangeStart = RangeStart - 2d;\r\nlet ExtRangeEnd = RangeEnd + 2d;\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet JobOperationParam = todynamic(strcat( \"[\", @\"{JobOperation}\", \"]\")); \r\nlet JobStatusParam = todynamic(strcat( \"[\", @\"{JobStatus}\", \"]\"));\r\nlet JobFailureCodeParam = todynamic(strcat( \"[\", @\"{JobFailureCode}\", \"]\"));\r\n//search\r\nlet Item_search = @\"{ContainerNameWithBackupItemName}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\"); \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderAzureDiagnostics = ()\r\n{\r\nlet BackupManagementServerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupManagementServer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not projecting BackupManagementServerVersion, BackupManagementServerOSVersion due to special handling like NewBackupManagementServerUniqueId\r\n| project OldBackupManagementServerUniqueId = columnifexists(\"BackupManagmentServerUniqueId_s\", \"\"), NewBackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), BackupManagementServerName = columnifexists(\"BackupManagementServerName_s\", \"\"), AzureBackupAgentVersion = columnifexists(\"AzureBackupAgentVersion_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), ResourceId, TimeGenerated\r\n| extend BackupManagementServerUniqueId = iff(NewBackupManagementServerUniqueId == \"\", OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId) \r\n| project-away OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderResourceSpecific = ()\r\n{\r\nlet BackupManagementServerTable =CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupManagementServer\" and State != \"Deleted\"\r\n| project BackupManagementServerUniqueId, BackupManagementServerName, AzureBackupAgentVersion, BackupManagementType, ResourceId, TimeGenerated\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet JobUnderAzureDiagnostics = ()\r\n{\r\nlet JobTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Job\" and SchemaVersion_s == \"V2\"\r\n// Exclude Log Jobs and InProgress Jobs\r\n| project JobOperation = columnifexists(\"JobOperation_s\", \"\") , JobOperationSubType = columnifexists(\"JobOperationSubType_s\", \"\"), JobUniqueIdGuid = columnifexists(\"JobUniqueId_g\", \"\") , JobUniqueIdStr = columnifexists(\"JobUniqueId_s\", \"\"),\r\nProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\",\"\"), AdHocOrScheduledJob = columnifexists(\"AdHocOrScheduledJob_s\",\"\"), RecoveryJobDestination = columnifexists(\"RecoveryJobDestination_s\",\"\"),\r\nRecoveryJobRPDateTime = todatetime(columnifexists(\"RecoveryJobRPDateTime_s\",\"\")), RecoveryJobRPLocation = columnifexists(\"RecoveryJobRPLocation_s\",\"\"), RecoveryLocationType = columnifexists(\"RecoveryLocationType_s\",\"\"),\r\nBackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\",\"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\",\"\"), VaultUniqueId = columnifexists(\"VaultUniqueId_s\",\"\"),\r\nJobStatus = columnifexists(\"JobStatus_s\",\"\"), JobFailureCode = columnifexists(\"JobFailureCode_s\",\"\"), JobStartDateTime = todatetime(columnifexists(\"JobStartDateTime_s\",\"\")), JobDurationInSecs = todouble(columnifexists(\"JobDurationInSecs_s\", \"\")),\r\nDataTransferredInMB = todouble(columnifexists(\"DataTransferredInMB_s\",\"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\",\"\"), TimeGenerated, ResourceId\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\")) \r\n| extend JobUniqueId = iff(JobUniqueIdGuid == \"\", JobUniqueIdStr, JobUniqueIdGuid) \r\n| project-away JobUniqueIdGuid, JobUniqueIdStr\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId ;\r\nVaultUnderAzureDiagnostics | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderResourceSpecific = ()\r\n{\r\nlet JobTable = AddonAzureBackupJobs \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Job\" \r\n// Exclude Log Jobs and InProgress Jobs\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\"))\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| where BackupItemUniqueId != \"\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet LatestBackupItemWithProtectedContainerTable = () \r\n{\r\nTotalBackupItemDimensionTable\r\n| join (CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics()),\r\n(BackupItemAssociationWithProtectedContainerUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId) on BackupItemUniqueId\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\nLatestBackupItemWithProtectedContainerTable | distinct BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestJobTableBasedOnBackupItem = (){\r\n CombinedTable | union isfuzzy = true \r\n(JobUnderAzureDiagnostics()\r\n| where BackupItemUniqueId != \"\"\r\n),\r\n(JobUnderResourceSpecific()\r\n| where BackupItemUniqueId != \"\"\r\n)\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId\r\n| where JobOperation in (JobOperationParam) or '*' in (JobOperationParam)\r\n| where JobStatus in (JobStatusParam) or '*' in (JobStatusParam)\r\n| where JobFailureCode in (JobFailureCodeParam) or '*' in (JobFailureCodeParam)\r\n| join kind= rightouter (LatestBackupItemInfoTable) on BackupItemUniqueId\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId = BackupItemUniqueId1, ResourceId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n};\r\nlet LatestJobTable = \r\nLatestJobTableBasedOnBackupItem()\r\n// Only When JobCount is >= 1\r\n| where JobUniqueId != \"\"; \r\nLatestJobTable\r\n| where JobStatus == \"Failed\"\r\n| summarize JobFailureCode = any(JobFailureCode), JobOperation = any(JobOperation) by JobUniqueId\r\n| summarize count(JobOperation) by JobFailureCode\r\n| sort by count_JobOperation", + "size": 0, + "title": "Failed Jobs by Failure Code", + "noDataMessage": "No records found for the selected time range and scope", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "piechart" + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "JobDistribution-FailureCodeGraph" + }, + { + "type": 1, + "content": { + "json": "____________________________" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "JobDistribution-DividingLine3" + }, + { + "type": 1, + "content": { + "json": "
Distribution of Jobs in Period by Backup Item
" + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo", + "value": "" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "JobDistribution-Grid2Title", + "styleSettings": { + "margin": "0% 0% 10px 0%" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "5dc2a074-b510-44f2-9530-cfcbd159b59c", + "version": "KqlParameterItem/1.0", + "name": "JobMetricSortBy", + "label": "Sort By", + "type": 2, + "description": "Use to sort by a certain column", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[{ \"value\": \"FailureCount\", \"label\": \"# Jobs Failed\" },\r\n{ \"value\": \"AvgDataTransferred\", \"label\": \"Avg data transferred (MB)\" }, \r\n{ \"value\": \"AvgJobDuration\", \"label\": \"Avg Job Duration (hrs)\" },\r\n{ \"value\": \"SuccessPercent\", \"label\": \"Job Success %\", \"selected\": \"true\" }]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "df3cc03c-53f7-4523-a29b-e50bf1b6d922", + "version": "KqlParameterItem/1.0", + "name": "JobMetricOrder", + "label": "Order", + "type": 2, + "description": "Use to specify the sort order: Ascending/Descending", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"Ascending\", \"selected\":true},\r\n { \"value\":\"Descending\"}\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "2033073e-5e18-4e0f-a543-a03b98874d8d", + "version": "KqlParameterItem/1.0", + "name": "JobMetricRowsPerGrid", + "label": "Rows per Page", + "type": 2, + "description": "Number of rows to display in grid view", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":10, \"label\":\"10\", \"selected\":true },\r\n { \"value\":25, \"label\":\"25\" },\r\n { \"value\":50, \"label\":\"50\" },\r\n { \"value\":100, \"label\":\"100\" },\r\n { \"value\":250, \"label\":\"250\" },\r\n { \"value\":500, \"label\":\"500\" },\r\n { \"value\":1000, \"label\":\"1000\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "356e4bfd-7e3d-4e48-89c0-b03efb72b9dc", + "version": "KqlParameterItem/1.0", + "name": "JobMetricPageNumber", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "// Time variable used ******************** Using ExtRange For artifacts ******************************\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\nlet ExtRangeStart = RangeStart - 2d;\r\nlet ExtRangeEnd = RangeEnd + 2d;\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet JobOperationParam = todynamic(strcat( \"[\", @\"{JobOperation}\", \"]\")); \r\nlet JobStatusParam = todynamic(strcat( \"[\", @\"{JobStatus}\", \"]\"));\r\nlet JobFailureCodeParam = todynamic(strcat( \"[\", @\"{JobFailureCode}\", \"]\"));\r\n//search\r\nlet Item_search = @\"{ContainerNameWithBackupItemName}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\"); \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderAzureDiagnostics = ()\r\n{\r\nlet BackupManagementServerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupManagementServer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not projecting BackupManagementServerVersion, BackupManagementServerOSVersion due to special handling like NewBackupManagementServerUniqueId\r\n| project OldBackupManagementServerUniqueId = columnifexists(\"BackupManagmentServerUniqueId_s\", \"\"), NewBackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), BackupManagementServerName = columnifexists(\"BackupManagementServerName_s\", \"\"), AzureBackupAgentVersion = columnifexists(\"AzureBackupAgentVersion_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), ResourceId, TimeGenerated\r\n| extend BackupManagementServerUniqueId = iff(NewBackupManagementServerUniqueId == \"\", OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId) \r\n| project-away OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderResourceSpecific = ()\r\n{\r\nlet BackupManagementServerTable =CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupManagementServer\" and State != \"Deleted\"\r\n| project BackupManagementServerUniqueId, BackupManagementServerName, AzureBackupAgentVersion, BackupManagementType, ResourceId, TimeGenerated\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet JobUnderAzureDiagnostics = ()\r\n{\r\nlet JobTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Job\" and SchemaVersion_s == \"V2\"\r\n// Exclude Log Jobs and InProgress Jobs\r\n| project JobOperation = columnifexists(\"JobOperation_s\", \"\") , JobOperationSubType = columnifexists(\"JobOperationSubType_s\", \"\"), JobUniqueIdGuid = columnifexists(\"JobUniqueId_g\", \"\") , JobUniqueIdStr = columnifexists(\"JobUniqueId_s\", \"\"),\r\nProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\",\"\"), AdHocOrScheduledJob = columnifexists(\"AdHocOrScheduledJob_s\",\"\"), RecoveryJobDestination = columnifexists(\"RecoveryJobDestination_s\",\"\"),\r\nRecoveryJobRPDateTime = todatetime(columnifexists(\"RecoveryJobRPDateTime_s\",\"\")), RecoveryJobRPLocation = columnifexists(\"RecoveryJobRPLocation_s\",\"\"), RecoveryLocationType = columnifexists(\"RecoveryLocationType_s\",\"\"),\r\nBackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\",\"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\",\"\"), VaultUniqueId = columnifexists(\"VaultUniqueId_s\",\"\"),\r\nJobStatus = columnifexists(\"JobStatus_s\",\"\"), JobFailureCode = columnifexists(\"JobFailureCode_s\",\"\"), JobStartDateTime = todatetime(columnifexists(\"JobStartDateTime_s\",\"\")), JobDurationInSecs = todouble(columnifexists(\"JobDurationInSecs_s\", \"\")),\r\nDataTransferredInMB = todouble(columnifexists(\"DataTransferredInMB_s\",\"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\",\"\"), TimeGenerated, ResourceId\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\")) \r\n| extend JobUniqueId = iff(JobUniqueIdGuid == \"\", JobUniqueIdStr, JobUniqueIdGuid) \r\n| project-away JobUniqueIdGuid, JobUniqueIdStr\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId ;\r\nVaultUnderAzureDiagnostics | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderResourceSpecific = ()\r\n{\r\nlet JobTable = AddonAzureBackupJobs \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Job\" \r\n// Exclude Log Jobs and InProgress Jobs\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\"))\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| where BackupItemUniqueId != \"\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet LatestBackupItemWithProtectedContainerTable = () \r\n{\r\nTotalBackupItemDimensionTable\r\n| join (CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics()),\r\n(BackupItemAssociationWithProtectedContainerUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId) on BackupItemUniqueId\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\nLatestBackupItemWithProtectedContainerTable | distinct BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestJobTableBasedOnBackupItem = (){\r\n CombinedTable | union isfuzzy = true \r\n(JobUnderAzureDiagnostics()\r\n| where BackupItemUniqueId != \"\"\r\n),\r\n(JobUnderResourceSpecific()\r\n| where BackupItemUniqueId != \"\"\r\n)\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId\r\n| where JobOperation in (JobOperationParam) or '*' in (JobOperationParam)\r\n| where JobStatus in (JobStatusParam) or '*' in (JobStatusParam)\r\n| where JobFailureCode in (JobFailureCodeParam) or '*' in (JobFailureCodeParam)\r\n| join kind= rightouter (LatestBackupItemInfoTable) on BackupItemUniqueId\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId = BackupItemUniqueId1, ResourceId\r\n};\r\nlet LatestJobTable = ()\r\n{ \r\n// Showing only BackupItem based Jobs\r\nLatestJobTableBasedOnBackupItem()\r\n| where JobUniqueId != \"\" or BackupItemUniqueId != \"\"\r\n}; \r\nlet JobMetric = ()\r\n{\r\n// Calculate percentage\r\nLatestJobTable\r\n| extend failed=iff(JobStatus == \"Failed\" , 1 , 0)\r\n| extend record = iff(JobUniqueId != \"\", 1, 0) // to be used for total row count\r\n| summarize FailureCount =sum(failed), TotalCount=sum(record), AvgDataTransferred =avg(DataTransferredInMB), AvgJobDuration = avg(JobDurationInSecs)/3600, \r\nBackupItemFriendlyName = any(BackupItemFriendlyName), BackupItemName = any(BackupItemName), ProtectedContainerFriendlyName = any(ProtectedContainerFriendlyName), ProtectedContainerName = any(ProtectedContainerName), BackupManagementType = any(BackupManagementType), BackupItemType = any(BackupItemType), ResourceId = any(ResourceId) by BackupItemUniqueId\r\n| extend SuccessPercent = ((TotalCount - FailureCount) *100)/todouble(TotalCount)\r\n};\r\nJobMetric\r\n| summarize c=count()\r\n| project num = (c-1)/{JobMetricRowsPerGrid} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "90", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "parameters - 7", + "styleSettings": { + "margin": "-23px 0% 0% 0%", + "padding": "0% 0% 0% 0%" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used ******************** Using ExtRange For artifacts ******************************\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\nlet ExtRangeStart = RangeStart - 2d;\r\nlet ExtRangeEnd = RangeEnd + 2d;\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet JobOperationParam = todynamic(strcat( \"[\", @\"{JobOperation}\", \"]\")); \r\nlet JobStatusParam = todynamic(strcat( \"[\", @\"{JobStatus}\", \"]\"));\r\nlet JobFailureCodeParam = todynamic(strcat( \"[\", @\"{JobFailureCode}\", \"]\"));\r\n//search\r\nlet Item_search = @\"{ContainerNameWithBackupItemName}\";\r\nlet ItemArray = split(Item_search, \";\");\r\nlet ItemArray_length = array_length(ItemArray);\r\nlet BI_search = iff(ItemArray_length == 2, ItemArray[1], ItemArray[0] );\r\nlet Container_search = iff(ItemArray_length == 2, ItemArray[0], \"\"); \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderAzureDiagnostics = ()\r\n{\r\nlet BackupManagementServerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupManagementServer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not projecting BackupManagementServerVersion, BackupManagementServerOSVersion due to special handling like NewBackupManagementServerUniqueId\r\n| project OldBackupManagementServerUniqueId = columnifexists(\"BackupManagmentServerUniqueId_s\", \"\"), NewBackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), BackupManagementServerName = columnifexists(\"BackupManagementServerName_s\", \"\"), AzureBackupAgentVersion = columnifexists(\"AzureBackupAgentVersion_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), ResourceId, TimeGenerated\r\n| extend BackupManagementServerUniqueId = iff(NewBackupManagementServerUniqueId == \"\", OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId) \r\n| project-away OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderResourceSpecific = ()\r\n{\r\nlet BackupManagementServerTable =CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupManagementServer\" and State != \"Deleted\"\r\n| project BackupManagementServerUniqueId, BackupManagementServerName, AzureBackupAgentVersion, BackupManagementType, ResourceId, TimeGenerated\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet JobUnderAzureDiagnostics = ()\r\n{\r\nlet JobTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Job\" and SchemaVersion_s == \"V2\"\r\n// Exclude Log Jobs and InProgress Jobs\r\n| project JobOperation = columnifexists(\"JobOperation_s\", \"\") , JobOperationSubType = columnifexists(\"JobOperationSubType_s\", \"\"), JobUniqueIdGuid = columnifexists(\"JobUniqueId_g\", \"\") , JobUniqueIdStr = columnifexists(\"JobUniqueId_s\", \"\"),\r\nProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\",\"\"), AdHocOrScheduledJob = columnifexists(\"AdHocOrScheduledJob_s\",\"\"), RecoveryJobDestination = columnifexists(\"RecoveryJobDestination_s\",\"\"),\r\nRecoveryJobRPDateTime = todatetime(columnifexists(\"RecoveryJobRPDateTime_s\",\"\")), RecoveryJobRPLocation = columnifexists(\"RecoveryJobRPLocation_s\",\"\"), RecoveryLocationType = columnifexists(\"RecoveryLocationType_s\",\"\"),\r\nBackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\",\"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\",\"\"), VaultUniqueId = columnifexists(\"VaultUniqueId_s\",\"\"),\r\nJobStatus = columnifexists(\"JobStatus_s\",\"\"), JobFailureCode = columnifexists(\"JobFailureCode_s\",\"\"), JobStartDateTime = todatetime(columnifexists(\"JobStartDateTime_s\",\"\")), JobDurationInSecs = todouble(columnifexists(\"JobDurationInSecs_s\", \"\")),\r\nDataTransferredInMB = todouble(columnifexists(\"DataTransferredInMB_s\",\"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\",\"\"), TimeGenerated, ResourceId\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\")) \r\n| extend JobUniqueId = iff(JobUniqueIdGuid == \"\", JobUniqueIdStr, JobUniqueIdGuid) \r\n| project-away JobUniqueIdGuid, JobUniqueIdStr\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId ;\r\nVaultUnderAzureDiagnostics | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderResourceSpecific = ()\r\n{\r\nlet JobTable = AddonAzureBackupJobs \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Job\" \r\n// Exclude Log Jobs and InProgress Jobs\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\"))\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| where BackupItemUniqueId != \"\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet LatestBackupItemWithProtectedContainerTable = () \r\n{\r\nTotalBackupItemDimensionTable\r\n| join (CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics()),\r\n(BackupItemAssociationWithProtectedContainerUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId) on BackupItemUniqueId\r\n| where isempty(Container_search) or Container_search == \"*\" or ProtectedContainerFriendlyName contains (Container_search)\r\n| where isempty(BI_search) or BI_search == \"*\" or BackupItemFriendlyName contains (BI_search)\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\nLatestBackupItemWithProtectedContainerTable | distinct BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestJobTableBasedOnBackupItem = (){\r\n CombinedTable | union isfuzzy = true \r\n(JobUnderAzureDiagnostics()\r\n| where BackupItemUniqueId != \"\"\r\n),\r\n(JobUnderResourceSpecific()\r\n| where BackupItemUniqueId != \"\"\r\n)\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId\r\n| where JobOperation in (JobOperationParam) or '*' in (JobOperationParam)\r\n| where JobStatus in (JobStatusParam) or '*' in (JobStatusParam)\r\n| where JobFailureCode in (JobFailureCodeParam) or '*' in (JobFailureCodeParam)\r\n| join kind= rightouter (LatestBackupItemInfoTable) on BackupItemUniqueId\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId = BackupItemUniqueId1, ResourceId\r\n};\r\nlet LatestJobTable = ()\r\n{ \r\n// Showing only BackupItem based Jobs\r\nLatestJobTableBasedOnBackupItem()\r\n| where JobUniqueId != \"\" or BackupItemUniqueId != \"\"\r\n}; \r\nlet JobMetric = ()\r\n{\r\n// Calculate percentage\r\nLatestJobTable\r\n| extend failed=iff(JobStatus == \"Failed\" , 1 , 0)\r\n| extend record = iff(JobUniqueId != \"\", 1, 0) // to be used for total row count\r\n| summarize FailureCount =sum(failed), TotalCount=sum(record), AvgDataTransferred =avg(DataTransferredInMB), AvgJobDuration = avg(JobDurationInSecs)/3600, \r\nBackupItemFriendlyName = any(BackupItemFriendlyName), BackupItemName = any(BackupItemName), ProtectedContainerFriendlyName = any(ProtectedContainerFriendlyName), ProtectedContainerName = any(ProtectedContainerName), BackupManagementType = any(BackupManagementType), BackupItemType = any(BackupItemType), ResourceId = any(ResourceId) by BackupItemUniqueId\r\n| extend SuccessPercent = ((TotalCount - FailureCount) *100)/todouble(TotalCount)\r\n};\r\nJobMetric\r\n| extend TempColumn = column_ifexists(tostring('{JobMetricSortBy}'), \"SuccessPercent\")\r\n| extend ColumnToBeSorted = iff(tostring('{JobMetricOrder}') == \"Ascending\", todouble(TempColumn) - 90000000, 90000000 - todouble(TempColumn))\r\n| sort by ColumnToBeSorted asc nulls last, BackupItemUniqueId asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{JobMetricRowsPerGrid} + 1))\r\n| where page_num has ('{JobMetricPageNumber}') or '*' in ('{JobMetricPageNumber}')\r\n| extend prefix = array_strcat(array_split(split(ResourceId,\"/\"), 4)[0] ,\"/\")\r\n| extend containerNameString = iff(array_length(split(ProtectedContainerName,\";\")) == 3, ProtectedContainerName, \"\")\r\n| parse containerNameString with entityType:string \";\" rgName:string \";\" entityName:string\r\n| extend entityTypeForAzureStorageUrl = iff((BackupManagementType == \"AzureStorage\" and BackupItemType == \"AzureFileShare\"), iff(entityType == \"storage\", \"/Microsoft.Storage/storageAccounts/\", \"/Microsoft.ClassicStorage/storageAccounts/\"), \"\")\r\n| extend entityTypeForIaaSVMUrl = iff((BackupManagementType == \"IaaSVM\" and BackupItemType == \"VM\"), iff(entityType =~ \"iaasvmcontainerv2\", \"/Microsoft.Compute/virtualMachines/\", \"/Microsoft.ClassicCompute/virtualMachines/\"), \"\")\r\n| extend entityTypeForAzureWorkloadUrl = iff(((BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SAPHanaDatabase\") or (BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SQLDataBase\")), iff(entityType =~ \"compute\", \"/Microsoft.Compute/virtualMachines/\", \"/Microsoft.ClassicCompute/virtualMachines/\"), \"\")\r\n| extend AzureResource = iff(BackupManagementType in (\"DPM\", \"AzureBackupServer\", \"MAB\"), \"\" , iff(containerNameString != \"\", strcat(prefix, \"/\", rgName, \"/providers\", entityTypeForAzureStorageUrl, entityTypeForIaaSVMUrl, entityTypeForAzureWorkloadUrl, entityName), ResourceId))\r\n| extend BackupItemLink = iff ((BackupManagementType == \"IaaSVM\" and BackupItemType == \"VM\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/IaasVMContainer;\", ProtectedContainerName, \"/protectedItems/VM;\", ProtectedContainerName),\r\niff((BackupManagementType == \"AzureStorage\" and BackupItemType == \"AzureFileShare\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/StorageContainer;\", ProtectedContainerName, \"/protectedItems/AzureFileShare;\", BackupItemName) , \r\niff((BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SQLDataBase\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/VMAppContainer;\", ProtectedContainerName, \"/protectedItems/SQLDataBase;\", BackupItemName) , \r\niff((BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SAPHanaDatabase\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/VMAppContainer;\", ProtectedContainerName, \"/protectedItems/SAPHanaDatabase;\", BackupItemName), \"\"))))\r\n| extend container_array = split(ProtectedContainerName,\";\")\r\n| extend container_arraylen = array_length(container_array)\r\n| project BackupItemName = BackupItemFriendlyName, ContainerName = ProtectedContainerFriendlyName, ContainerResourceGroup = iff(container_arraylen == 3, container_array[(container_arraylen-2)], \"(none)\"), FailureCount, SuccessPercent = iff( (isnan(SuccessPercent) or isinf(SuccessPercent) or isempty(SuccessPercent)), \"-\", strcat(tostring(round(SuccessPercent,2)), \" %\")), AvgDataTransferred = iff( (isnan(AvgDataTransferred) or isinf(AvgDataTransferred) or isempty(AvgDataTransferred)), \"-\", tostring(round(AvgDataTransferred,2))) ,AvgJobDuration = iff( (isnan(AvgJobDuration) or isinf(AvgJobDuration) or isempty(AvgJobDuration)), \"-\", tostring(round(AvgJobDuration,2))), AzureResource, BackupItemLink, BackupItemUniqueId, TotalCount, TempColumn, ColumnToBeSorted", + "size": 3, + "noDataMessage": "No records found for the selected time range and scope", + "exportFieldName": "BackupItemUniqueId", + "exportParameterName": "SelectedContainerNameWithBackupItemName", + "exportDefaultValue": "*", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "BackupItemName", + "formatter": 16, + "formatOptions": { + "linkColumn": "BackupItemLink", + "linkTarget": "Resource", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Backup Item" + } + }, + { + "columnMatch": "ContainerName", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Protected Container associated with the Backup Item" + } + }, + { + "columnMatch": "ContainerResourceGroup", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Resource Group of the Backup Item" + } + }, + { + "columnMatch": "FailureCount", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Number of Jobs (that were triggered in the selected time range) on the given Backup Item that failed" + } + }, + { + "columnMatch": "SuccessPercent", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "% of Jobs (that were triggered in the selected time range) on the Backup Item that were successful" + } + }, + { + "columnMatch": "AvgDataTransferred", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "minimumFractionDigits": 2, + "maximumFractionDigits": 2 + } + }, + "tooltipFormat": { + "tooltip": "Avg data transferred by Jobs (that were triggered in the selected time range) on the Backup Item" + } + }, + { + "columnMatch": "AvgJobDuration", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "minimumFractionDigits": 2, + "maximumFractionDigits": 2 + } + }, + "tooltipFormat": { + "tooltip": "Avg duration of Jobs (that were triggered in the selected time range) on the Backup Item" + } + }, + { + "columnMatch": "AzureResource", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Azure Resource associated with the Backup Item. For Azure VM Backup, SQL in Azure VM backup and SAP database in Azure VM backup, the Azure Resource is the Azure VM. For Azure Files Share backup, the Azure Resource is the Azure Storage account. For on-premises Backup Items, this field is blank." + } + }, + { + "columnMatch": "BackupItemLink", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "BackupItemUniqueId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TotalCount", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TempColumn", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ColumnToBeSorted", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "labelSettings": [ + { + "columnId": "BackupItemName", + "label": "Backup Item" + }, + { + "columnId": "ContainerName", + "label": "Container" + }, + { + "columnId": "ContainerResourceGroup", + "label": "Resource Group" + }, + { + "columnId": "FailureCount", + "label": "# Jobs Failed" + }, + { + "columnId": "SuccessPercent", + "label": "Job Success %" + }, + { + "columnId": "AvgDataTransferred", + "label": "Avg Data Transferred (MB)" + }, + { + "columnId": "AvgJobDuration", + "label": "Avg Job Duration (hrs)" + }, + { + "columnId": "AzureResource", + "label": "Azure Resource" + }, + { + "columnId": "BackupItemLink" + }, + { + "columnId": "BackupItemUniqueId" + }, + { + "columnId": "TotalCount" + }, + { + "columnId": "TempColumn" + }, + { + "columnId": "ColumnToBeSorted" + } + ] + }, + "sortBy": [] + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "JobDistribution-Grid1", + "styleSettings": { + "padding": "0% 0% 0% 0%", + "showBorder": true + } + }, + { + "type": 1, + "content": { + "json": " Click on any row above to see details of all jobs for that backup item in the seletced time range. " + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "text - 66" + }, + { + "type": 1, + "content": { + "json": "
List of Jobs in Period
" + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "SelectedContainerNameWithBackupItemName", + "comparison": "isNotEqualTo", + "value": "*" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "text - 17", + "styleSettings": { + "margin": "0% 0% 10px 0%" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "5dc2a074-b510-44f2-9530-cfcbd159b59c", + "version": "KqlParameterItem/1.0", + "name": "JobMetricSortBy2", + "label": "Sort By", + "type": 2, + "description": "Use to sort by a certain column", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[{ \"value\": \"JobDurationInSecs\", \"label\": \"Job Duration (hrs)\" },\r\n{ \"value\": \"DataTransferredInMB\", \"label\": \"Data Transferred (MB)\", \"selected\": \"true\" }]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "df3cc03c-53f7-4523-a29b-e50bf1b6d922", + "version": "KqlParameterItem/1.0", + "name": "JobMetricOrder2", + "label": "Order", + "type": 2, + "description": "Use to specify the sort order: Ascending/Descending", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"Ascending\"},\r\n { \"value\":\"Descending\", \"selected\":true}\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "90453a1f-7fd0-45d4-a2ef-cd36b4a834e0", + "version": "KqlParameterItem/1.0", + "name": "JobMetricRowsPerGrid2", + "label": "Rows per Page", + "type": 2, + "description": "Number of rows to display in grid view", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":10, \"label\":\"10\", \"selected\":true },\r\n { \"value\":25, \"label\":\"25\" },\r\n { \"value\":50, \"label\":\"50\" },\r\n { \"value\":100, \"label\":\"100\" },\r\n { \"value\":250, \"label\":\"250\" },\r\n { \"value\":500, \"label\":\"500\" },\r\n { \"value\":1000, \"label\":\"1000\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "356e4bfd-7e3d-4e48-89c0-b03efb72b9dc", + "version": "KqlParameterItem/1.0", + "name": "JobMetricPageNumber2", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "// Time variable used ******************** Using ExtRange For artifacts ******************************\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\nlet ExtRangeStart = RangeStart - 2d;\r\nlet ExtRangeEnd = RangeEnd + 2d;\r\n// BMSTypeWithBackupItemType MappingTable\r\nlet BMSTypeWithBackupItemTypeMappingTable = datatable (BMSTypeWithBackupItemType:string, CustomBMSTypeWithBackupItemType:string)\r\n [ \"AzureWorkload/SAPHanaDatabase\", \"SAP HANA in Azure VM/SAP HANA in Azure VM\",\r\n \"AzureWorkload/SQLDataBase\", \"SQL in Azure VM/SQL Database\",\r\n \"IaaSVM/VM\", \"Azure Virtual Machine/Azure VM\",\r\n\t \"AzureStorage/AzureFileShare\", \"Azure Storage (Azure Files)/Azure File Share\",\r\n\t \"MAB/FileFolder\", \"Azure Backup Agent/Files and Folder\",\r\n\t \"DPM/SQLDB\", \"DPM/SQL Database\",\r\n\t \"DPM/VMwareVM\", \"DPM/VMWare VM\",\r\n\t \"DPM/HyperVVM\", \"DPM/Hyper-V VM\",\r\n\t \"DPM/FileFolder\", \"DPM/Files and Folder\",\r\n\t \"DPM/Client\", \"DPM/Client\",\r\n\t \"DPM/SystemState\", \"DPM/System State\",\r\n\t \"DPM/Sharepoint\", \"DPM/Sharepoint Database\",\r\n\t \"DPM/Exchange\", \"DPM/Exchange Mailbox Database\",\r\n\t \"AzureBackupServer/SQLDB\", \"Azure Backup Server/SQL Database\",\r\n\t \"AzureBackupServer/VMwareVM\", \"Azure Backup Server/VMWare VM\",\r\n\t \"AzureBackupServer/HyperVVM\", \"Azure Backup Server/Hyper-V VM\",\r\n\t \"AzureBackupServer/FileFolder\", \"Azure Backup Server/Files and Folder\",\r\n\t \"AzureBackupServer/Client\", \"Azure Backup Server/Client\",\r\n\t \"AzureBackupServer/SystemState\", \"Azure Backup Server/System State\",\r\n\t \"AzureBackupServer/Sharepoint\", \"Azure Backup Server/Sharepoint Database\",\r\n\t \"AzureBackupServer/Exchange\", \"Azure Backup Server/Exchange Mailbox Database\"];\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet JobOperationParam = todynamic(strcat( \"[\", @\"{JobOperation}\", \"]\")); \r\nlet JobStatusParam = todynamic(strcat( \"[\", @\"{JobStatus}\", \"]\"));\r\nlet JobFailureCodeParam = todynamic(strcat( \"[\", @\"{JobFailureCode}\", \"]\"));\r\nlet SelectedContainerNameWithBackupItemNameParam = @\"{SelectedContainerNameWithBackupItemName}\";\t \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderAzureDiagnostics = ()\r\n{\r\nlet BackupManagementServerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupManagementServer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not projecting BackupManagementServerVersion, BackupManagementServerOSVersion due to special handling like NewBackupManagementServerUniqueId\r\n| project OldBackupManagementServerUniqueId = columnifexists(\"BackupManagmentServerUniqueId_s\", \"\"), NewBackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), BackupManagementServerName = columnifexists(\"BackupManagementServerName_s\", \"\"), AzureBackupAgentVersion = columnifexists(\"AzureBackupAgentVersion_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), ResourceId, TimeGenerated\r\n| extend BackupManagementServerUniqueId = iff(NewBackupManagementServerUniqueId == \"\", OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId) \r\n| project-away OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderResourceSpecific = ()\r\n{\r\nlet BackupManagementServerTable =CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupManagementServer\" and State != \"Deleted\"\r\n| project BackupManagementServerUniqueId, BackupManagementServerName, AzureBackupAgentVersion, BackupManagementType, ResourceId, TimeGenerated\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet JobUnderAzureDiagnostics = ()\r\n{\r\nlet JobTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Job\" and SchemaVersion_s == \"V2\"\r\n// Exclude Log Jobs and InProgress Jobs\r\n| project JobOperation = columnifexists(\"JobOperation_s\", \"\") , JobOperationSubType = columnifexists(\"JobOperationSubType_s\", \"\"), JobUniqueIdGuid = columnifexists(\"JobUniqueId_g\", \"\") , JobUniqueIdStr = columnifexists(\"JobUniqueId_s\", \"\"),\r\nProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\",\"\"), AdHocOrScheduledJob = columnifexists(\"AdHocOrScheduledJob_s\",\"\"), RecoveryJobDestination = columnifexists(\"RecoveryJobDestination_s\",\"\"),\r\nRecoveryJobRPDateTime = todatetime(columnifexists(\"RecoveryJobRPDateTime_s\",\"\")), RecoveryJobRPLocation = columnifexists(\"RecoveryJobRPLocation_s\",\"\"), RecoveryLocationType = columnifexists(\"RecoveryLocationType_s\",\"\"),\r\nBackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\",\"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\",\"\"), VaultUniqueId = columnifexists(\"VaultUniqueId_s\",\"\"),\r\nJobStatus = columnifexists(\"JobStatus_s\",\"\"), JobFailureCode = columnifexists(\"JobFailureCode_s\",\"\"), JobStartDateTime = todatetime(columnifexists(\"JobStartDateTime_s\",\"\")), JobDurationInSecs = todouble(columnifexists(\"JobDurationInSecs_s\", \"\")),\r\nDataTransferredInMB = todouble(columnifexists(\"DataTransferredInMB_s\",\"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\",\"\"), TimeGenerated, ResourceId\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\")) \r\n| extend JobUniqueId = iff(JobUniqueIdGuid == \"\", JobUniqueIdStr, JobUniqueIdGuid) \r\n| project-away JobUniqueIdGuid, JobUniqueIdStr\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId ;\r\nVaultUnderAzureDiagnostics | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderResourceSpecific = ()\r\n{\r\nlet JobTable = AddonAzureBackupJobs \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Job\" \r\n// Exclude Log Jobs and InProgress Jobs\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\"))\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| where BackupItemUniqueId != \"\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet LatestBackupItemWithProtectedContainerTable = () \r\n{\r\nTotalBackupItemDimensionTable\r\n| join (CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics()),\r\n(BackupItemAssociationWithProtectedContainerUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId) on BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, ResourceId\r\n| where BackupItemUniqueId == (SelectedContainerNameWithBackupItemNameParam) or '*' in (SelectedContainerNameWithBackupItemNameParam)\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\nLatestBackupItemWithProtectedContainerTable | distinct BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestJobTableBasedOnBackupItem = (){\r\n CombinedTable | union isfuzzy = true \r\n(JobUnderAzureDiagnostics()\r\n| where BackupItemUniqueId != \"\"\r\n),\r\n(JobUnderResourceSpecific()\r\n| where BackupItemUniqueId != \"\"\r\n)\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId\r\n| where JobOperation in (JobOperationParam) or '*' in (JobOperationParam)\r\n| where JobStatus in (JobStatusParam) or '*' in (JobStatusParam)\r\n| where JobFailureCode in (JobFailureCodeParam) or '*' in (JobFailureCodeParam)\r\n| join kind= rightouter (LatestBackupItemInfoTable) on BackupItemUniqueId\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId = BackupItemUniqueId1, JobStartDateTime, AdHocOrScheduledJob, ResourceId\r\n};\r\nlet LatestJobTable = ()\r\n{LatestJobTableBasedOnBackupItem()\r\n// Show only BackupItems which has Jobs\r\n| where JobUniqueId != \"\" \r\n}; \r\nLatestJobTable\r\n| summarize c=count()\r\n| project num = (c-1)/{JobMetricRowsPerGrid2} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "90", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "SelectedContainerNameWithBackupItemName", + "comparison": "isNotEqualTo", + "value": "*" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "JobDistribution-Grid2ParameterBlock", + "styleSettings": { + "margin": "-23px 0% 0% 0%", + "padding": "0% 0% 0% 0%" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used ******************** Using ExtRange For artifacts ******************************\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\nlet ExtRangeStart = RangeStart - 2d;\r\nlet ExtRangeEnd = RangeEnd + 2d;\r\n// BMSTypeWithBackupItemType MappingTable\r\nlet BMSTypeWithBackupItemTypeMappingTable = datatable (BMSTypeWithBackupItemType:string, CustomBMSTypeWithBackupItemType:string)\r\n [ \"AzureWorkload/SAPHanaDatabase\", \"SAP HANA in Azure VM/SAP HANA in Azure VM\",\r\n \"AzureWorkload/SQLDataBase\", \"SQL in Azure VM/SQL Database\",\r\n \"IaaSVM/VM\", \"Azure Virtual Machine/Azure VM\",\r\n\t \"AzureStorage/AzureFileShare\", \"Azure Storage (Azure Files)/Azure File Share\",\r\n\t \"MAB/FileFolder\", \"Azure Backup Agent/Files and Folder\",\r\n\t \"DPM/SQLDB\", \"DPM/SQL Database\",\r\n\t \"DPM/VMwareVM\", \"DPM/VMWare VM\",\r\n\t \"DPM/HyperVVM\", \"DPM/Hyper-V VM\",\r\n\t \"DPM/FileFolder\", \"DPM/Files and Folder\",\r\n\t \"DPM/Client\", \"DPM/Client\",\r\n\t \"DPM/SystemState\", \"DPM/System State\",\r\n\t \"DPM/Sharepoint\", \"DPM/Sharepoint Database\",\r\n\t \"DPM/Exchange\", \"DPM/Exchange Mailbox Database\",\r\n\t \"AzureBackupServer/SQLDB\", \"Azure Backup Server/SQL Database\",\r\n\t \"AzureBackupServer/VMwareVM\", \"Azure Backup Server/VMWare VM\",\r\n\t \"AzureBackupServer/HyperVVM\", \"Azure Backup Server/Hyper-V VM\",\r\n\t \"AzureBackupServer/FileFolder\", \"Azure Backup Server/Files and Folder\",\r\n\t \"AzureBackupServer/Client\", \"Azure Backup Server/Client\",\r\n\t \"AzureBackupServer/SystemState\", \"Azure Backup Server/System State\",\r\n\t \"AzureBackupServer/Sharepoint\", \"Azure Backup Server/Sharepoint Database\",\r\n\t \"AzureBackupServer/Exchange\", \"Azure Backup Server/Exchange Mailbox Database\"];\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet JobOperationParam = todynamic(strcat( \"[\", @\"{JobOperation}\", \"]\")); \r\nlet JobStatusParam = todynamic(strcat( \"[\", @\"{JobStatus}\", \"]\"));\r\nlet JobFailureCodeParam = todynamic(strcat( \"[\", @\"{JobFailureCode}\", \"]\"));\r\nlet SelectedContainerNameWithBackupItemNameParam = @\"{SelectedContainerNameWithBackupItemName}\";\t \r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderAzureDiagnostics = ()\r\n{\r\nlet BackupManagementServerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupManagementServer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not projecting BackupManagementServerVersion, BackupManagementServerOSVersion due to special handling like NewBackupManagementServerUniqueId\r\n| project OldBackupManagementServerUniqueId = columnifexists(\"BackupManagmentServerUniqueId_s\", \"\"), NewBackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), BackupManagementServerName = columnifexists(\"BackupManagementServerName_s\", \"\"), AzureBackupAgentVersion = columnifexists(\"AzureBackupAgentVersion_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), ResourceId, TimeGenerated\r\n| extend BackupManagementServerUniqueId = iff(NewBackupManagementServerUniqueId == \"\", OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId) \r\n| project-away OldBackupManagementServerUniqueId, NewBackupManagementServerUniqueId\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupManagementServerUnderResourceSpecific = ()\r\n{\r\nlet BackupManagementServerTable =CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupManagementServer\" and State != \"Deleted\"\r\n| project BackupManagementServerUniqueId, BackupManagementServerName, AzureBackupAgentVersion, BackupManagementType, ResourceId, TimeGenerated\r\n| summarize arg_max(TimeGenerated, *) by BackupManagementServerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupManagementServerTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet BackupItemAssociationWithProtectedContainerUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | project ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName\r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific\r\n) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, VaultUniqueId, BackupManagementType, \r\nTimeGenerated\r\n};\r\nlet JobUnderAzureDiagnostics = ()\r\n{\r\nlet JobTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Job\" and SchemaVersion_s == \"V2\"\r\n// Exclude Log Jobs and InProgress Jobs\r\n| project JobOperation = columnifexists(\"JobOperation_s\", \"\") , JobOperationSubType = columnifexists(\"JobOperationSubType_s\", \"\"), JobUniqueIdGuid = columnifexists(\"JobUniqueId_g\", \"\") , JobUniqueIdStr = columnifexists(\"JobUniqueId_s\", \"\"),\r\nProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\",\"\"), AdHocOrScheduledJob = columnifexists(\"AdHocOrScheduledJob_s\",\"\"), RecoveryJobDestination = columnifexists(\"RecoveryJobDestination_s\",\"\"),\r\nRecoveryJobRPDateTime = todatetime(columnifexists(\"RecoveryJobRPDateTime_s\",\"\")), RecoveryJobRPLocation = columnifexists(\"RecoveryJobRPLocation_s\",\"\"), RecoveryLocationType = columnifexists(\"RecoveryLocationType_s\",\"\"),\r\nBackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\",\"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\",\"\"), VaultUniqueId = columnifexists(\"VaultUniqueId_s\",\"\"),\r\nJobStatus = columnifexists(\"JobStatus_s\",\"\"), JobFailureCode = columnifexists(\"JobFailureCode_s\",\"\"), JobStartDateTime = todatetime(columnifexists(\"JobStartDateTime_s\",\"\")), JobDurationInSecs = todouble(columnifexists(\"JobDurationInSecs_s\", \"\")),\r\nDataTransferredInMB = todouble(columnifexists(\"DataTransferredInMB_s\",\"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\",\"\"), TimeGenerated, ResourceId\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\")) \r\n| extend JobUniqueId = iff(JobUniqueIdGuid == \"\", JobUniqueIdStr, JobUniqueIdGuid) \r\n| project-away JobUniqueIdGuid, JobUniqueIdStr\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId ;\r\nVaultUnderAzureDiagnostics | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderResourceSpecific = ()\r\n{\r\nlet JobTable = AddonAzureBackupJobs \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Job\" \r\n// Exclude Log Jobs and InProgress Jobs\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\"))\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| where BackupItemUniqueId != \"\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet LatestBackupItemWithProtectedContainerTable = () \r\n{\r\nTotalBackupItemDimensionTable\r\n| join (CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationWithProtectedContainerUnderAzureDiagnostics()),\r\n(BackupItemAssociationWithProtectedContainerUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId) on BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, BackupManagementType, BackupItemType, ResourceId\r\n| where BackupItemUniqueId == (SelectedContainerNameWithBackupItemNameParam) or '*' in (SelectedContainerNameWithBackupItemNameParam)\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\nLatestBackupItemWithProtectedContainerTable | distinct BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, ResourceId\r\n};\r\nlet LatestJobTableBasedOnBackupItem = (){\r\n CombinedTable | union isfuzzy = true \r\n(JobUnderAzureDiagnostics()\r\n| where BackupItemUniqueId != \"\"\r\n),\r\n(JobUnderResourceSpecific()\r\n| where BackupItemUniqueId != \"\"\r\n)\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId\r\n| where JobOperation in (JobOperationParam) or '*' in (JobOperationParam)\r\n| where JobStatus in (JobStatusParam) or '*' in (JobStatusParam)\r\n| where JobFailureCode in (JobFailureCodeParam) or '*' in (JobFailureCodeParam)\r\n| join kind= rightouter (LatestBackupItemInfoTable) on BackupItemUniqueId\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, DataTransferredInMB = tostring(round(DataTransferredInMB,2)), JobDurationInSecs =tostring(round((JobDurationInSecs/3600),2)), BackupItemUniqueId = BackupItemUniqueId1, JobStartDateTime, AdHocOrScheduledJob, ResourceId\r\n};\r\nlet LatestJobTable = ()\r\n{LatestJobTableBasedOnBackupItem()\r\n// Show only BackupItems which has Jobs\r\n| where JobUniqueId != \"\" \r\n}; \r\n//JobUniqueId*, BackupItemName*, TimeGenerated*, Failure Code*, Data Transferred*, Duration*, Adhoc, Operation* \r\nlet OutputTable = () {LatestJobTable\r\n| extend TempColumn = column_ifexists(tostring('{JobMetricSortBy2}'), \"DataTransferredInMB\")\r\n| extend ColumnToBeSorted = iff(tostring('{JobMetricOrder2}') == \"Ascending\", todouble(TempColumn) - 90000000, 90000000 - todouble(TempColumn))\r\n| sort by ColumnToBeSorted asc nulls last, JobUniqueId asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{JobMetricRowsPerGrid2} + 1))\r\n| where page_num has ('{JobMetricPageNumber2}') or '*' in ('{JobMetricPageNumber2}')\r\n| extend prefix = array_strcat(array_split(split(ResourceId,\"/\"), 4)[0] ,\"/\")\r\n| extend containerNameString = iff(array_length(split(ProtectedContainerName,\";\")) == 3, ProtectedContainerName, \"\")\r\n| parse containerNameString with entityType:string \";\" rgName:string \";\" entityName:string\r\n| extend entityTypeForAzureStorageUrl = iff((BackupManagementType == \"AzureStorage\" and BackupItemType == \"AzureFileShare\"), iff(entityType == \"storage\", \"/Microsoft.Storage/storageAccounts/\", \"/Microsoft.ClassicStorage/storageAccounts/\"), \"\")\r\n| extend entityTypeForIaaSVMUrl = iff((BackupManagementType == \"IaaSVM\" and BackupItemType == \"VM\"), iff(entityType =~ \"iaasvmcontainerv2\", \"/Microsoft.Compute/virtualMachines/\", \"/Microsoft.ClassicCompute/virtualMachines/\"), \"\")\r\n| extend entityTypeForAzureWorkloadUrl = iff(((BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SAPHanaDatabase\") or (BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SQLDataBase\")), iff(entityType =~ \"compute\", \"/Microsoft.Compute/virtualMachines/\", \"/Microsoft.ClassicCompute/virtualMachines/\"), \"\")\r\n| extend AzureResource = iff(BackupManagementType in (\"DPM\", \"AzureBackupServer\", \"MAB\"), \"\" , iff(containerNameString != \"\", strcat(prefix, \"/\", rgName, \"/providers\", entityTypeForAzureStorageUrl, entityTypeForIaaSVMUrl, entityTypeForAzureWorkloadUrl, entityName), ResourceId))\r\n| extend BackupItemLink = iff ((BackupManagementType == \"IaaSVM\" and BackupItemType == \"VM\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/IaasVMContainer;\", ProtectedContainerName, \"/protectedItems/VM;\", ProtectedContainerName),\r\niff((BackupManagementType == \"AzureStorage\" and BackupItemType == \"AzureFileShare\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/StorageContainer;\", ProtectedContainerName, \"/protectedItems/AzureFileShare;\", BackupItemName) , \r\niff((BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SQLDataBase\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/VMAppContainer;\", ProtectedContainerName, \"/protectedItems/SQLDataBase;\", BackupItemName) , \r\niff((BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SAPHanaDatabase\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/VMAppContainer;\", ProtectedContainerName, \"/protectedItems/SAPHanaDatabase;\", BackupItemName), \"\"))))\r\n| extend container_array = split(ProtectedContainerName,\";\")\r\n| extend container_arraylen = array_length(container_array)\r\n| project ExtractedBackupItemName = BackupItemFriendlyName, ExtractedContainerName = ProtectedContainerFriendlyName, ContainerResourceGroup = iff(container_arraylen == 3, container_array[(container_arraylen-2)], \"(none)\"), BMSTypeWithBackupItemType = strcat(BackupManagementType, \"/\", BackupItemType), JobOperation, JobStatus = ( iff(JobStatus == \"Completed\", \"Succeeded\", iff(JobStatus == \"CompletedWithWarnings\", \"SucceededWithWarnings\", JobStatus))), JobUniqueId, JobStartDateTime, JobDuration = JobDurationInSecs, JobFailureCode, DataTransferredInMB, TempColumn, ColumnToBeSorted, AzureResource, BackupItemLink};\r\nlet CustomOutputTable = () {BMSTypeWithBackupItemTypeMappingTable\r\n| join kind= rightouter (OutputTable) \r\non BMSTypeWithBackupItemType\r\n| project ExtractedBackupItemName, ExtractedContainerName, ContainerResourceGroup, BMSTypeWithBackupItemType = iff(CustomBMSTypeWithBackupItemType == \"\",BMSTypeWithBackupItemType1 ,CustomBMSTypeWithBackupItemType ), JobOperation, JobStatus, JobUniqueId, JobStartDateTime, JobDuration, JobFailureCode, DataTransferredInMB, TempColumn, ColumnToBeSorted, AzureResource, BackupItemLink\r\n| parse BMSTypeWithBackupItemType with ExtractedBMSType:string \"/\" ExtractedBackupItemType:string\r\n| project BackupItemName=ExtractedBackupItemName, ContainerName=ExtractedContainerName, ContainerResourceGroup, JobOperation, JobStatus, JobUniqueId, JobStartDateTime, JobDuration, JobFailureCode, DataTransferredInMB, TempColumn, ColumnToBeSorted, AzureResource, BackupItemLink, ExtractedBMSType, ExtractedBackupItemType\r\n};\r\nCustomOutputTable", + "size": 3, + "noDataMessage": "No records found for the selected time range and scope", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "BackupItemName", + "formatter": 16, + "formatOptions": { + "linkColumn": "BackupItemLink", + "linkTarget": "Resource", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Backup Item" + } + }, + { + "columnMatch": "ContainerName", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Protected Container associated with the Backup Item" + } + }, + { + "columnMatch": "ContainerResourceGroup", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Resource Group of the Backup Item" + } + }, + { + "columnMatch": "JobOperation", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Job Operation" + } + }, + { + "columnMatch": "JobStatus", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Job Status" + } + }, + { + "columnMatch": "JobUniqueId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "JobStartDateTime", + "formatter": 6, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + }, + "dateFormat": { + "showUtcTime": true, + "formatName": "shortDateTimePattern" + }, + "tooltipFormat": { + "tooltip": "Start date and time of the Job" + } + }, + { + "columnMatch": "JobDuration", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumFractionDigits": 2, + "maximumFractionDigits": 2 + } + }, + "tooltipFormat": { + "tooltip": "Job Duration" + } + }, + { + "columnMatch": "JobFailureCode", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Job Failure Code" + } + }, + { + "columnMatch": "DataTransferredInMB", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "minimumFractionDigits": 2, + "maximumFractionDigits": 2 + } + }, + "tooltipFormat": { + "tooltip": "Data Transferred by the Job" + } + }, + { + "columnMatch": "TempColumn", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ColumnToBeSorted", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "AzureResource", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Azure Resource associated with the Backup Item. For Azure VM Backup, SQL in Azure VM backup and SAP database in Azure VM backup, the Azure Resource is the Azure VM. For Azure Files Share backup, the Azure Resource is the Azure Storage account. For on-premises Backup Items, this field is blank." + } + }, + { + "columnMatch": "BackupItemLink", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ExtractedBMSType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Management Type" + } + }, + { + "columnMatch": "ExtractedBackupItemType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Item Type" + } + } + ], + "labelSettings": [ + { + "columnId": "BackupItemName", + "label": "Backup Item" + }, + { + "columnId": "ContainerName", + "label": "Container" + }, + { + "columnId": "ContainerResourceGroup", + "label": "Resource Group" + }, + { + "columnId": "JobOperation", + "label": "Job Operation" + }, + { + "columnId": "JobStatus", + "label": "Job Status" + }, + { + "columnId": "JobUniqueId" + }, + { + "columnId": "JobStartDateTime", + "label": "Job Start Date Time" + }, + { + "columnId": "JobDuration", + "label": "Job Duration (hrs)" + }, + { + "columnId": "JobFailureCode", + "label": "Job Failure Code" + }, + { + "columnId": "DataTransferredInMB", + "label": "Data Transferred (MB)" + }, + { + "columnId": "TempColumn" + }, + { + "columnId": "ColumnToBeSorted" + }, + { + "columnId": "AzureResource" + }, + { + "columnId": "BackupItemLink" + }, + { + "columnId": "ExtractedBMSType", + "label": "Backup Management Type" + }, + { + "columnId": "ExtractedBackupItemType", + "label": "Backup Item Type" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "JobDistribution" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "SelectedContainerNameWithBackupItemName", + "comparison": "isNotEqualTo", + "value": "*" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "JobDistribution-Grid2", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "padding": "0% 0% -20px 0%", + "showBorder": true + } + } + ] + }, + "name": "group - 0" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/jobdistribution-tab/settings.json b/Azure Backup/Workbooks/jobdistribution-tab/settings.json new file mode 100644 index 0000000..b62f87a --- /dev/null +++ b/Azure Backup/Workbooks/jobdistribution-tab/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Job Distribution Report", + "author": "Microsoft", + "galleries": [] +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/policydetails-tab/policydetails-tab.workbook b/Azure Backup/Workbooks/policydetails-tab/policydetails-tab.workbook new file mode 100644 index 0000000..b3c8a8f --- /dev/null +++ b/Azure Backup/Workbooks/policydetails-tab/policydetails-tab.workbook @@ -0,0 +1,1228 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "a29464c3-34f0-4d60-82bb-614b8128b7f9", + "version": "KqlParameterItem/1.0", + "name": "PolicyName", + "label": "Search Policy Name", + "type": 1, + "description": "Use to search by Policy Name", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "90", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "PolicyDetails-SearchParameterBlock", + "styleSettings": { + "margin": "0% 0% 0% 0%" + } + }, + { + "type": 1, + "content": { + "json": "______________" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "PolicyDetails-DividingLine1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet PolicyNameParam = @\"{PolicyName}\";\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n// Not Projecting ProtectedContainerUniqueId - DPM ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n// Not Projecting ProtectedContainerUniqueId - DPM ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId, BackupManagementServerUniqueId, StorageUniqueId, StorageConsumedInMBs, StorageAllocatedInMBs, TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderAzureDiagnostics = ()\r\n{\r\nlet PolicyTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where OperationName == \"Policy\" and SchemaVersion_s == \"V2\"\r\n| project PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"), PolicyName = PolicyName_s, ResourceId, TimeGenerated\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), PolicyName, ResourceId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderAzureDiagnostics | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderResourceSpecific = ()\r\n{\r\nlet PolicyTable = AddonAzureBackupPolicy\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Policy\" \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderResourceSpecific | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderAzureDiagnostics | project PolicyUniqueId, PolicyName, ResourceId) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet BackupItemAssociationAndStorageConsumptionUnderResourceSpecific = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderResourceSpecific | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet LatestBackupItemAssociationAndStorageConsumptionTable = ()\r\n{\r\nLatestBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n)on BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, ProtectedContainerUniqueId, ProtectedContainerName, BackupManagementServerUniqueId, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState,PolicyName, ResourceId, TimeGenerated, StorageReplicationType\r\n};\r\nlet PolicyTable = () {LatestBackupItemAssociationAndStorageConsumptionTable\r\n| where PolicyName contains (PolicyNameParam) or '*' in (PolicyNameParam)\r\n};\r\nlet ActivePolicyCount = () \r\n{PolicyTable \r\n| summarize count(BackupItemUniqueId) by PolicyUniqueId, ResourceId\r\n| extend active = iff(PolicyUniqueId != \"\", 1, 0)\r\n| summarize ActivePolicy = sum(active)\r\n| extend Key = pack_array(\"Active Policies\"), Value = pack_array( ActivePolicy), SubText = pack_array(\"Count\"), Row = pack_array(-2)\r\n| project Key, Value, SubText, Row\r\n| mvexpand Key, Value, SubText, Row};\r\nlet StorageByStorageReplication = ()\r\n{PolicyTable\r\n| summarize sum(StorageConsumedInMBs) by StorageReplicationType \r\n| order by StorageReplicationType \r\n// The below two values are temporary StorageReplicationType during vault creation\r\n| where StorageReplicationType !in (\"Invalid\", \"\")\r\n| extend rn = row_number()\r\n| extend Key = pack_array(StorageReplicationType), Value = pack_array( sum_StorageConsumedInMBs/1024), SubText = pack_array(\"Cloud Storage (GB)\"), Row = pack_array(rn)\r\n| project Key, Value, SubText, Row\r\n| mvexpand Key, Value, SubText, Row\r\n};\r\nunion ActivePolicyCount, StorageByStorageReplication \r\n| order by toint(Row) asc\r\n| order by toint(Row) asc", + "size": 3, + "noDataMessage": "No records found for the selected time range and scope", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Key", + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubText", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + }, + "showBorder": true + } + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "PolicyDetails-Tiles" + }, + { + "type": 1, + "content": { + "json": "______________" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "PolicyDetails-DividingLine2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\")); \r\nlet PolicyNameParam = @\"{PolicyName}\";\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationHistoryUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationHistoryUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeHistoryUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeHistoryUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationHistoryUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationHistoryUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today \r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderAzureDiagnostics = ()\r\n{\r\nlet PolicyTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where OperationName == \"Policy\" and SchemaVersion_s == \"V2\"\r\n| project PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"), PolicyName = PolicyName_s, ResourceId, TimeGenerated\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), PolicyName, ResourceId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderAzureDiagnostics | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderResourceSpecific = ()\r\n{\r\nlet PolicyTable = AddonAzureBackupPolicy\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Policy\" \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderResourceSpecific | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState};\r\nlet BackupItemAssociationAndStorageConsumptionHistoryUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationHistoryUnderAzureDiagnostics | project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n// To-do: Figure out why ResourceId is needed for policy join\r\n PolicyUnderAzureDiagnostics | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId , TimeRangeEndDay\r\n | join kind= leftouter (\r\n BackupItemFrontEndSizeHistoryUnderAzureDiagnostics | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId \r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeGenerated, TimeRangeEndDay, BackupItemUniqueId, BackupItemFrontEndSize, PolicyUniqueId, PolicyName, ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay\r\n| join kind= leftouter (\r\n StorageAssociationHistoryUnderAzureDiagnostics | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project BackupItemUniqueId,TimeGenerated, TimeRangeEndDay,ResourceId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, PolicyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs \r\n};\r\nlet BackupItemAssociationAndStorageConsumptionHistoryUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationHistoryUnderResourceSpecific | project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n// To-do: Figure out why ResourceId is needed for policy join\r\n PolicyUnderResourceSpecific | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay \r\n | join kind= leftouter (\r\n BackupItemFrontEndSizeHistoryUnderResourceSpecific | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId \r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeGenerated, TimeRangeEndDay, BackupItemUniqueId, BackupItemFrontEndSize, PolicyUniqueId, PolicyName, ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay\r\n| join kind= leftouter (\r\n StorageAssociationHistoryUnderResourceSpecific | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project BackupItemUniqueId,TimeGenerated, TimeRangeEndDay,ResourceId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, PolicyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs \r\n};\r\n//LatestBackupItemAssociationAndStorageConsumptionHistoryTable\r\nlet partition_data = (p:long, n:long)\r\n{\r\nTotalBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionHistoryUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionHistoryUnderResourceSpecific())\r\n| where hash(BackupItemUniqueId, n) == p\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay)\r\n on BackupItemUniqueId\r\n| project TimeGenerated, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, PolicyUniqueId, PolicyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState, ResourceId, BackupItemUniqueId, TimeRangeEndDay\r\n};\r\nlet StorageHistoryMetric = ()\r\n{\r\n//LatestBackupItemAssociationAndStorageConsumptionHistoryTable\r\nunion hint.spread=5 hint.concurrency=5 (partition_data(0,5)), (partition_data(1,5)), (partition_data(2,5)), (partition_data(3,5)), (partition_data(4,5))\r\n| where PolicyName contains (PolicyNameParam) or '*' in (PolicyNameParam)\r\n};\r\nStorageHistoryMetric\r\n| where PolicyUniqueId != \"\"\r\n| summarize ActivePolicyCount = dcount(strcat(ResourceId, PolicyUniqueId), 4) by TimeRangeEndDay", + "size": 0, + "aggregation": 5, + "title": "Active Policy Trend", + "noDataMessage": "No records found for the selected time range and scope", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "gridSettings": { + "sortBy": [ + { + "itemKey": "TimeRangeEndDay", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "TimeRangeEndDay", + "sortOrder": 2 + } + ], + "chartSettings": { + "xAxis": "TimeRangeEndDay", + "seriesLabelSettings": [ + { + "seriesName": "ActivePolicyCount", + "label": "# Active Policies" + } + ] + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo", + "value": "" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "PolicyDetails-ActivePoliciesTrendGraph" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\")); \r\nlet PolicyNameParam = @\"{PolicyName}\";\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationHistoryUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationHistoryUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeHistoryUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeHistoryUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationHistoryUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationHistoryUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today \r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderAzureDiagnostics = ()\r\n{\r\nlet PolicyTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where OperationName == \"Policy\" and SchemaVersion_s == \"V2\"\r\n| project PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"), PolicyName = PolicyName_s, ResourceId, TimeGenerated\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), PolicyName, ResourceId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderAzureDiagnostics | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderResourceSpecific = ()\r\n{\r\nlet PolicyTable = AddonAzureBackupPolicy\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Policy\" \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderResourceSpecific | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState};\r\nlet BackupItemAssociationAndStorageConsumptionHistoryUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationHistoryUnderAzureDiagnostics | project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n// To-do: Figure out why ResourceId is needed for policy join\r\n PolicyUnderAzureDiagnostics | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId , TimeRangeEndDay\r\n | join kind= leftouter (\r\n BackupItemFrontEndSizeHistoryUnderAzureDiagnostics | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId \r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeGenerated, TimeRangeEndDay, BackupItemUniqueId, BackupItemFrontEndSize, PolicyUniqueId, PolicyName, ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay\r\n| join kind= leftouter (\r\n StorageAssociationHistoryUnderAzureDiagnostics | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project BackupItemUniqueId,TimeGenerated, TimeRangeEndDay,ResourceId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, PolicyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs \r\n};\r\nlet BackupItemAssociationAndStorageConsumptionHistoryUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationHistoryUnderResourceSpecific | project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n// To-do: Figure out why ResourceId is needed for policy join\r\n PolicyUnderResourceSpecific | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay \r\n | join kind= leftouter (\r\n BackupItemFrontEndSizeHistoryUnderResourceSpecific | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId \r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeGenerated, TimeRangeEndDay, BackupItemUniqueId, BackupItemFrontEndSize, PolicyUniqueId, PolicyName, ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay\r\n| join kind= leftouter (\r\n StorageAssociationHistoryUnderResourceSpecific | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project BackupItemUniqueId,TimeGenerated, TimeRangeEndDay,ResourceId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, PolicyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs \r\n};\r\n//LatestBackupItemAssociationAndStorageConsumptionHistoryTable\r\nlet partition_data = (p:long, n:long)\r\n{\r\nTotalBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionHistoryUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionHistoryUnderResourceSpecific())\r\n| where hash(BackupItemUniqueId, n) == p\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay)\r\n on BackupItemUniqueId\r\n| project TimeGenerated, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, PolicyUniqueId, PolicyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState, ResourceId, BackupItemUniqueId, TimeRangeEndDay\r\n};\r\nlet StorageHistoryMetric = ()\r\n{\r\n//LatestBackupItemAssociationAndStorageConsumptionHistoryTable\r\nunion hint.spread=5 hint.concurrency=5 (partition_data(0,5)), (partition_data(1,5)), (partition_data(2,5)), (partition_data(3,5)), (partition_data(4,5))\r\n| where PolicyName contains (PolicyNameParam) or '*' in (PolicyNameParam)\r\n};\r\nStorageHistoryMetric\r\n| summarize StorageConsumedInGBs = sum(StorageConsumedInMBs)/(1024) by TimeRangeEndDay", + "size": 0, + "aggregation": 5, + "title": "Cloud Storage Trend", + "noDataMessage": "No records found for the selected time range and scope", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "gridSettings": { + "sortBy": [ + { + "itemKey": "TimeRangeEndDay", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "TimeRangeEndDay", + "sortOrder": 2 + } + ], + "chartSettings": { + "xAxis": "TimeRangeEndDay", + "seriesLabelSettings": [ + { + "seriesName": "StorageConsumedInMBs", + "label": "Cloud Storage (MB)" + }, + { + "seriesName": "StorageConsumedInGBs", + "label": "Cloud Storage (GB)" + } + ] + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo", + "value": "" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "PolicyDetails-CloudStorageTrendGraph" + }, + { + "type": 1, + "content": { + "json": "_________________" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "PolicyDetails-DividingLine3" + }, + { + "type": 1, + "content": { + "json": "
Backup Items and Storage by Policy
" + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "PolicyDetails-GridTitle1", + "styleSettings": { + "margin": "0% 0% 10px 0%" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "5dc2a074-b510-44f2-9530-cfcbd159b59c", + "version": "KqlParameterItem/1.0", + "name": "BillingMetricSortBy", + "label": "Sort By", + "type": 2, + "description": "Use to sort by a certain column", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[{ \"value\": \"count_BackupItemUniqueId\", \"label\": \"# BackupItems\" },\r\n{ \"value\": \"sum_StorageConsumedInMBs\", \"label\": \"Cloud Storage (MB)\", \"selected\": \"true\" }]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "df3cc03c-53f7-4523-a29b-e50bf1b6d922", + "version": "KqlParameterItem/1.0", + "name": "BillingMetricOrder", + "label": "Order", + "type": 2, + "description": "Use to specify the sort order: Ascending/Descending", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"Ascending\"},\r\n { \"value\":\"Descending\", \"selected\":true}\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "44b4c590-ecc4-4d3d-840e-16c4638000d4", + "version": "KqlParameterItem/1.0", + "name": "StorageMetricRowsPerGrid", + "label": "Rows Per Page", + "type": 2, + "description": "Number of rows to display in grid view", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":10, \"label\":\"10\", \"selected\":true },\r\n { \"value\":25, \"label\":\"25\" },\r\n { \"value\":50, \"label\":\"50\" },\r\n { \"value\":100, \"label\":\"100\" },\r\n { \"value\":250, \"label\":\"250\" },\r\n { \"value\":500, \"label\":\"500\" },\r\n { \"value\":1000, \"label\":\"1000\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "90478836-8cb6-4235-98a0-7724ac01d29a", + "version": "KqlParameterItem/1.0", + "name": "StorageMetricPageNumber", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet PolicyNameParam = @\"{PolicyName}\";\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId, BackupManagementServerUniqueId, StorageUniqueId, StorageConsumedInMBs, StorageAllocatedInMBs, TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderAzureDiagnostics = ()\r\n{\r\nlet PolicyTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where OperationName == \"Policy\" and SchemaVersion_s == \"V2\"\r\n| project PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"), PolicyName = PolicyName_s, ResourceId, TimeGenerated\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), PolicyName, ResourceId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderAzureDiagnostics | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderResourceSpecific = ()\r\n{\r\nlet PolicyTable = AddonAzureBackupPolicy\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Policy\" \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderResourceSpecific | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderAzureDiagnostics | project PolicyUniqueId, PolicyName, ResourceId) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet BackupItemAssociationAndStorageConsumptionUnderResourceSpecific = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderResourceSpecific | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet LatestBackupItemAssociationAndStorageConsumptionTable = ()\r\n{\r\nLatestBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n)on BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, \r\nBackupManagementType, BackupItemType, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState,PolicyName, ResourceId, TimeGenerated, StorageReplicationType\r\n};\r\nlet StorageMetric = ()\r\n{LatestBackupItemAssociationAndStorageConsumptionTable\r\n// Filter out Active Policies\r\n| where PolicyUniqueId != \"\"\r\n| where PolicyName contains (PolicyNameParam) or '*' in (PolicyNameParam)\r\n| summarize sum(BackupItemFrontEndSize), sum(StorageConsumedInMBs), count(BackupItemUniqueId), StorageReplicationType = any(StorageReplicationType), PolicyName = any(PolicyName), ResourceId = any(ResourceId), PolicyUniqueId = any(PolicyUniqueId) by PolicyLink = strcat(ResourceId, PolicyUniqueId)\r\n};\r\nStorageMetric\r\n| summarize c=count()\r\n| project num = (c-1)/{StorageMetricRowsPerGrid} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "90", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "PolicyDetails-Grid1ParameterBlock", + "styleSettings": { + "margin": "-23px 0% 0% 0%" + } + }, + { + "type": 1, + "content": { + "json": " Click on any row above to see all backup items associated with that policy." + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "text - 65" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet PolicyNameParam = @\"{PolicyName}\";\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId, BackupManagementServerUniqueId, StorageUniqueId, StorageConsumedInMBs, StorageAllocatedInMBs, TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderAzureDiagnostics = ()\r\n{\r\nlet PolicyTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where OperationName == \"Policy\" and SchemaVersion_s == \"V2\"\r\n| project PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"), PolicyName = PolicyName_s, ResourceId, TimeGenerated\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), PolicyName, ResourceId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderAzureDiagnostics | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderResourceSpecific = ()\r\n{\r\nlet PolicyTable = AddonAzureBackupPolicy\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Policy\" \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderResourceSpecific | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderAzureDiagnostics | project PolicyUniqueId, PolicyName, ResourceId) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet BackupItemAssociationAndStorageConsumptionUnderResourceSpecific = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderResourceSpecific | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet LatestBackupItemAssociationAndStorageConsumptionTable = ()\r\n{\r\nLatestBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n)on BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, \r\nBackupManagementType, BackupItemType, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState,PolicyName, ResourceId, TimeGenerated, StorageReplicationType\r\n};\r\nLatestBackupItemAssociationAndStorageConsumptionTable\r\n// Filter out Active Policies\r\n| where PolicyUniqueId != \"\"\r\n| where PolicyName contains (PolicyNameParam) or '*' in (PolicyNameParam)\r\n| summarize sum(BackupItemFrontEndSize), sum(StorageConsumedInMBs), count(BackupItemUniqueId), StorageReplicationType = any(StorageReplicationType), PolicyName = any(PolicyName), ResourceId = any(ResourceId), PolicyUniqueId = any(PolicyUniqueId) by PolicyLink = strcat(ResourceId, PolicyUniqueId)\r\n| extend TempColumn = column_ifexists(tostring('{BillingMetricSortBy}'), \"sum_StorageConsumedInMBs\")\r\n| extend ColumnToBeSorted = iff(tostring('{BillingMetricOrder}') == \"Ascending\", todouble(TempColumn) - 90000000, 90000000 - todouble(TempColumn))\r\n| sort by ColumnToBeSorted asc nulls last, PolicyLink asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{StorageMetricRowsPerGrid} + 1))\r\n| where page_num has ('{StorageMetricPageNumber}') or '*' in ('{StorageMetricPageNumber}') \r\n| project PolicyName, count_BackupItemUniqueId, StorageConsumedInGBs = sum_StorageConsumedInMBs/1024, ResourceId, StorageReplicationType, PolicyLink, PolicyUniqueId", + "size": 3, + "noDataMessage": "No records found for the selected time range and scope", + "exportFieldName": "PolicyLink", + "exportParameterName": "SelectedPolicyLink", + "exportDefaultValue": "*", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "PolicyName", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Policy" + } + }, + { + "columnMatch": "count_BackupItemUniqueId", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Number of Backup Items associated with the Policy, as of the end of the selected time range" + } + }, + { + "columnMatch": "StorageConsumedInGBs", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "minimumFractionDigits": 2, + "maximumFractionDigits": 2 + } + }, + "tooltipFormat": { + "tooltip": "Total Cloud Storage consumed by Backup Items backed up as per the given Policy, as of the end of the selected time range" + } + }, + { + "columnMatch": "ResourceId", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Vault that the Policy belongs to" + } + }, + { + "columnMatch": "StorageReplicationType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Storage Replication Type associated with the Policy" + } + }, + { + "columnMatch": "PolicyLink", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "PolicyUniqueId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "labelSettings": [ + { + "columnId": "PolicyName", + "label": "Policy Name" + }, + { + "columnId": "count_BackupItemUniqueId", + "label": "# Backup Items" + }, + { + "columnId": "StorageConsumedInGBs", + "label": "Cloud Storage (GB)" + }, + { + "columnId": "ResourceId", + "label": "Vault" + }, + { + "columnId": "StorageReplicationType", + "label": "Storage Replication Type" + }, + { + "columnId": "PolicyLink" + }, + { + "columnId": "PolicyUniqueId" + } + ] + }, + "sortBy": [] + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "PolicyDetails-Grid1", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "showBorder": true + } + }, + { + "type": 1, + "content": { + "json": "
List of Backup Items associated with the selected Policy
" + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "SelectedPolicyLink", + "comparison": "isNotEqualTo", + "value": "*" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "PolicyDetails-Grid2Title", + "styleSettings": { + "margin": "0% 0% 10px 0%" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "7bb4a71d-d932-4737-8715-d378be7ffba5", + "version": "KqlParameterItem/1.0", + "name": "BillingMetricSortBy3", + "label": "Sort By", + "type": 2, + "description": "Use to sort by a certain column", + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n{ \\\"value\\\": \\\"StorageConsumedInMBs\\\", \\\"label\\\": \\\"Cloud Storage (MB)\\\", \\\"selected\\\": \\\"true\\\" }]\"}", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "595e5629-4f64-4038-bff5-5f3371259caa", + "version": "KqlParameterItem/1.0", + "name": "BillingMetricOrder3", + "label": "Order", + "type": 2, + "description": "Use to specify the sort order: Ascending/Descending", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"Ascending\"},\r\n { \"value\":\"Descending\", \"selected\":true}\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "0e4b3406-91aa-452e-90b2-6b22e71f0b82", + "version": "KqlParameterItem/1.0", + "name": "StorageMetricRowsPerGrid3", + "label": "Rows Per Page", + "type": 2, + "description": "Number of rows to display in grid view", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":10, \"label\":\"10\", \"selected\":true },\r\n { \"value\":25, \"label\":\"25\" },\r\n { \"value\":50, \"label\":\"50\" },\r\n { \"value\":100, \"label\":\"100\" },\r\n { \"value\":250, \"label\":\"250\" },\r\n { \"value\":500, \"label\":\"500\" },\r\n { \"value\":1000, \"label\":\"1000\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "d1b7fe67-8c02-431c-904c-f82238dd112e", + "version": "KqlParameterItem/1.0", + "name": "StorageMetricPageNumber3", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// BMSTypeWithBackupItemType MappingTable\r\nlet BMSTypeWithBackupItemTypeMappingTable = datatable (BMSTypeWithBackupItemType:string, CustomBMSTypeWithBackupItemType:string)\r\n [ \"AzureWorkload/SAPHanaDatabase\", \"SAP HANA in Azure VM/SAP HANA in Azure VM\",\r\n \"AzureWorkload/SQLDataBase\", \"SQL in Azure VM/SQL Database\",\r\n \"IaaSVM/VM\", \"Azure Virtual Machine/Azure VM\",\r\n\t \"AzureStorage/AzureFileShare\", \"Azure Storage (Azure Files)/Azure File Share\",\r\n\t \"MAB/FileFolder\", \"Azure Backup Agent/Files and Folder\",\r\n\t \"DPM/SQLDB\", \"DPM/SQL Database\",\r\n\t \"DPM/VMwareVM\", \"DPM/VMWare VM\",\r\n\t \"DPM/HyperVVM\", \"DPM/Hyper-V VM\",\r\n\t \"DPM/FileFolder\", \"DPM/Files and Folder\",\r\n\t \"DPM/Client\", \"DPM/Client\",\r\n\t \"DPM/SystemState\", \"DPM/System State\",\r\n\t \"DPM/Sharepoint\", \"DPM/Sharepoint Database\",\r\n\t \"DPM/Exchange\", \"DPM/Exchange Mailbox Database\",\r\n\t \"AzureBackupServer/SQLDB\", \"Azure Backup Server/SQL Database\",\r\n\t \"AzureBackupServer/VMwareVM\", \"Azure Backup Server/VMWare VM\",\r\n\t \"AzureBackupServer/HyperVVM\", \"Azure Backup Server/Hyper-V VM\",\r\n\t \"AzureBackupServer/FileFolder\", \"Azure Backup Server/Files and Folder\",\r\n\t \"AzureBackupServer/Client\", \"Azure Backup Server/Client\",\r\n\t \"AzureBackupServer/SystemState\", \"Azure Backup Server/System State\",\r\n\t \"AzureBackupServer/Sharepoint\", \"Azure Backup Server/Sharepoint Database\",\r\n\t \"AzureBackupServer/Exchange\", \"Azure Backup Server/Exchange Mailbox Database\"];\r\n// Params\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet PolicyNameParam = @\"{PolicyName}\";\r\nlet PolicyLinkParam = @\"{SelectedPolicyLink}\";\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId, BackupManagementServerUniqueId, StorageUniqueId, StorageConsumedInMBs, StorageAllocatedInMBs, TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderAzureDiagnostics = ()\r\n{\r\nlet PolicyTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where OperationName == \"Policy\" and SchemaVersion_s == \"V2\"\r\n| project PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"), PolicyName = PolicyName_s, ResourceId, TimeGenerated\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), PolicyName, ResourceId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderAzureDiagnostics | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderResourceSpecific = ()\r\n{\r\nlet PolicyTable = AddonAzureBackupPolicy\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Policy\" \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderResourceSpecific | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderAzureDiagnostics | project PolicyUniqueId, PolicyName, ResourceId) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet BackupItemAssociationAndStorageConsumptionUnderResourceSpecific = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderResourceSpecific | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet LatestBackupItemAssociationAndStorageConsumptionTable = ()\r\n{\r\nLatestBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n)on BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, \r\nBackupManagementType, BackupItemType, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState,PolicyName, ResourceId, TimeGenerated, StorageReplicationType\r\n};\r\nlet OutputTable = () {LatestBackupItemAssociationAndStorageConsumptionTable\r\n// PolicyLink Parameter\r\n| where strcat(ResourceId, PolicyUniqueId) == (PolicyLinkParam) or '*' in (PolicyLinkParam)\r\n| project BackupItemUniqueId\r\n};\r\nOutputTable\r\n| summarize c=count()\r\n| project num = (c-1)/{StorageMetricRowsPerGrid3} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "90", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "SelectedPolicyLink", + "comparison": "isNotEqualTo", + "value": "*" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "PolicyDetails-Grid2ParameterBlock", + "styleSettings": { + "margin": "-23px 0% 0% 0%" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// BMSTypeWithBackupItemType MappingTable\r\nlet BMSTypeWithBackupItemTypeMappingTable = datatable (BMSTypeWithBackupItemType:string, CustomBMSTypeWithBackupItemType:string)\r\n [ \"AzureWorkload/SAPHanaDatabase\", \"SAP HANA in Azure VM/SAP HANA in Azure VM\",\r\n \"AzureWorkload/SQLDataBase\", \"SQL in Azure VM/SQL Database\",\r\n \"IaaSVM/VM\", \"Azure Virtual Machine/Azure VM\",\r\n\t \"AzureStorage/AzureFileShare\", \"Azure Storage (Azure Files)/Azure File Share\",\r\n\t \"MAB/FileFolder\", \"Azure Backup Agent/Files and Folder\",\r\n\t \"DPM/SQLDB\", \"DPM/SQL Database\",\r\n\t \"DPM/VMwareVM\", \"DPM/VMWare VM\",\r\n\t \"DPM/HyperVVM\", \"DPM/Hyper-V VM\",\r\n\t \"DPM/FileFolder\", \"DPM/Files and Folder\",\r\n\t \"DPM/Client\", \"DPM/Client\",\r\n\t \"DPM/SystemState\", \"DPM/System State\",\r\n\t \"DPM/Sharepoint\", \"DPM/Sharepoint Database\",\r\n\t \"DPM/Exchange\", \"DPM/Exchange Mailbox Database\",\r\n\t \"AzureBackupServer/SQLDB\", \"Azure Backup Server/SQL Database\",\r\n\t \"AzureBackupServer/VMwareVM\", \"Azure Backup Server/VMWare VM\",\r\n\t \"AzureBackupServer/HyperVVM\", \"Azure Backup Server/Hyper-V VM\",\r\n\t \"AzureBackupServer/FileFolder\", \"Azure Backup Server/Files and Folder\",\r\n\t \"AzureBackupServer/Client\", \"Azure Backup Server/Client\",\r\n\t \"AzureBackupServer/SystemState\", \"Azure Backup Server/System State\",\r\n\t \"AzureBackupServer/Sharepoint\", \"Azure Backup Server/Sharepoint Database\",\r\n\t \"AzureBackupServer/Exchange\", \"Azure Backup Server/Exchange Mailbox Database\"];\r\n// Params\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet PolicyNameParam = @\"{PolicyName}\";\r\nlet PolicyLinkParam = @\"{SelectedPolicyLink}\";\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId, BackupManagementServerUniqueId, StorageUniqueId, StorageConsumedInMBs, StorageAllocatedInMBs, TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderAzureDiagnostics = ()\r\n{\r\nlet PolicyTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where OperationName == \"Policy\" and SchemaVersion_s == \"V2\"\r\n| project PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"), PolicyName = PolicyName_s, ResourceId, TimeGenerated\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), PolicyName, ResourceId, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderAzureDiagnostics | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\nlet PolicyUnderResourceSpecific = ()\r\n{\r\nlet PolicyTable = AddonAzureBackupPolicy\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Policy\" \r\n| summarize arg_max(TimeGenerated, *) by PolicyUniqueId, ResourceId;\r\nVaultUnderResourceSpecific | join (\r\n PolicyTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderAzureDiagnostics | project PolicyUniqueId, PolicyName, ResourceId) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet BackupItemAssociationAndStorageConsumptionUnderResourceSpecific = ()\r\n{\r\n// Using outer join for BackupItemAssociation - as there could be BackupItems without ProtectedContainer (in case of soft delete), BackupItems without policies\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific \r\n\t// To show as per as on 'AsonDay'\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n PolicyUnderResourceSpecific | project PolicyUniqueId, PolicyName, ResourceId ) on PolicyUniqueId, ResourceId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated \r\n) on BackupItemUniqueId\r\n// using leftouter due to AzureStorage - storageconsumption table is not emitted. inner join will exclude AzureStorage BackupItems.\r\n| join kind= leftouter (\r\n StorageAssociationUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId,TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, PolicyName, ResourceId, StorageReplicationType\r\n};\r\nlet LatestBackupItemAssociationAndStorageConsumptionTable = ()\r\n{\r\nLatestBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n)on BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, \r\nBackupManagementType, BackupItemType, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState,PolicyName, ResourceId, TimeGenerated, StorageReplicationType\r\n};\r\nlet OutputTable = () {LatestBackupItemAssociationAndStorageConsumptionTable\r\n// PolicyLink Parameter\r\n| where strcat(ResourceId, PolicyUniqueId) == (PolicyLinkParam) or '*' in (PolicyLinkParam)\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementType, BackupItemType, BackupItemFrontEndSize, StorageConsumedInMBs, PolicyName, ResourceId, StorageReplicationType\r\n| extend TempColumn = column_ifexists(tostring('{BillingMetricSortBy3}'), \"StorageConsumedInMBs\")\r\n| extend ColumnToBeSorted = iff(tostring('{BillingMetricOrder3}') == \"Ascending\", todouble(TempColumn) - 90000000, 90000000 - todouble(TempColumn))\r\n| sort by ColumnToBeSorted asc nulls last, BackupItemUniqueId asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{StorageMetricRowsPerGrid3} + 1))\r\n| where page_num has ('{StorageMetricPageNumber3}') or '*' in ('{StorageMetricPageNumber3}')\r\n| extend prefix = array_strcat(array_split(split(ResourceId,\"/\"), 4)[0] ,\"/\")\r\n| extend containerNameString = iff(array_length(split(ProtectedContainerName,\";\")) == 3, ProtectedContainerName, \"\")\r\n| parse containerNameString with entityType:string \";\" rgName:string \";\" entityName:string\r\n| extend entityTypeForAzureStorageUrl = iff((BackupManagementType == \"AzureStorage\" and BackupItemType == \"AzureFileShare\"), iff(entityType == \"storage\", \"/Microsoft.Storage/storageAccounts/\", \"/Microsoft.ClassicStorage/storageAccounts/\"), \"\")\r\n| extend entityTypeForIaaSVMUrl = iff((BackupManagementType == \"IaaSVM\" and BackupItemType == \"VM\"), iff(entityType =~ \"iaasvmcontainerv2\", \"/Microsoft.Compute/virtualMachines/\", \"/Microsoft.ClassicCompute/virtualMachines/\"), \"\")\r\n| extend entityTypeForAzureWorkloadUrl = iff(((BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SAPHanaDatabase\") or (BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SQLDataBase\")), iff(entityType =~ \"compute\", \"/Microsoft.Compute/virtualMachines/\", \"/Microsoft.ClassicCompute/virtualMachines/\"), \"\")\r\n| extend AzureResource = iff(BackupManagementType in (\"DPM\",\"MAB\",\"AzureBackupServer\"), \"\" , iff(containerNameString != \"\", strcat(prefix, \"/\", rgName, \"/providers\", entityTypeForAzureStorageUrl, entityTypeForIaaSVMUrl, entityTypeForAzureWorkloadUrl, entityName), ResourceId))\r\n| extend BackupItemLink = iff ((BackupManagementType == \"IaaSVM\" and BackupItemType == \"VM\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/IaasVMContainer;\", ProtectedContainerName, \"/protectedItems/VM;\", ProtectedContainerName),\r\niff((BackupManagementType == \"AzureStorage\" and BackupItemType == \"AzureFileShare\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/StorageContainer;\", ProtectedContainerName, \"/protectedItems/AzureFileShare;\", BackupItemName) , \r\niff((BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SQLDataBase\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/VMAppContainer;\", ProtectedContainerName, \"/protectedItems/SQLDataBase;\", BackupItemName) , \r\niff((BackupManagementType == \"AzureWorkload\" and BackupItemType == \"SAPHanaDatabase\"), strcat(ResourceId,\"/backupFabrics/Azure/protectionContainers/VMAppContainer;\", ProtectedContainerName, \"/protectedItems/SAPHanaDatabase;\", BackupItemName), \"\"))))\r\n| extend container_array = split(ProtectedContainerName,\";\")\r\n| extend container_arraylen = array_length(container_array)\r\n| project BackupItemName = BackupItemFriendlyName, ProtectedContainerName = ProtectedContainerFriendlyName, ContainerResourceGroup = iff(container_arraylen == 3, container_array[(container_arraylen-2)], \"(none)\"), PolicyName, BMSTypeWithBackupItemType = strcat(BackupManagementType, \"/\", BackupItemType), StorageConsumedInMBs, ResourceId, StorageReplicationType, AzureResource, BackupItemLink};\r\nlet CustomOutputTable = BMSTypeWithBackupItemTypeMappingTable\r\n| join kind= rightouter (OutputTable) \r\non BMSTypeWithBackupItemType\r\n| project BackupItemName, ProtectedContainerName, ContainerResourceGroup, PolicyName, BMSTypeWithBackupItemType = iff(CustomBMSTypeWithBackupItemType == \"\",BMSTypeWithBackupItemType1 ,CustomBMSTypeWithBackupItemType ), StorageConsumedInMBs, ResourceId, StorageReplicationType, AzureResource, BackupItemLink\r\n| parse BMSTypeWithBackupItemType with ExtractedBMSType:string \"/\" ExtractedBackupItemType:string\r\n| project BackupItemName, ProtectedContainerName, ContainerResourceGroup, PolicyName, StorageConsumedInGBs = StorageConsumedInMBs/1024, ResourceId, StorageReplicationType, AzureResource, BackupItemLink, ExtractedBMSType, ExtractedBackupItemType\r\n;\r\nCustomOutputTable", + "size": 3, + "noDataMessage": "No records found for the selected time range and scope", + "exportFieldName": "BackupItemUniqueId", + "exportParameterName": "SelectedBackupItemUniqueId", + "exportDefaultValue": "*", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "BackupItemName", + "formatter": 16, + "formatOptions": { + "linkColumn": "BackupItemLink", + "linkTarget": "Resource", + "linkIsContextBlade": false, + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Backup Item" + } + }, + { + "columnMatch": "ProtectedContainerName", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Protected Container associated with the Backup Item" + } + }, + { + "columnMatch": "ContainerResourceGroup", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Resource Group of the Backup Item" + } + }, + { + "columnMatch": "PolicyName", + "formatter": 16, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Policy associated with the Backup Item" + } + }, + { + "columnMatch": "StorageConsumedInGBs", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumFractionDigits": 2, + "maximumFractionDigits": 2 + } + }, + "tooltipFormat": { + "tooltip": "Cloud storage consumed by the Backup Item, as of the end of the selected time range" + } + }, + { + "columnMatch": "ResourceId", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Vault associated with the Backup Item" + } + }, + { + "columnMatch": "StorageReplicationType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Storage Replication Type associated with the Backup Item" + } + }, + { + "columnMatch": "AzureResource", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Azure Resource associated with the Backup Item. For Azure VM Backup, SQL in Azure VM backup and SAP database in Azure VM backup, the Azure Resource is the Azure VM. For Azure Files Share backup, the Azure Resource is the Azure Storage account. For on-premises Backup Items, this field is blank." + } + }, + { + "columnMatch": "BackupItemLink", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ExtractedBMSType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Management Type" + } + }, + { + "columnMatch": "ExtractedBackupItemType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Item Type" + } + }, + { + "columnMatch": "ExtractedBackupItemName", + "formatter": 16, + "formatOptions": { + "linkColumn": "BackupItemLink", + "linkTarget": "Resource", + "subTarget": "backupProtectedItems", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Backup Item" + } + }, + { + "columnMatch": "ExtractedContainerName", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "StorageConsumedInMB", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "minimumFractionDigits": 2, + "maximumFractionDigits": 2 + } + }, + "tooltipFormat": { + "tooltip": "Total Cloud Storage consumed by the Backup Item, as of the end of the selected period" + } + }, + { + "columnMatch": "BMSTypeWithBackupItemType", + "formatter": 13, + "formatOptions": { + "linkColumn": "finalUrl", + "linkTarget": "Resource", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Type of Backup Item, in format Backup Management Type/Backup Item Type" + } + }, + { + "columnMatch": "ContainerNameWithBackupItemName", + "formatter": 5, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "BackupItemFrontEndSize", + "formatter": 5, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + } + }, + { + "columnMatch": "PolicyLink", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "BackupItemUniqueId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TempColumn", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ColumnToBeSorted", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "row_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "page_num", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "finalUrl", + "formatter": 5, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + } + ], + "labelSettings": [ + { + "columnId": "BackupItemName", + "label": "Backup Item" + }, + { + "columnId": "ProtectedContainerName", + "label": "Container" + }, + { + "columnId": "ContainerResourceGroup", + "label": "Resource Group" + }, + { + "columnId": "PolicyName", + "label": "Policy" + }, + { + "columnId": "StorageConsumedInGBs", + "label": "Cloud Storage (GB)" + }, + { + "columnId": "ResourceId", + "label": "Vault" + }, + { + "columnId": "StorageReplicationType", + "label": "Storage Replication Type" + }, + { + "columnId": "AzureResource", + "label": "Azure Resource" + }, + { + "columnId": "BackupItemLink" + }, + { + "columnId": "ExtractedBMSType", + "label": "Backup Management Type" + }, + { + "columnId": "ExtractedBackupItemType", + "label": "Backup Item Type" + } + ] + }, + "sortBy": [] + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "PolicyDetails" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "SelectedPolicyLink", + "comparison": "isNotEqualTo", + "value": "*" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "PolicyDetails-Grid2", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "showBorder": true + } + } + ] + }, + "name": "group - 0" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/policydetails-tab/settings.json b/Azure Backup/Workbooks/policydetails-tab/settings.json new file mode 100644 index 0000000..eae6c0b --- /dev/null +++ b/Azure Backup/Workbooks/policydetails-tab/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Policy Details Report", + "author": "Microsoft", + "galleries": [] +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/summary-tab/settings.json b/Azure Backup/Workbooks/summary-tab/settings.json new file mode 100644 index 0000000..18ffe81 --- /dev/null +++ b/Azure Backup/Workbooks/summary-tab/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Summary Report", + "author": "Microsoft", + "galleries": [] +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/summary-tab/summary-tab.workbook b/Azure Backup/Workbooks/summary-tab/summary-tab.workbook new file mode 100644 index 0000000..3d63be2 --- /dev/null +++ b/Azure Backup/Workbooks/summary-tab/summary-tab.workbook @@ -0,0 +1,263 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "
Key Parameters by Backup Item Type
" + }, + "customWidth": "100", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Summary" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Summary" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "Summary-GridTitle1", + "styleSettings": { + "margin": "0% 0% 0% 0%" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet ExtRangeStart = RangeStart - 2d;\r\nlet ExtRangeEnd = RangeEnd + 2d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n // Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId, BackupManagementServerUniqueId, StorageUniqueId, StorageConsumedInMBs, StorageAllocatedInMBs, TimeGenerated, ResourceId\r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderAzureDiagnostics = ()\r\n{\r\nlet JobTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Job\" and SchemaVersion_s == \"V2\"\r\n// Exclude Log Jobs and InProgress Jobs\r\n| project JobOperation = columnifexists(\"JobOperation_s\", \"\") , JobOperationSubType = columnifexists(\"JobOperationSubType_s\", \"\"), JobUniqueIdGuid = columnifexists(\"JobUniqueId_g\", \"\") , JobUniqueIdStr = columnifexists(\"JobUniqueId_s\", \"\"),\r\nProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\",\"\"), AdHocOrScheduledJob = columnifexists(\"AdHocOrScheduledJob_s\",\"\"), RecoveryJobDestination = columnifexists(\"RecoveryJobDestination_s\",\"\"),\r\nRecoveryJobRPDateTime = todatetime(columnifexists(\"RecoveryJobRPDateTime_s\",\"\")), RecoveryJobRPLocation = columnifexists(\"RecoveryJobRPLocation_s\",\"\"), RecoveryLocationType = columnifexists(\"RecoveryLocationType_s\",\"\"),\r\nBackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\",\"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\",\"\"), VaultUniqueId = columnifexists(\"VaultUniqueId_s\",\"\"),\r\nJobStatus = columnifexists(\"JobStatus_s\",\"\"), JobFailureCode = columnifexists(\"JobFailureCode_s\",\"\"), JobStartDateTime = todatetime(columnifexists(\"JobStartDateTime_s\",\"\")), JobDurationInSecs = todouble(columnifexists(\"JobDurationInSecs_s\", \"\")),\r\nDataTransferredInMB = todouble(columnifexists(\"DataTransferredInMB_s\",\"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\",\"\"), TimeGenerated, ResourceId\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\")) \r\n| extend JobUniqueId = iff(JobUniqueIdGuid == \"\", JobUniqueIdStr, JobUniqueIdGuid) \r\n| project-away JobUniqueIdGuid, JobUniqueIdStr\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId ;\r\nVaultUnderAzureDiagnostics | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderResourceSpecific = ()\r\n{\r\nlet JobTable = AddonAzureBackupJobs \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Job\" \r\n// Exclude Log Jobs and InProgress Jobs\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\"))\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedInstanceUnderAzureDiagnostics = (isProtectedContainerBillingType:bool)\r\n{\r\n let ProtectedInstanceTable = AzureDiagnostics \r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedInstance\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"),\r\n ProtectedInstanceCount = toint(columnifexists(\"ProtectedInstanceCount_s\", \"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| where (BackupItemUniqueId == \"\" and isProtectedContainerBillingType) or (ProtectedContainerUniqueId == \"\" and not(isProtectedContainerBillingType))\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedInstanceTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedInstanceUnderResourceSpecific = (isProtectedContainerBillingType:bool)\r\n{\r\nlet ProtectedInstanceTable = AddonAzureBackupProtectedInstance \r\n| where OperationName == \"ProtectedInstance\" and State != \"Deleted\"\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where (BackupItemUniqueId == \"\" and isProtectedContainerBillingType) or (ProtectedContainerUniqueId == \"\" and not(isProtectedContainerBillingType))\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedInstanceTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet LatestProtectedInstanceTable = (isProtectedContainerBillingType:bool) \r\n{CombinedTable | union isfuzzy = true \r\n(ProtectedInstanceUnderAzureDiagnostics(isProtectedContainerBillingType)),\r\n(ProtectedInstanceUnderResourceSpecific(isProtectedContainerBillingType))\r\n| where startofday(TimeGenerated) == AsonDay\r\n// ProtectedInstance is at BillingEntity level. CustomBackupManagementType can be the filter used.\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId\r\n| project BackupItemUniqueId, ProtectedContainerUniqueId, BackupManagementType, ResourceId, TimeGenerated, ProtectedInstanceCount, TimeRangeEndDay = startofday(TimeGenerated), StorageReplicationType\r\n};\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet LatestBackupItemAndStorageConsumptionTable = ()\r\n{\r\nLatestBackupItemDimensionTable | join kind= leftouter\r\n(CombinedTable | union isfuzzy = true \r\n(StorageAssociationUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated),\r\n(StorageAssociationUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId)\r\n on BackupItemUniqueId\r\n| summarize StorageConsumedInGBs = sum(StorageConsumedInMBs)/(1024) by BackupManagementType, BackupItemType};\r\nlet LatestJobTableBasedOnBackupItem = (){\r\nTotalBackupItemDimensionTable\r\n| join ( \r\nCombinedTable | union isfuzzy = true \r\n(JobUnderAzureDiagnostics()\r\n| where BackupItemUniqueId != \"\"\r\n),\r\n(JobUnderResourceSpecific()\r\n| where BackupItemUniqueId != \"\"\r\n)\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId\r\n) on BackupItemUniqueId\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, BackupManagementType, BackupItemType, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, JobStartDateTime, AdHocOrScheduledJob, ResourceId, TimeGenerated\r\n};\r\nlet LatestJobTable = ()\r\n{LatestJobTableBasedOnBackupItem()\r\n// Taking only BackupItemBasedJobs\r\n| where JobUniqueId != \"\"\r\n}; \r\nlet LatestProtectedContainerUniqueIdTableBasedOnBackupItemExcludingDPMVMs = (){\r\nLatestBackupItemDimensionTable\r\n| where not((BackupManagementType has \"DPM\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"DPM\" and BackupItemType has \"HyperVVM\") \r\nor (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"HyperVVM\"))\r\n| join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationUnderAzureDiagnostics()),\r\n(BackupItemAssociationUnderResourceSpecific())\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId) on BackupItemUniqueId\r\n| distinct ProtectedContainerUniqueId, BackupManagementType\r\n};\r\nlet LatestProtectedInstanceTableFromProtectedContainerUniqueId = ()\r\n{ \r\nLatestProtectedInstanceTable(true)\r\n| join kind= rightouter (LatestProtectedContainerUniqueIdTableBasedOnBackupItemExcludingDPMVMs) on ProtectedContainerUniqueId\r\n| project BillingEntityUniqueId = ProtectedContainerUniqueId1, ProtectedInstanceCount, BackupManagementType = BackupManagementType1\r\n};\r\nlet LatestProtectedInstanceTableFromBackupItemUniqueId = ()\r\n{ \r\n(LatestProtectedInstanceTable(false)\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\"))\r\n| join kind= rightouter (LatestBackupItemDimensionTable | where ((BackupManagementType has \"DPM\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"DPM\" and BackupItemType has \"HyperVVM\")\r\nor (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"HyperVVM\"))) on BackupItemUniqueId\r\n| project BillingEntityUniqueId = BackupItemUniqueId1, ProtectedInstanceCount, BackupManagementType\r\n};\r\n// Special handling for DPM, AzureBackupServer Cluster scenario - Node PS has ProtectedInstance, whereas Cluster PS has storage Consumption\r\nlet LatestProtectedInstanceTableFromDPMNodeProtectedContainerUniqueId = ()\r\n{ \r\n(\r\n(LatestProtectedInstanceTable(true)\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\")\r\n| where ProtectedInstanceCount > 0)\r\n| join kind= leftanti (LatestProtectedContainerUniqueIdTableBasedOnBackupItemExcludingDPMVMs) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId, BackupManagementType, ResourceId, TimeGenerated, ProtectedInstanceCount, TimeRangeEndDay, StorageReplicationType)\r\n| join (\r\nCombinedTable | union isfuzzy = true \r\n(ProtectedContainerUnderAzureDiagnostics()),\r\n(ProtectedContainerUnderResourceSpecific())\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\")\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId)\r\n on ProtectedContainerUniqueId\r\n // BackupItemFrontEndSize and StorageConsumed will be 0.0 as the same will be calculated at cluster level \r\n // As it is DPM or AzureBackupServer, no extra handling needed for AzureWorkload\r\n| project BillingEntityUniqueId = ProtectedContainerUniqueId, ProtectedInstanceCount, BackupManagementType\r\n};\r\nlet ProtectedInstanceMetricTable = ( ) \r\n{ union \r\n(LatestProtectedInstanceTableFromProtectedContainerUniqueId()),\r\n(LatestProtectedInstanceTableFromBackupItemUniqueId()),\r\n(LatestProtectedInstanceTableFromDPMNodeProtectedContainerUniqueId)\r\n| project CustomProtectedInstanceCount = iff(isempty(ProtectedInstanceCount) or BackupManagementType == \"AzureStorage\", 0.0, todouble(ProtectedInstanceCount)/10), BillingEntityUniqueId\r\n};\r\n(LatestBackupItemDimensionTable | count | extend Dummy = 1) \r\n| join (LatestBackupItemAndStorageConsumptionTable | summarize sum(StorageConsumedInGBs) | extend Dummy = 1) on Dummy \r\n| join (LatestJobTable | where JobUniqueId != \"\" | summarize dcount(JobUniqueId,4) | extend Dummy = 1) on Dummy \r\n| join (ProtectedInstanceMetricTable | summarize sum(CustomProtectedInstanceCount) | extend Dummy = 1) on Dummy \r\n| extend Key = pack_array( \"Backup Items\", \"Protected Instances\", \"Cloud Storage (GB)\", \"Jobs Created\"), Value = pack_array( Count, sum_CustomProtectedInstanceCount, sum_StorageConsumedInGBs, dcount_JobUniqueId), \r\nSubTitle = pack_array( \"\", \"\", \"\", \"\")\r\n| project Key, Value, SubTitle \r\n| mvexpand Key, Value, SubTitle", + "size": 4, + "noDataMessage": "No records found for the selected time range and scope", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Key", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubTitle", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "minimumFractionDigits": 0, + "maximumFractionDigits": 2 + } + } + }, + "showBorder": true + } + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Summary" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Summary" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo", + "value": "" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "Summary-Tiles", + "styleSettings": { + "margin": "0% 0% 0% -15px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet ExtRangeStart = RangeStart - 2d;\r\nlet ExtRangeEnd = RangeEnd + 2d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\nlet TrendEndDay = iff((RangeEnd-Today == 1d),RangeEnd-1d, RangeEnd);\r\nlet interval = 1d;\r\nlet BMSTypeWithBackupItemTypeMappingTable = datatable (BMSTypeWithBackupItemType:string, CustomBMSTypeWithBackupItemType:string)\r\n [ \"AzureWorkload/SAPHanaDatabase\", \"SAP HANA in Azure VM/SAP HANA in Azure VM\",\r\n \"AzureWorkload/SQLDataBase\", \"SQL in Azure VM/SQL Database\",\r\n \"IaaSVM/VM\", \"Azure Virtual Machine/Azure VM\",\r\n\t \"AzureStorage/AzureFileShare\", \"Azure Storage (Azure Files)/Azure File Share\",\r\n\t \"MAB/FileFolder\", \"Azure Backup Agent/Files and Folder\",\r\n\t \"DPM/SQLDB\", \"DPM/SQL Database\",\r\n\t \"DPM/VMwareVM\", \"DPM/VMWare VM\",\r\n\t \"DPM/HyperVVM\", \"DPM/Hyper-V VM\",\r\n\t \"DPM/FileFolder\", \"DPM/Files and Folder\",\r\n\t \"DPM/Client\", \"DPM/Client\",\r\n\t \"DPM/SystemState\", \"DPM/System State\",\r\n\t \"DPM/Sharepoint\", \"DPM/Sharepoint Database\",\r\n\t \"DPM/Exchange\", \"DPM/Exchange Mailbox Database\",\r\n\t \"AzureBackupServer/SQLDB\", \"Azure Backup Server/SQL Database\",\r\n\t \"AzureBackupServer/VMwareVM\", \"Azure Backup Server/VMWare VM\",\r\n\t \"AzureBackupServer/HyperVVM\", \"Azure Backup Server/Hyper-V VM\",\r\n\t \"AzureBackupServer/FileFolder\", \"Azure Backup Server/Files and Folder\",\r\n\t \"AzureBackupServer/Client\", \"Azure Backup Server/Client\",\r\n\t \"AzureBackupServer/SystemState\", \"Azure Backup Server/System State\",\r\n\t \"AzureBackupServer/Sharepoint\", \"Azure Backup Server/Sharepoint Database\",\r\n\t \"AzureBackupServer/Exchange\", \"Azure Backup Server/Exchange Mailbox Database\"];\r\n// Params\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\")); \r\n\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId, BackupManagementServerUniqueId, StorageUniqueId, StorageConsumedInMBs, StorageAllocatedInMBs, TimeGenerated, ResourceId\r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderAzureDiagnostics = ()\r\n{\r\nlet JobTable = AzureDiagnostics \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Job\" and SchemaVersion_s == \"V2\"\r\n// Exclude Log Jobs and InProgress Jobs\r\n| project JobOperation = columnifexists(\"JobOperation_s\", \"\") , JobOperationSubType = columnifexists(\"JobOperationSubType_s\", \"\"), JobUniqueIdGuid = columnifexists(\"JobUniqueId_g\", \"\") , JobUniqueIdStr = columnifexists(\"JobUniqueId_s\", \"\"),\r\nProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\",\"\"), AdHocOrScheduledJob = columnifexists(\"AdHocOrScheduledJob_s\",\"\"), RecoveryJobDestination = columnifexists(\"RecoveryJobDestination_s\",\"\"),\r\nRecoveryJobRPDateTime = todatetime(columnifexists(\"RecoveryJobRPDateTime_s\",\"\")), RecoveryJobRPLocation = columnifexists(\"RecoveryJobRPLocation_s\",\"\"), RecoveryLocationType = columnifexists(\"RecoveryLocationType_s\",\"\"),\r\nBackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\",\"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\",\"\"), VaultUniqueId = columnifexists(\"VaultUniqueId_s\",\"\"),\r\nJobStatus = columnifexists(\"JobStatus_s\",\"\"), JobFailureCode = columnifexists(\"JobFailureCode_s\",\"\"), JobStartDateTime = todatetime(columnifexists(\"JobStartDateTime_s\",\"\")), JobDurationInSecs = todouble(columnifexists(\"JobDurationInSecs_s\", \"\")),\r\nDataTransferredInMB = todouble(columnifexists(\"DataTransferredInMB_s\",\"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\",\"\"), TimeGenerated, ResourceId\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\")) \r\n| extend JobUniqueId = iff(JobUniqueIdGuid == \"\", JobUniqueIdStr, JobUniqueIdGuid) \r\n| project-away JobUniqueIdGuid, JobUniqueIdStr\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId ;\r\nVaultUnderAzureDiagnostics | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\nlet JobUnderResourceSpecific = ()\r\n{\r\nlet JobTable = AddonAzureBackupJobs \r\n// Take records until previous day\r\n| where TimeGenerated >= ExtRangeStart and TimeGenerated <= ExtRangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"Job\" \r\n// Exclude Log Jobs and InProgress Jobs\r\n| where not((JobOperation == \"Backup\" and JobOperationSubType == \"Log\") or (JobOperation == \"Backup\" and JobOperationSubType == \"Recovery point_Log\") or (JobStatus == \"InProgress\"))\r\n| where JobStartDateTime >= RangeStart and JobStartDateTime <= RangeEnd\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n JobTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\n\r\n\r\nlet LatestBackupItemAndStorageConsumptionTable = ()\r\n{\r\nLatestBackupItemDimensionTable | join kind= leftouter\r\n(CombinedTable | union isfuzzy = true \r\n(StorageAssociationUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated),\r\n(StorageAssociationUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId)\r\n on BackupItemUniqueId\r\n| summarize StorageConsumedInGBs = sum(StorageConsumedInMBs)/(1024) by BackupManagementType, BackupItemType};\r\n\r\n\r\nlet LatestJobTableBasedOnBackupItem = (){\r\nTotalBackupItemDimensionTable\r\n| join ( \r\nCombinedTable | union isfuzzy = true \r\n(JobUnderAzureDiagnostics()\r\n| where BackupItemUniqueId != \"\"\r\n),\r\n(JobUnderResourceSpecific()\r\n| where BackupItemUniqueId != \"\"\r\n)\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, JobStartDateTime, AdHocOrScheduledJob, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, JobUniqueId\r\n) on BackupItemUniqueId\r\n| project JobStatus, JobUniqueId, JobOperation, JobFailureCode, BackupManagementType, BackupItemType, DataTransferredInMB, JobDurationInSecs, BackupItemUniqueId, JobStartDateTime, AdHocOrScheduledJob, ResourceId, TimeGenerated\r\n};\r\nlet LatestJobTable = ()\r\n{LatestJobTableBasedOnBackupItem()\r\n// Taking only BackupItemBasedJobs\r\n| where JobUniqueId != \"\"\r\n}; \r\nlet JobSuccessPercentageTable = (){\r\nLatestJobTable\r\n// Calculate percentage\r\n| extend success=iff((JobStatus == \"Completed\" or JobStatus == \"CompletedWithWarnings\") , 1 , 0)\r\n| extend record = iff(JobUniqueId != \"\", 1, 0) // to be used for total row count\r\n| summarize SuccessfulCount =sum(success), TotalCount=sum(record) by BackupManagementType, BackupItemType\r\n| extend JobSuccessPercentage = (SuccessfulCount*100)/todouble(TotalCount)\r\n};\r\nlet SummaryTable = (){\r\n// Total BackupItem Types in the period\r\nTotalBackupItemDimensionTable | summarize by BackupManagementType, BackupItemType\r\n// Active BackupItem count \r\n| join kind=leftouter (LatestBackupItemDimensionTable | summarize count(BackupItemUniqueId) by BackupManagementType, BackupItemType) on BackupManagementType == BackupManagementType, BackupItemType == BackupItemType\r\n| join kind=leftouter JobSuccessPercentageTable on BackupManagementType == BackupManagementType, BackupItemType == BackupItemType \r\n| join kind=leftouter LatestBackupItemAndStorageConsumptionTable on BackupManagementType == BackupManagementType, BackupItemType == BackupItemType \r\n| project BMSTypeWithBackupItemType = strcat(BackupManagementType,\"/\", BackupItemType), count_BackupItemUniqueId, JobSuccessPercentage, StorageConsumedInGBs};\r\nlet CustomSummaryTable = BMSTypeWithBackupItemTypeMappingTable\r\n| join kind= rightouter (SummaryTable) \r\non BMSTypeWithBackupItemType == BMSTypeWithBackupItemType\r\n| project BMSTypeWithBackupItemType = iff(CustomBMSTypeWithBackupItemType == \"\",BMSTypeWithBackupItemType1 ,CustomBMSTypeWithBackupItemType ), count_BackupItemUniqueId, JobSuccessPercentage = iff( (isnan(JobSuccessPercentage) or isinf(JobSuccessPercentage) or isempty(JobSuccessPercentage)), \"-\", tostring(strcat(round(JobSuccessPercentage,2), \" %\"))), StorageConsumedInGBs\r\n| parse BMSTypeWithBackupItemType with ExtractedBMSType:string \"/\" ExtractedBackupItemType:string\r\n| project ExtractedBMSType, ExtractedBackupItemType, count_BackupItemUniqueId, JobSuccessPercentage, StorageConsumedInGBs\r\n| order by ExtractedBMSType asc;\r\nCustomSummaryTable", + "size": 3, + "noDataMessage": "No records found for the selected time range and scope", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "ExtractedBMSType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Management Type" + } + }, + { + "columnMatch": "ExtractedBackupItemType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Item Type" + } + }, + { + "columnMatch": "count_BackupItemUniqueId", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Number of Backup Items of the given type, as of the end of the selected time range" + } + }, + { + "columnMatch": "JobSuccessPercentage", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "% of Jobs (that were triggered in the selected time range) that were successful for Backup Items of the given type" + } + }, + { + "columnMatch": "StorageConsumedInGBs", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "minimumFractionDigits": 2, + "maximumFractionDigits": 2 + } + }, + "tooltipFormat": { + "tooltip": "Total Cloud Storage consumed by Backup Items of the given type, as of the end of the selected time range" + } + } + ], + "labelSettings": [ + { + "columnId": "ExtractedBMSType", + "label": "Backup Management Type" + }, + { + "columnId": "ExtractedBackupItemType", + "label": "Backup Item Type" + }, + { + "columnId": "count_BackupItemUniqueId", + "label": "# Backup Items" + }, + { + "columnId": "JobSuccessPercentage", + "label": "Job Success %" + }, + { + "columnId": "StorageConsumedInGBs", + "label": "Cloud Storage (GB)" + } + ] + }, + "sortBy": [] + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Summary" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Summary" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "Summary-Grid", + "styleSettings": { + "margin": "-23px 0% 0% 0%", + "showBorder": true + } + } + ] + }, + "name": "group - 0" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/usage-tab/settings.json b/Azure Backup/Workbooks/usage-tab/settings.json new file mode 100644 index 0000000..be61fd1 --- /dev/null +++ b/Azure Backup/Workbooks/usage-tab/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Usage Report", + "author": "Microsoft", + "galleries": [] +} \ No newline at end of file diff --git a/Azure Backup/Workbooks/usage-tab/usage-tab.workbook b/Azure Backup/Workbooks/usage-tab/usage-tab.workbook new file mode 100644 index 0000000..4eb2685 --- /dev/null +++ b/Azure Backup/Workbooks/usage-tab/usage-tab.workbook @@ -0,0 +1,785 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "a29464c3-34f0-4d60-82bb-614b8128b7f9", + "version": "KqlParameterItem/1.0", + "name": "BillingEntityName", + "label": "Search Billed Entity", + "type": 1, + "description": "Search by Billed Entity Name", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "90", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "Usage-SearchParameterBlock", + "styleSettings": { + "margin": "0% 0% 0% 0%", + "padding": "0% 0% 0% 0%" + } + }, + { + "type": 1, + "content": { + "json": "_____________________" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "Usage-DividingLine1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet NumberOfDaysInRange = datetime_diff('day',RangeEnd, RangeStart);\r\n// AsonDay is needed to project consumption data only as per the last complete day.\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\nlet BMSTypeMappingTable = datatable (CustomBackupManagementType:string, CustomBMSType:string)\r\n [ \"IaaSVM\", \"Azure Virtual Machine\",\r\n\t \"MAB\", \"Azure Backup Agent\",\r\n\t \"DPM\", \"DPM\",\r\n\t \"AzureBackupServer\", \"Azure Backup Server\",\r\n\t \"AzureStorage\", \"Azure Storage (Azure Files)\",\r\n\t \"AzureWorkload/SQLDataBase\", \"SQL in Azure VM\",\r\n\t \"AzureWorkload/SAPHanaDatabase\", \"SAP HANA in Azure VM\"\r\n\t];\r\n // Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet BillingEntityNameParam = @\"{BillingEntityName}\";\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId, BackupManagementServerUniqueId, StorageUniqueId, StorageConsumedInMBs, StorageAllocatedInMBs, TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedInstanceUnderAzureDiagnostics = (isProtectedContainerBillingType:bool)\r\n{\r\n let ProtectedInstanceTable = AzureDiagnostics \r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedInstance\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"),\r\n ProtectedInstanceCount = toint(columnifexists(\"ProtectedInstanceCount_s\", \"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| where (BackupItemUniqueId == \"\" and isProtectedContainerBillingType) or (ProtectedContainerUniqueId == \"\" and not(isProtectedContainerBillingType))\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedInstanceTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedInstanceUnderResourceSpecific = (isProtectedContainerBillingType:bool)\r\n{\r\nlet ProtectedInstanceTable = AddonAzureBackupProtectedInstance \r\n| where OperationName == \"ProtectedInstance\" and State != \"Deleted\"\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where (BackupItemUniqueId == \"\" and isProtectedContainerBillingType) or (ProtectedContainerUniqueId == \"\" and not(isProtectedContainerBillingType))\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedInstanceTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\t\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, ResourceId, StorageReplicationType \r\n) on BackupItemUniqueId\r\n| join kind= leftouter (\r\n StorageAssociationUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId, TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, ResourceId, StorageReplicationType \r\n};\r\nlet BackupItemAssociationAndStorageConsumptionUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific \t\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, ResourceId, StorageReplicationType \r\n) on BackupItemUniqueId\r\n| join kind= leftouter (\r\n StorageAssociationUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId, TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, ResourceId, StorageReplicationType \r\n};\r\nlet LatestBackupItemAssociationAndStorageConsumptionTable = ()\r\n{\r\nLatestBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId)\r\n on BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, \r\nBackupManagementType, BackupItemType, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState, TimeGenerated, ResourceId, StorageReplicationType\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\n// projecting TimeRangeDay to distill the report for RangeEndDay\r\nLatestBackupItemAssociationAndStorageConsumptionTable | project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, PolicyUniqueId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState, TimeRangeEndDay = startofday(TimeGenerated), CustomBackupManagementType = BackupManagementType, ResourceId, StorageReplicationType\r\n};\r\nlet LatestProtectedContainerInfoTableExcludingDPMVMs = (){\r\n// projecting TimeRangeDay to distill the report for RangeEndDay\r\nLatestBackupItemAssociationAndStorageConsumptionTable\r\n| where not((BackupManagementType has \"DPM\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"DPM\" and BackupItemType has \"HyperVVM\") \r\nor (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"HyperVVM\"))\r\n// CustomBackupManagementType needed to distinguish 'AzureWorkload' \r\n| summarize StorageConsumedInMBs = sum(StorageConsumedInMBs), StorageAllocatedInMBs= sum(StorageAllocatedInMBs), BackupItemFrontEndSize = sum(BackupItemFrontEndSize), ProtectedContainerName = any(ProtectedContainerName), ProtectedContainerFriendlyName= any(ProtectedContainerFriendlyName), TimeRangeEndDay = startofday(any(TimeGenerated)), \r\nBackupManagementType = any(BackupManagementType), CustomBackupManagementType = iff((any(BackupManagementType) has \"AzureWorkload\"), any(strcat(BackupManagementType, \"/\", BackupItemType)), any(BackupManagementType)), StorageReplicationType = any(StorageReplicationType), ResourceId = any(ResourceId) by ProtectedContainerUniqueId\r\n};\r\nlet LatestProtectedInstanceTable = (isProtectedContainerBillingType:bool) \r\n{CombinedTable | union isfuzzy = true \r\n(ProtectedInstanceUnderAzureDiagnostics(isProtectedContainerBillingType)),\r\n(ProtectedInstanceUnderResourceSpecific(isProtectedContainerBillingType))\r\n| where startofday(TimeGenerated) == AsonDay\r\n// ProtectedInstance is at BillingEntity level. CustomBackupManagementType can be the filter used.\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId\r\n| project BackupItemUniqueId, ProtectedContainerUniqueId, BackupManagementType, ResourceId, TimeGenerated, ProtectedInstanceCount, TimeRangeEndDay = startofday(TimeGenerated), StorageReplicationType\r\n};\r\nlet LatestProtectedInstanceTableFromProtectedContainerUniqueId = ()\r\n{ \r\nLatestProtectedInstanceTable(true)\r\n| join kind= rightouter (LatestProtectedContainerInfoTableExcludingDPMVMs ) on ProtectedContainerUniqueId\r\n| project TimeRangeEndDay = TimeRangeEndDay1, ProtectedInstanceCount, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, BackupManagementType = BackupManagementType1, CustomBackupManagementType, BillingEntityType = \"ProtectedContainer\", BillingEntityName = ProtectedContainerFriendlyName, \r\n BillingEntityUniqueId = ProtectedContainerUniqueId1, ResourceId = ResourceId1, StorageReplicationType = StorageReplicationType1, ProtectedContainerName\r\n};\r\nlet LatestProtectedInstanceTableFromBackupItemUniqueId = ()\r\n{ \r\n(LatestProtectedInstanceTable(false)\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\"))\r\n| join kind= rightouter \r\n// applicable only for DPM VM Scenarios\r\n(LatestBackupItemInfoTable | where ((BackupManagementType has \"DPM\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"DPM\" and BackupItemType has \"HyperVVM\") \r\nor (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"HyperVVM\")))\r\non BackupItemUniqueId\r\n| project TimeRangeEndDay = TimeRangeEndDay1, ProtectedInstanceCount, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, BackupManagementType, CustomBackupManagementType, BillingEntityType = \"BackupItem\", BillingEntityName = BackupItemFriendlyName, \r\n BillingEntityUniqueId = BackupItemUniqueId1, ResourceId = ResourceId1, StorageReplicationType = StorageReplicationType1\r\n};\r\n// Special handling for DPM, AzureBackupServer Cluster scenario - Node PS has ProtectedInstance, whereas Cluster PS has storage Consumption\r\nlet LatestProtectedInstanceTableFromDPMNodeProtectedContainerUniqueId = ()\r\n{ \r\n(\r\n(LatestProtectedInstanceTable(true)\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\")\r\n| where ProtectedInstanceCount > 0)\r\n| join kind= leftanti (LatestProtectedContainerInfoTableExcludingDPMVMs ) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId, BackupManagementType, ResourceId, TimeGenerated, ProtectedInstanceCount, TimeRangeEndDay, StorageReplicationType)\r\n| join (\r\nCombinedTable | union isfuzzy = true \r\n(ProtectedContainerUnderAzureDiagnostics()),\r\n(ProtectedContainerUnderResourceSpecific())\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\")\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId)\r\n on ProtectedContainerUniqueId\r\n // BackupItemFrontEndSize and StorageConsumed will be 0.0 as the same will be calculated at cluster level \r\n // As it is DPM or AzureBackupServer, no extra handling needed for AzureWorkload\r\n| project TimeRangeEndDay, ProtectedInstanceCount, BackupItemFrontEndSize = 0.0,\r\n StorageConsumedInMBs = 0.0, BackupManagementType, CustomBackupManagementType = BackupManagementType,\r\n BillingEntityType = \"ProtectedContainer\", BillingEntityName = ProtectedContainerFriendlyName, \r\n BillingEntityUniqueId = ProtectedContainerUniqueId, ResourceId, StorageReplicationType, ProtectedContainerName\r\n};\r\nlet ProtectedInstanceMetric = ( ) \r\n{ union \r\n(LatestProtectedInstanceTableFromBackupItemUniqueId() ),\r\n(LatestProtectedInstanceTableFromProtectedContainerUniqueId()),\r\n(LatestProtectedInstanceTableFromDPMNodeProtectedContainerUniqueId)\r\n| where BillingEntityName contains (BillingEntityNameParam) or '*' in (BillingEntityNameParam)\r\n| summarize arg_max(TimeRangeEndDay, *) by BillingEntityUniqueId \r\n};\r\nlet ProtectedInstanceCount = ()\r\n{\r\nBMSTypeMappingTable\r\n| join kind = rightouter (\r\nProtectedInstanceMetric\r\n| project ProtectedInstanceCount = iff(isempty(ProtectedInstanceCount) or CustomBackupManagementType == \"AzureStorage\", 0.0 ,todouble(ProtectedInstanceCount)/10), CustomBackupManagementType\r\n| summarize TotalProtectedInstanceCount = sum(ProtectedInstanceCount) by CustomBackupManagementType\r\n) on CustomBackupManagementType\r\n| project CustomBackupManagementType = iff(CustomBMSType == \"\",CustomBackupManagementType1,CustomBMSType), TotalProtectedInstanceCount\r\n| order by CustomBackupManagementType asc\r\n| extend rn = row_number()\r\n| extend Key = pack_array(CustomBackupManagementType), Value = pack_array(TotalProtectedInstanceCount), SubText = pack_array(\"Protected Instance Count\"), Row = pack_array(rn)\r\n| project Key, Value, SubText, Row\r\n| mvexpand Key, Value, SubText, Row\r\n};\r\nlet StorageByStorageReplication = ()\r\n{ProtectedInstanceMetric\r\n| summarize sum(StorageConsumedInMBs) by StorageReplicationType \r\n| order by StorageReplicationType\r\n// The below two values are temporary StorageReplicationType during vault creation\r\n| where StorageReplicationType !in (\"Invalid\", \"\")\r\n| extend rn = row_number(100)\r\n| extend Key = pack_array(StorageReplicationType), Value = pack_array( sum_StorageConsumedInMBs/1024), SubText = pack_array(\"Cloud Storage (GB)\"), Row = pack_array(rn)\r\n| project Key, Value, SubText, Row\r\n| mvexpand Key, Value, SubText, Row\r\n};\r\nunion ProtectedInstanceCount, StorageByStorageReplication \r\n| order by toint(Row) asc", + "size": 3, + "noDataMessage": "No records found for the selected time range and scope", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Key", + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubText", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + "showBorder": true + } + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "Usage-Tiles" + }, + { + "type": 1, + "content": { + "json": "_____________________" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "Usage-DividingLine2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\")); \r\nlet BillingEntityNameParam = @\"{BillingEntityName}\";\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationHistoryUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationHistoryUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeHistoryUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeHistoryUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationHistoryUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationHistoryUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today \r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerHistoryUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerHistoryUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedInstanceHistoryUnderAzureDiagnostics = (isProtectedContainerBillingType:bool)\r\n{\r\n let ProtectedInstanceTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedInstance\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"),\r\n ProtectedInstanceCount = toint(columnifexists(\"ProtectedInstanceCount_s\", \"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| where (BackupItemUniqueId == \"\" and isProtectedContainerBillingType) or (ProtectedContainerUniqueId == \"\" and not(isProtectedContainerBillingType))\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedInstanceTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedInstanceHistoryUnderResourceSpecific = (isProtectedContainerBillingType:bool)\r\n{\r\nlet ProtectedInstanceTable = AddonAzureBackupProtectedInstance \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedInstance\" and State != \"Deleted\"\r\n| where (BackupItemUniqueId == \"\" and isProtectedContainerBillingType) or (ProtectedContainerUniqueId == \"\" and not(isProtectedContainerBillingType))\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n ProtectedInstanceTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState};\r\nlet BackupItemAssociationAndStorageConsumptionHistoryUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerUniqueId, ProtectedContainerFriendlyName \r\n| join kind= rightouter (\r\n BackupItemAssociationHistoryUnderAzureDiagnostics | project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on ProtectedContainerUniqueId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId , TimeRangeEndDay\r\n | join kind= leftouter (\r\n BackupItemFrontEndSizeHistoryUnderAzureDiagnostics | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId \r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeGenerated, TimeRangeEndDay, BackupItemUniqueId, BackupItemFrontEndSize, PolicyUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay\r\n| join kind= leftouter (\r\n StorageAssociationHistoryUnderAzureDiagnostics | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project BackupItemUniqueId,TimeGenerated, TimeRangeEndDay,ResourceId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs \r\n};\r\nlet BackupItemAssociationAndStorageConsumptionHistoryUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationHistoryUnderResourceSpecific | project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on ProtectedContainerUniqueId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay \r\n | join kind= leftouter (\r\n BackupItemFrontEndSizeHistoryUnderResourceSpecific | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId \r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeGenerated, TimeRangeEndDay, BackupItemUniqueId, BackupItemFrontEndSize, PolicyUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay\r\n| join kind= leftouter (\r\n StorageAssociationHistoryUnderResourceSpecific | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project BackupItemUniqueId,TimeGenerated, TimeRangeEndDay,ResourceId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs \r\n};\r\nlet partition_data = (p:long, n:long) \r\n{\r\nTotalBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionHistoryUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionHistoryUnderResourceSpecific())\r\n| where hash(BackupItemUniqueId, n) == p\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay)\r\n on BackupItemUniqueId\r\n};\r\nlet LatestBackupItemAssociationAndStorageConsumptionHistoryTable = materialize(\r\nunion hint.spread=5 hint.concurrency=5 (partition_data(0,5)), (partition_data(1,5)), (partition_data(2,5)), (partition_data(3,5)), (partition_data(4,5))\r\n);\r\nlet LatestBackupItemHistoryInfoTable = (){\r\nLatestBackupItemAssociationAndStorageConsumptionHistoryTable \r\n| project BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, PolicyUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState, CustomBackupManagementType = BackupManagementType, ProtectedContainerUniqueId, BackupItemUniqueId, TimeRangeEndDay\r\n};\r\nlet LatestProtectedContainerHistoryInfoTableExcludingDPMVMs = (){\r\nLatestBackupItemAssociationAndStorageConsumptionHistoryTable \r\n| where not((BackupManagementType has \"DPM\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"DPM\" and BackupItemType has \"HyperVVM\") \r\nor (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"HyperVVM\"))\r\n| summarize StorageConsumedInMBs = sum(StorageConsumedInMBs), StorageAllocatedInMBs= sum(StorageAllocatedInMBs), BackupItemFrontEndSize = sum(BackupItemFrontEndSize), ProtectedContainerName = any(ProtectedContainerName), ProtectedContainerFriendlyName = any(ProtectedContainerFriendlyName), CustomBackupManagementType = iff((any(BackupManagementType) has \"AzureWorkload\"), any(strcat(BackupManagementType, \"/\", BackupItemType)), any(BackupManagementType)), BackupManagementType = any(BackupManagementType) by ProtectedContainerUniqueId, TimeRangeEndDay\r\n};\r\nlet TotalProtectedInstanceHistoryTable = (isProtectedContainerBillingType:bool) \r\n{CombinedTable | union isfuzzy = true \r\n(ProtectedInstanceHistoryUnderAzureDiagnostics(isProtectedContainerBillingType)),\r\n(ProtectedInstanceHistoryUnderResourceSpecific(isProtectedContainerBillingType))\r\n// ProtectedInstance is at BillingEntity level. CustomBackupManagementType can be the filter used.\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId, TimeRangeEndDay\r\n};\r\nlet LatestProtectedInstanceHistoryTableFromProtectedContainerUniqueId = ()\r\n{ \r\nTotalProtectedInstanceHistoryTable(true) \r\n| join kind= rightouter (LatestProtectedContainerHistoryInfoTableExcludingDPMVMs) on ProtectedContainerUniqueId, TimeRangeEndDay\r\n| project TimeRangeEndDay = iff(isempty(TimeRangeEndDay1), TimeRangeEndDay, TimeRangeEndDay1), ProtectedInstanceCount, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, BackupManagementType = BackupManagementType1, CustomBackupManagementType, BillingEntityType = \"ProtectedContainer\", BillingEntityName = ProtectedContainerFriendlyName, BillingEntityUniqueId = ProtectedContainerUniqueId1\r\n};\r\nlet LatestProtectedInstanceHistoryTableFromBackupItemUniqueId = ()\r\n{ \r\n(TotalProtectedInstanceHistoryTable(false) \r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\"))\r\n| join kind= rightouter (LatestBackupItemHistoryInfoTable | where ((BackupManagementType has \"DPM\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"DPM\" and BackupItemType has \"HyperVVM\") \r\n or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"HyperVVM\"))) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeRangeEndDay = TimeRangeEndDay1, ProtectedInstanceCount, BackupItemFrontEndSize, StorageConsumedInMBs, CustomBackupManagementType, BackupManagementType, BillingEntityType = \"BackupItem\", BillingEntityName = BackupItemFriendlyName, BillingEntityUniqueId = BackupItemUniqueId1\r\n};\r\n// Special handling for DPM, AzureBackupServer Cluster scenario - Node PS has ProtectedInstance, whereas Cluster PS has storage Consumption\r\nlet LatestProtectedInstanceHistoryTableFromDPMNodeProtectedContainerUniqueId = ()\r\n{ \r\n(\r\n(TotalProtectedInstanceHistoryTable(true) \r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\")\r\n| where ProtectedInstanceCount > 0)\r\n| join kind= leftanti (LatestProtectedContainerHistoryInfoTableExcludingDPMVMs ) on ProtectedContainerUniqueId, TimeRangeEndDay\r\n| project ProtectedContainerUniqueId, BackupManagementType, ResourceId, TimeGenerated, ProtectedInstanceCount, TimeRangeEndDay, StorageReplicationType)\r\n| join (\r\nCombinedTable | union isfuzzy = true \r\n(ProtectedContainerHistoryUnderAzureDiagnostics()),\r\n(ProtectedContainerHistoryUnderResourceSpecific())\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\")\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId, TimeRangeEndDay)\r\n on ProtectedContainerUniqueId, TimeRangeEndDay\r\n // BackupItemFrontEndSize and StorageConsumed will be 0.0 as the same will be calculated at cluster level \r\n // As it is DPM or AzureBackupServer, no extra handling needed for AzureWorkload\r\n| project TimeRangeEndDay, ProtectedInstanceCount, BackupItemFrontEndSize = 0.0,\r\n StorageConsumedInMBs = 0.0, BackupManagementType, CustomBackupManagementType = BackupManagementType,\r\n BillingEntityType = \"ProtectedContainer\", BillingEntityName = ProtectedContainerFriendlyName, \r\n BillingEntityUniqueId = ProtectedContainerUniqueId, ResourceId, StorageReplicationType, ProtectedContainerName\r\n};\r\nlet ProtectedInstanceHistoryMetric = ( )\r\n{ union \r\n(LatestProtectedInstanceHistoryTableFromProtectedContainerUniqueId()),\r\n(LatestProtectedInstanceHistoryTableFromBackupItemUniqueId()),\r\n(LatestProtectedInstanceHistoryTableFromDPMNodeProtectedContainerUniqueId)\r\n| project CustomBackupManagementType, BackupItemFrontEndSize, StorageConsumedInMBs, BillingEntityUniqueId, BillingEntityName, ProtectedInstanceCount, BillingEntityType, TimeRangeEndDay, BackupManagementType\r\n| where BillingEntityName contains (BillingEntityNameParam) or '*' in (BillingEntityNameParam)\r\n};\r\nProtectedInstanceHistoryMetric()\r\n// Display Tweaks for AFS and null ProtectedInstanceCount\r\n// Billing Entity is at BackupManagementType level and not at DS level. Hence BMSTypeWithBackupItemType can't be used.\r\n| project ProtectedInstanceCount = iff(isempty(ProtectedInstanceCount) or CustomBackupManagementType == \"AzureStorage\", 0.0 ,(todouble(ProtectedInstanceCount)/10)), TimeRangeEndDay\r\n| summarize ProtectedInstanceCount = sum(ProtectedInstanceCount) by TimeRangeEndDay", + "size": 0, + "aggregation": 5, + "title": "Protected Instances Trend", + "noDataMessage": "No records found for the selected time range and scope", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "gridSettings": { + "sortBy": [ + { + "itemKey": "TimeRangeEndDay", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "TimeRangeEndDay", + "sortOrder": 2 + } + ], + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "ProtectedInstanceCount", + "label": "# Protected Instances" + } + ] + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "Usage-ProtectedInstancesTrendGraph" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\n// Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\")); \r\nlet BillingEntityNameParam = @\"{BillingEntityName}\";\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationHistoryUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationHistoryUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeHistoryUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeHistoryUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationHistoryUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationHistoryUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today \r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerHistoryUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerHistoryUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedInstanceHistoryUnderAzureDiagnostics = (isProtectedContainerBillingType:bool)\r\n{\r\n let ProtectedInstanceTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedInstance\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"),\r\n ProtectedInstanceCount = toint(columnifexists(\"ProtectedInstanceCount_s\", \"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| where (BackupItemUniqueId == \"\" and isProtectedContainerBillingType) or (ProtectedContainerUniqueId == \"\" and not(isProtectedContainerBillingType))\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedInstanceTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedInstanceHistoryUnderResourceSpecific = (isProtectedContainerBillingType:bool)\r\n{\r\nlet ProtectedInstanceTable = AddonAzureBackupProtectedInstance \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedInstance\" and State != \"Deleted\"\r\n| where (BackupItemUniqueId == \"\" and isProtectedContainerBillingType) or (ProtectedContainerUniqueId == \"\" and not(isProtectedContainerBillingType))\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId, TimeRangeEndDay = startofday(TimeGenerated);\r\nVaultUnderResourceSpecific | join (\r\n ProtectedInstanceTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet TotalBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState};\r\nlet BackupItemAssociationAndStorageConsumptionHistoryUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerUniqueId, ProtectedContainerFriendlyName \r\n| join kind= rightouter (\r\n BackupItemAssociationHistoryUnderAzureDiagnostics | project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on ProtectedContainerUniqueId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId , TimeRangeEndDay\r\n | join kind= leftouter (\r\n BackupItemFrontEndSizeHistoryUnderAzureDiagnostics | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId \r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeGenerated, TimeRangeEndDay, BackupItemUniqueId, BackupItemFrontEndSize, PolicyUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay\r\n| join kind= leftouter (\r\n StorageAssociationHistoryUnderAzureDiagnostics | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project BackupItemUniqueId,TimeGenerated, TimeRangeEndDay,ResourceId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs \r\n};\r\nlet BackupItemAssociationAndStorageConsumptionHistoryUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationHistoryUnderResourceSpecific | project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on ProtectedContainerUniqueId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay \r\n | join kind= leftouter (\r\n BackupItemFrontEndSizeHistoryUnderResourceSpecific | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId \r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeGenerated, TimeRangeEndDay, BackupItemUniqueId, BackupItemFrontEndSize, PolicyUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ResourceId\r\n | summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay\r\n| join kind= leftouter (\r\n StorageAssociationHistoryUnderResourceSpecific | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, TimeRangeEndDay, ResourceId\r\n) on BackupItemUniqueId, TimeRangeEndDay\r\n| project BackupItemUniqueId,TimeGenerated, TimeRangeEndDay,ResourceId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs \r\n};\r\nlet partition_data = (p:long, n:long) \r\n{\r\nTotalBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionHistoryUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionHistoryUnderResourceSpecific())\r\n| where hash(BackupItemUniqueId, n) == p\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, TimeRangeEndDay)\r\n on BackupItemUniqueId\r\n};\r\nlet LatestBackupItemAssociationAndStorageConsumptionHistoryTable = materialize(\r\nunion hint.spread=5 hint.concurrency=5 (partition_data(0,5)), (partition_data(1,5)), (partition_data(2,5)), (partition_data(3,5)), (partition_data(4,5))\r\n);\r\nlet LatestBackupItemHistoryInfoTable = (){\r\nLatestBackupItemAssociationAndStorageConsumptionHistoryTable \r\n| project BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, PolicyUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState, CustomBackupManagementType = BackupManagementType, ProtectedContainerUniqueId, BackupItemUniqueId, TimeRangeEndDay\r\n};\r\nlet LatestProtectedContainerHistoryInfoTableExcludingDPMVMs = (){\r\nLatestBackupItemAssociationAndStorageConsumptionHistoryTable \r\n| where not((BackupManagementType has \"DPM\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"DPM\" and BackupItemType has \"HyperVVM\") \r\nor (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"HyperVVM\"))\r\n| summarize StorageConsumedInMBs = sum(StorageConsumedInMBs), StorageAllocatedInMBs= sum(StorageAllocatedInMBs), BackupItemFrontEndSize = sum(BackupItemFrontEndSize), ProtectedContainerName = any(ProtectedContainerName), ProtectedContainerFriendlyName = any(ProtectedContainerFriendlyName), CustomBackupManagementType = iff((any(BackupManagementType) has \"AzureWorkload\"), any(strcat(BackupManagementType, \"/\", BackupItemType)), any(BackupManagementType)), BackupManagementType = any(BackupManagementType) by ProtectedContainerUniqueId, TimeRangeEndDay\r\n};\r\nlet TotalProtectedInstanceHistoryTable = (isProtectedContainerBillingType:bool) \r\n{CombinedTable | union isfuzzy = true \r\n(ProtectedInstanceHistoryUnderAzureDiagnostics(isProtectedContainerBillingType)),\r\n(ProtectedInstanceHistoryUnderResourceSpecific(isProtectedContainerBillingType))\r\n// ProtectedInstance is at BillingEntity level. CustomBackupManagementType can be the filter used.\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId, TimeRangeEndDay\r\n};\r\nlet LatestProtectedInstanceHistoryTableFromProtectedContainerUniqueId = ()\r\n{ \r\nTotalProtectedInstanceHistoryTable(true) \r\n| join kind= rightouter (LatestProtectedContainerHistoryInfoTableExcludingDPMVMs) on ProtectedContainerUniqueId, TimeRangeEndDay\r\n| project TimeRangeEndDay = iff(isempty(TimeRangeEndDay1), TimeRangeEndDay, TimeRangeEndDay1), ProtectedInstanceCount, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, BackupManagementType = BackupManagementType1, CustomBackupManagementType, BillingEntityType = \"ProtectedContainer\", BillingEntityName = ProtectedContainerFriendlyName, BillingEntityUniqueId = ProtectedContainerUniqueId1\r\n};\r\nlet LatestProtectedInstanceHistoryTableFromBackupItemUniqueId = ()\r\n{ \r\n(TotalProtectedInstanceHistoryTable(false) \r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\"))\r\n| join kind= rightouter (LatestBackupItemHistoryInfoTable | where ((BackupManagementType has \"DPM\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"DPM\" and BackupItemType has \"HyperVVM\") \r\n or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"HyperVVM\"))) on BackupItemUniqueId, TimeRangeEndDay\r\n| project TimeRangeEndDay = TimeRangeEndDay1, ProtectedInstanceCount, BackupItemFrontEndSize, StorageConsumedInMBs, CustomBackupManagementType, BackupManagementType, BillingEntityType = \"BackupItem\", BillingEntityName = BackupItemFriendlyName, BillingEntityUniqueId = BackupItemUniqueId1\r\n};\r\n// Special handling for DPM, AzureBackupServer Cluster scenario - Node PS has ProtectedInstance, whereas Cluster PS has storage Consumption\r\nlet LatestProtectedInstanceHistoryTableFromDPMNodeProtectedContainerUniqueId = ()\r\n{ \r\n(\r\n(TotalProtectedInstanceHistoryTable(true) \r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\")\r\n| where ProtectedInstanceCount > 0)\r\n| join kind= leftanti (LatestProtectedContainerHistoryInfoTableExcludingDPMVMs ) on ProtectedContainerUniqueId, TimeRangeEndDay\r\n| project ProtectedContainerUniqueId, BackupManagementType, ResourceId, TimeGenerated, ProtectedInstanceCount, TimeRangeEndDay, StorageReplicationType)\r\n| join (\r\nCombinedTable | union isfuzzy = true \r\n(ProtectedContainerHistoryUnderAzureDiagnostics()),\r\n(ProtectedContainerHistoryUnderResourceSpecific())\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\")\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId, TimeRangeEndDay)\r\n on ProtectedContainerUniqueId, TimeRangeEndDay\r\n // BackupItemFrontEndSize and StorageConsumed will be 0.0 as the same will be calculated at cluster level \r\n // As it is DPM or AzureBackupServer, no extra handling needed for AzureWorkload\r\n| project TimeRangeEndDay, ProtectedInstanceCount, BackupItemFrontEndSize = 0.0,\r\n StorageConsumedInMBs = 0.0, BackupManagementType, CustomBackupManagementType = BackupManagementType,\r\n BillingEntityType = \"ProtectedContainer\", BillingEntityName = ProtectedContainerFriendlyName, \r\n BillingEntityUniqueId = ProtectedContainerUniqueId, ResourceId, StorageReplicationType, ProtectedContainerName\r\n};\r\nlet ProtectedInstanceHistoryMetric = ( )\r\n{ union \r\n(LatestProtectedInstanceHistoryTableFromProtectedContainerUniqueId()),\r\n(LatestProtectedInstanceHistoryTableFromBackupItemUniqueId()),\r\n(LatestProtectedInstanceHistoryTableFromDPMNodeProtectedContainerUniqueId)\r\n| project CustomBackupManagementType, BackupItemFrontEndSize, StorageConsumedInMBs, BillingEntityUniqueId, BillingEntityName, ProtectedInstanceCount, BillingEntityType, TimeRangeEndDay, BackupManagementType\r\n| where BillingEntityName contains (BillingEntityNameParam) or '*' in (BillingEntityNameParam)\r\n};\r\nProtectedInstanceHistoryMetric()\r\n// Display Tweaks for AFS and null ProtectedInstanceCount\r\n// Billing Entity is at BackupManagementType level and not at DS level. Hence BMSTypeWithBackupItemType can't be used.\r\n| project TimeRangeEndDay, StorageConsumedInMBs = iff(isempty(StorageConsumedInMBs), todouble(0), StorageConsumedInMBs)\r\n| summarize StorageConsumedInGBs = sum(StorageConsumedInMBs)/(1024) by TimeRangeEndDay", + "size": 0, + "aggregation": 5, + "title": "Cloud Storage Trend", + "noDataMessage": "No records found for the selected time range and scope", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "gridSettings": { + "sortBy": [ + { + "itemKey": "TimeRangeEndDay", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "TimeRangeEndDay", + "sortOrder": 2 + } + ], + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "StorageConsumedInMBs", + "label": "Cloud Storage (MB)" + }, + { + "seriesName": "StorageConsumedInGBs", + "label": "Cloud Storage (GB)" + } + ], + "xSettings": { + "unit": 17, + "min": null, + "max": null + } + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "Usage-CloudStorageTrendGraph" + }, + { + "type": 1, + "content": { + "json": "___________" + }, + "conditionalVisibility": { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "Usage-DividingLine2" + }, + { + "type": 1, + "content": { + "json": "
Protected Instances and Storage by Billed Entity
" + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "Usage-Grid1Title", + "styleSettings": { + "margin": "0% 0% 10px 0%" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "5dc2a074-b510-44f2-9530-cfcbd159b59c", + "version": "KqlParameterItem/1.0", + "name": "ProtectedInstanceMetricSortBy", + "label": "Sort By", + "type": 2, + "description": "Use to sort by a certain column", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[{ \"value\": \"ProtectedInstanceCount\", \"label\": \"# Protected Instances\" },\r\n{ \"value\": \"StorageConsumedInMBs\", \"label\": \"Cloud Storage (MB)\", \"selected\": \"true\" }]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "df3cc03c-53f7-4523-a29b-e50bf1b6d922", + "version": "KqlParameterItem/1.0", + "name": "ProtectedInstanceMetricOrder", + "label": "Order", + "type": 2, + "description": "Use to specify the sort order: Ascending/Descending", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":\"Ascending\"},\r\n { \"value\":\"Descending\", \"selected\":true}\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "102bf69d-4952-4a1f-827d-fd726a82d666", + "version": "KqlParameterItem/1.0", + "name": "ProtectedInstanceMetricRowsPerGrid", + "label": "Rows per page", + "type": 2, + "description": "Number of rows to display in grid view", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\":10, \"label\":\"10\", \"selected\":true },\r\n { \"value\":25, \"label\":\"25\" },\r\n { \"value\":50, \"label\":\"50\" },\r\n { \"value\":100, \"label\":\"100\" },\r\n { \"value\":250, \"label\":\"250\" },\r\n { \"value\":500, \"label\":\"500\" },\r\n { \"value\":1000, \"label\":\"1000\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "f4433681-963d-4204-867c-c54c6c89d3f8", + "version": "KqlParameterItem/1.0", + "name": "ProtectedInstanceMetricPageNumber", + "label": "Page", + "type": 2, + "description": "Select Page Number", + "isRequired": true, + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet NumberOfDaysInRange = datetime_diff('day',RangeEnd, RangeStart);\r\n// AsonDay is needed to project consumption data only as per the last complete day.\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\nlet BMSTypeMappingTable = datatable (CustomBackupManagementType:string, CustomBMSType:string)\r\n [ \"IaaSVM\", \"Azure Virtual Machine\",\r\n\t \"MAB\", \"Azure Backup Agent\",\r\n\t \"DPM\", \"DPM\",\r\n\t \"AzureBackupServer\", \"Azure Backup Server\",\r\n\t \"AzureStorage\", \"Azure Storage (Azure Files)\",\r\n\t \"AzureWorkload/SQLDataBase\", \"SQL in Azure VM\",\r\n\t \"AzureWorkload/SAPHanaDatabase\", \"SAP HANA in Azure VM\"\r\n\t];\r\n // Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet BillingEntityNameParam = @\"{BillingEntityName}\";\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId, BackupManagementServerUniqueId, StorageUniqueId, StorageConsumedInMBs, StorageAllocatedInMBs, TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedInstanceUnderAzureDiagnostics = (isProtectedContainerBillingType:bool)\r\n{\r\n let ProtectedInstanceTable = AzureDiagnostics \r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedInstance\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"),\r\n ProtectedInstanceCount = toint(columnifexists(\"ProtectedInstanceCount_s\", \"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| where (BackupItemUniqueId == \"\" and isProtectedContainerBillingType) or (ProtectedContainerUniqueId == \"\" and not(isProtectedContainerBillingType))\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedInstanceTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedInstanceUnderResourceSpecific = (isProtectedContainerBillingType:bool)\r\n{\r\nlet ProtectedInstanceTable = AddonAzureBackupProtectedInstance \r\n| where OperationName == \"ProtectedInstance\" and State != \"Deleted\"\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where (BackupItemUniqueId == \"\" and isProtectedContainerBillingType) or (ProtectedContainerUniqueId == \"\" and not(isProtectedContainerBillingType))\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedInstanceTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\t\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, ResourceId, StorageReplicationType \r\n) on BackupItemUniqueId\r\n| join kind= leftouter (\r\n StorageAssociationUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId, TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, ResourceId, StorageReplicationType \r\n};\r\nlet BackupItemAssociationAndStorageConsumptionUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific \t\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, ResourceId, StorageReplicationType \r\n) on BackupItemUniqueId\r\n| join kind= leftouter (\r\n StorageAssociationUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId, TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, ResourceId, StorageReplicationType \r\n};\r\nlet LatestBackupItemAssociationAndStorageConsumptionTable = ()\r\n{\r\nLatestBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId)\r\n on BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, \r\nBackupManagementType, BackupItemType, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState, TimeGenerated, ResourceId, StorageReplicationType\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\n// projecting TimeRangeDay to distill the report for RangeEndDay\r\nLatestBackupItemAssociationAndStorageConsumptionTable | project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, PolicyUniqueId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState, TimeRangeEndDay = startofday(TimeGenerated), CustomBackupManagementType = BackupManagementType, ResourceId, StorageReplicationType\r\n};\r\nlet LatestProtectedContainerInfoTableExcludingDPMVMs = (){\r\n// projecting TimeRangeDay to distill the report for RangeEndDay\r\nLatestBackupItemAssociationAndStorageConsumptionTable\r\n| where not((BackupManagementType has \"DPM\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"DPM\" and BackupItemType has \"HyperVVM\") \r\nor (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"HyperVVM\"))\r\n// CustomBackupManagementType needed to distinguish 'AzureWorkload' \r\n| summarize StorageConsumedInMBs = sum(StorageConsumedInMBs), StorageAllocatedInMBs= sum(StorageAllocatedInMBs), BackupItemFrontEndSize = sum(BackupItemFrontEndSize), ProtectedContainerName = any(ProtectedContainerName), ProtectedContainerFriendlyName= any(ProtectedContainerFriendlyName), TimeRangeEndDay = startofday(any(TimeGenerated)), \r\nBackupManagementType = any(BackupManagementType), CustomBackupManagementType = iff((any(BackupManagementType) has \"AzureWorkload\"), any(strcat(BackupManagementType, \"/\", BackupItemType)), any(BackupManagementType)), StorageReplicationType = any(StorageReplicationType), ResourceId = any(ResourceId) by ProtectedContainerUniqueId\r\n};\r\nlet LatestProtectedInstanceTable = (isProtectedContainerBillingType:bool) \r\n{CombinedTable | union isfuzzy = true \r\n(ProtectedInstanceUnderAzureDiagnostics(isProtectedContainerBillingType)),\r\n(ProtectedInstanceUnderResourceSpecific(isProtectedContainerBillingType))\r\n| where startofday(TimeGenerated) == AsonDay\r\n// ProtectedInstance is at BillingEntity level. CustomBackupManagementType can be the filter used.\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId\r\n| project BackupItemUniqueId, ProtectedContainerUniqueId, BackupManagementType, ResourceId, TimeGenerated, ProtectedInstanceCount, TimeRangeEndDay = startofday(TimeGenerated), StorageReplicationType\r\n};\r\nlet LatestProtectedInstanceTableFromProtectedContainerUniqueId = ()\r\n{ \r\nLatestProtectedInstanceTable(true)\r\n| join kind= rightouter (LatestProtectedContainerInfoTableExcludingDPMVMs ) on ProtectedContainerUniqueId\r\n| project TimeRangeEndDay = TimeRangeEndDay1, ProtectedInstanceCount, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, BackupManagementType = BackupManagementType1, CustomBackupManagementType, BillingEntityType = \"ProtectedContainer\", BillingEntityName = ProtectedContainerFriendlyName, \r\n BillingEntityUniqueId = ProtectedContainerUniqueId1, ResourceId = ResourceId1, StorageReplicationType = StorageReplicationType1, ProtectedContainerName\r\n};\r\nlet LatestProtectedInstanceTableFromBackupItemUniqueId = ()\r\n{ \r\n(LatestProtectedInstanceTable(false)\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\"))\r\n| join kind= rightouter \r\n// applicable only for DPM VM Scenarios\r\n(LatestBackupItemInfoTable | where ((BackupManagementType has \"DPM\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"DPM\" and BackupItemType has \"HyperVVM\") \r\nor (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"HyperVVM\")))\r\non BackupItemUniqueId\r\n| project TimeRangeEndDay = TimeRangeEndDay1, ProtectedInstanceCount, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, BackupManagementType, CustomBackupManagementType, BillingEntityType = \"BackupItem\", BillingEntityName = BackupItemFriendlyName, \r\n BillingEntityUniqueId = BackupItemUniqueId1, ResourceId = ResourceId1, StorageReplicationType = StorageReplicationType1\r\n};\r\n// Special handling for DPM, AzureBackupServer Cluster scenario - Node PS has ProtectedInstance, whereas Cluster PS has storage Consumption\r\nlet LatestProtectedInstanceTableFromDPMNodeProtectedContainerUniqueId = ()\r\n{ \r\n(\r\n(LatestProtectedInstanceTable(true)\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\")\r\n| where ProtectedInstanceCount > 0)\r\n| join kind= leftanti (LatestProtectedContainerInfoTableExcludingDPMVMs ) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId, BackupManagementType, ResourceId, TimeGenerated, ProtectedInstanceCount, TimeRangeEndDay, StorageReplicationType)\r\n| join (\r\nCombinedTable | union isfuzzy = true \r\n(ProtectedContainerUnderAzureDiagnostics()),\r\n(ProtectedContainerUnderResourceSpecific())\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\")\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId)\r\n on ProtectedContainerUniqueId\r\n // BackupItemFrontEndSize and StorageConsumed will be 0.0 as the same will be calculated at cluster level \r\n // As it is DPM or AzureBackupServer, no extra handling needed for AzureWorkload\r\n| project TimeRangeEndDay, ProtectedInstanceCount, BackupItemFrontEndSize = 0.0,\r\n StorageConsumedInMBs = 0.0, BackupManagementType, CustomBackupManagementType = BackupManagementType,\r\n BillingEntityType = \"ProtectedContainer\", BillingEntityName = ProtectedContainerFriendlyName, \r\n BillingEntityUniqueId = ProtectedContainerUniqueId, ResourceId, StorageReplicationType, ProtectedContainerName\r\n};\r\nlet ProtectedInstanceMetric = ( ) \r\n{ union \r\n(LatestProtectedInstanceTableFromBackupItemUniqueId() ),\r\n(LatestProtectedInstanceTableFromProtectedContainerUniqueId()),\r\n(LatestProtectedInstanceTableFromDPMNodeProtectedContainerUniqueId)\r\n| where BillingEntityName contains (BillingEntityNameParam) or '*' in (BillingEntityNameParam)\r\n| summarize arg_max(TimeRangeEndDay, *) by BillingEntityUniqueId \r\n};\r\nProtectedInstanceMetric\r\n| summarize c=count()\r\n| project num = (c-1)/{ProtectedInstanceMetricRowsPerGrid} + 1\r\n| project nums = range(1,num,1), num\r\n| mvexpand nums\r\n| project nums = tostring(nums), num = strcat(tostring(nums),\" of \",tostring(num))", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "90", + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "name": "Usage-Grid1ParameterBlock", + "styleSettings": { + "margin": "-23px 0% 0% 0%", + "padding": "0% 0% 0% 0%" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Time variable used\r\nlet Today = startofday(now());\r\nlet RangeStart = startofday({TimeRange:start});\r\nlet RangeEnd = startofday({TimeRange:end}) + 1d;\r\nlet NumberOfDaysInRange = datetime_diff('day',RangeEnd, RangeStart);\r\n// AsonDay is needed to project consumption data only as per the last complete day.\r\nlet AsonDay = iff((RangeEnd-Today == 1d),RangeEnd-2d, RangeEnd-1d);\r\nlet AzureStorageCutoffDate = datetime({AzureStorageCutOffDate});\r\nlet BMSTypeMappingTable = datatable (CustomBackupManagementType:string, CustomBMSType:string)\r\n [ \"IaaSVM\", \"Azure Virtual Machine\",\r\n\t \"MAB\", \"Azure Backup Agent\",\r\n\t \"DPM\", \"DPM\",\r\n\t \"AzureBackupServer\", \"Azure Backup Server\",\r\n\t \"AzureStorage\", \"Azure Storage (Azure Files)\",\r\n\t \"AzureWorkload/SQLDataBase\", \"SQL in Azure VM\",\r\n\t \"AzureWorkload/SAPHanaDatabase\", \"SAP HANA in Azure VM\"\r\n\t];\r\n // Params (excluding sorting params)\r\nlet BackupManagementTypeParam = split(replace(\"/[a-zA-Z*]+\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet BackupItemTypeParam = split(replace(\"[a-zA-Z*]+/\", \"\", @\"{CustomBackupManagementTypeParam}\"),\",\");\r\nlet VaultSubscriptionParam = todynamic(strcat( \"[\", replace(\"/subscriptions/\", \"\", @\"{VaultSubscription:value}\"), \"]\"));\r\nlet LocationParam = todynamic(strcat( \"[\", @\"{Location}\", \"]\")); \r\nlet VaultParam = todynamic(strcat( \"[\", @\"{Vault}\", \"]\"));\r\nlet BillingEntityNameParam = @\"{BillingEntityName}\";\r\n// High-level Functions\r\nlet VaultUnderAzureDiagnostics = ()\r\n{\r\nAzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where Category == \"AzureBackupReport\" and OperationName == \"Vault\" and SchemaVersion_s == \"V2\"\r\n| project VaultName = columnifexists(\"VaultName_s\", \"\"), AzureDataCenter = columnifexists(\"AzureDataCenter_s\", \"\"), ResourceId, StorageReplicationType = StorageReplicationType_s, TimeGenerated \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet VaultUnderResourceSpecific = ()\r\n{\r\nCoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where OperationName == \"Vault\" \r\n| summarize arg_max(TimeGenerated, *) by ResourceId\r\n| parse ResourceId with * \"SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS\" *\r\n| where SubscriptionId in (VaultSubscriptionParam) or '*' in (VaultSubscriptionParam)\r\n| where AzureDataCenter in (LocationParam) or '*' in (LocationParam)\r\n| where VaultName in (VaultParam) or '*' in (VaultParam)\r\n| project StorageReplicationType, ResourceId\r\n};\r\nlet BackupItemUnderAzureDiagnostics = ()\r\n{\r\nlet BackupItemTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItem\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupItemProtectionState = columnifexists(\"BackupItemProtectionState_s\", \"\"), BackupItemAppVersion = columnifexists(\"BackupItemAppVersion_s\", \"\"),\r\nSecondaryBackupProtectionState = columnifexists(\"SecondaryBackupProtectionState_s\", \"\"), BackupItemName = columnifexists(\"BackupItemName_s\", \"\"), BackupItemFriendlyName = columnifexists(\"BackupItemFriendlyName_s\", \"\"),\r\nBackupItemType = columnifexists(\"BackupItemType_s\", \"\"), ProtectionGroupName = columnifexists(\"ProtectionGroupName_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion, SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemUnderResourceSpecific = ()\r\n{\r\nlet BackupItemTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItem\" and State != \"Deleted\"\r\n//Handle MAB system state\r\n| project BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupItemName = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), \"System State\", BackupItemName), BackupItemProtectionState, BackupItemAppVersion,SecondaryBackupProtectionState, BackupItemFriendlyName, BackupItemType, ProtectionGroupName, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), \r\nVaultUniqueId = columnifexists(\"VaultUniqueId_s\", \"\"), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), PolicyUniqueIdGuid = columnifexists(\"PolicyUniqueId_g\", \"\") , PolicyUniqueIdStr = columnifexists(\"PolicyUniqueId_s\", \"\"),\r\nTimeGenerated, ResourceId \r\n// Handle MAB SystemState\r\n| project PolicyUniqueId = iff(PolicyUniqueIdGuid == \"\", PolicyUniqueIdStr, PolicyUniqueIdGuid), BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemAssociationUnderResourceSpecific = ()\r\n{\r\nlet BackupItemAssociationTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemAssociation\" and State != \"Deleted\"\r\n// Handle MAB SystemState\r\n| project PolicyUniqueId, BackupItemUniqueId = iff((BackupManagementType == \"MAB\" and BackupItemUniqueId contains \"ssbv\\\\\"), replace(@\"[^;]+$\", @\"systemstate\", BackupItemUniqueId ), BackupItemUniqueId), BackupManagementServerUniqueId, ProtectedContainerUniqueId, VaultUniqueId, BackupManagementType, TimeGenerated, ResourceId\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemAssociationTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderAzureDiagnostics = ()\r\n{\r\n let BackupItemFrontEndSizeTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"BackupItemFrontEndSizeConsumption\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project BackupItemFrontEndSize = todouble(columnifexists(\"BackupItemFrontEndSize_s\", \"\")), BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet BackupItemFrontEndSizeUnderResourceSpecific = ()\r\n{\r\nlet BackupItemFrontEndSizeTable = CoreAzureBackup \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"BackupItemFrontEndSizeConsumption\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n BackupItemFrontEndSizeTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderAzureDiagnostics = ()\r\n{\r\n let StorageAssociationTable = AzureDiagnostics \r\n // Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"StorageAssociation\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), StorageUniqueId = columnifexists(\"StorageUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"), StorageConsumedInMBs = todouble(columnifexists(\"StorageConsumedInMBs_s\", \"\")), \r\nStorageAllocatedInMBs = todouble(columnifexists(\"StorageAllocatedInMBs_s\", \"\")), TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet StorageAssociationUnderResourceSpecific = ()\r\n{\r\nlet StorageAssociationTable = AddonAzureBackupStorage \r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"StorageAssociation\" and State != \"Deleted\"\r\n// Not Projecting ProtectedContainerUniqueId - DPM/AzureBackupServer ProtectedContainer (incase of cluster) is node PS and not cluster PS\r\n| project BackupItemUniqueId, BackupManagementServerUniqueId, StorageUniqueId, StorageConsumedInMBs, StorageAllocatedInMBs, TimeGenerated, ResourceId \r\n// Providers like DPM, AzureBackupServer has Disk storage. Filtering out cloud storage only.\r\n| where split(StorageUniqueId, \";\")[2] has \"cloud\"\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n StorageAssociationTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderAzureDiagnostics = ()\r\n{\r\nlet ProtectedContainerTable = AzureDiagnostics\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedContainer\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n| project ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), ProtectedContainerFriendlyName = columnifexists(\"ProtectedContainerFriendlyName_s\", \"\"), AgentVersion = columnifexists(\"AgentVersion_s\", \"\"),\r\nProtectedContainerOSType = columnifexists(\"ProtectedContainerOSType_s\", \"\"), ProtectedContainerOSVersion = columnifexists(\"ProtectedContainerOSVersion_s\", \"\"), ProtectedContainerWorkloadType = columnifexists(\"ProtectedContainerWorkloadType_s\", \"\"), ProtectedContainerName = columnifexists(\"ProtectedContainerName_s\", \"\"), ProtectedContainerProtectionState = columnifexists(\"ProtectedContainerProtectionState_s\", \"\"), ProtectedContainerLocation = columnifexists(\"ProtectedContainerLocation_s\", \"\"), ProtectedContainerType = columnifexists(\"ProtectedContainerType_s\", \"\"),\r\nBackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedContainerUnderResourceSpecific = ()\r\n{\r\nlet ProtectedContainerTable = CoreAzureBackup\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where OperationName == \"ProtectedContainer\" and State != \"Deleted\"\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedContainerTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedInstanceUnderAzureDiagnostics = (isProtectedContainerBillingType:bool)\r\n{\r\n let ProtectedInstanceTable = AzureDiagnostics \r\n| where Category == \"AzureBackupReport\" and OperationName == \"ProtectedInstance\" and SchemaVersion_s == \"V2\" and State_s != \"Deleted\"\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType_s == \"AzureStorage\")\r\n| project BackupItemUniqueId = columnifexists(\"BackupItemUniqueId_s\", \"\"), ProtectedContainerUniqueId = columnifexists(\"ProtectedContainerUniqueId_s\", \"\"), BackupManagementServerUniqueId = columnifexists(\"BackupManagementServerUniqueId_s\", \"\"),\r\n ProtectedInstanceCount = toint(columnifexists(\"ProtectedInstanceCount_s\", \"\")), BackupManagementType = columnifexists(\"BackupManagementType_s\", \"\"), TimeGenerated, ResourceId \r\n| where (BackupItemUniqueId == \"\" and isProtectedContainerBillingType) or (ProtectedContainerUniqueId == \"\" and not(isProtectedContainerBillingType))\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId;\r\nVaultUnderAzureDiagnostics | join (\r\n ProtectedInstanceTable \r\n) on ResourceId;\r\n};\r\nlet ProtectedInstanceUnderResourceSpecific = (isProtectedContainerBillingType:bool)\r\n{\r\nlet ProtectedInstanceTable = AddonAzureBackupProtectedInstance \r\n| where OperationName == \"ProtectedInstance\" and State != \"Deleted\"\r\n// Take records until previous day\r\n| where TimeGenerated >= RangeStart and TimeGenerated <= RangeEnd and TimeGenerated < Today\r\n| where not(TimeGenerated <= AzureStorageCutoffDate and BackupManagementType == \"AzureStorage\")\r\n| where (BackupItemUniqueId == \"\" and isProtectedContainerBillingType) or (ProtectedContainerUniqueId == \"\" and not(isProtectedContainerBillingType))\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId;\r\nVaultUnderResourceSpecific | join (\r\n ProtectedInstanceTable \r\n) on ResourceId;\r\n};\r\n// BusinessLogic\r\nlet LatestBackupItemDimensionTable = () {CombinedTable | union isfuzzy = true \r\n(BackupItemUnderAzureDiagnostics()),\r\n(BackupItemUnderResourceSpecific())\r\n| where BackupItemUniqueId != \"\"\r\n// To show as per as on 'AsonDay'\r\n| where startofday(TimeGenerated) == AsonDay\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| where BackupItemType in (BackupItemTypeParam) or '*' in (BackupItemTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, BackupItemProtectionState, ResourceId};\r\nlet BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics = ()\r\n{\r\nProtectedContainerUnderAzureDiagnostics | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderAzureDiagnostics\t\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, ResourceId, StorageReplicationType \r\n) on BackupItemUniqueId\r\n| join kind= leftouter (\r\n StorageAssociationUnderAzureDiagnostics | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId, TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, ResourceId, StorageReplicationType \r\n};\r\nlet BackupItemAssociationAndStorageConsumptionUnderResourceSpecific = ()\r\n{\r\nProtectedContainerUnderResourceSpecific | distinct ProtectedContainerName, ProtectedContainerFriendlyName, ProtectedContainerUniqueId \r\n| join kind= rightouter (\r\n BackupItemAssociationUnderResourceSpecific \t\r\n\t| where startofday(TimeGenerated) == AsonDay\r\n\t| project ProtectedContainerUniqueId, BackupItemUniqueId, BackupManagementServerUniqueId, PolicyUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on ProtectedContainerUniqueId\r\n| join kind= leftouter (\r\n BackupItemFrontEndSizeUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project BackupItemFrontEndSize, BackupItemUniqueId, TimeGenerated, ResourceId, StorageReplicationType \r\n) on BackupItemUniqueId\r\n| join kind= leftouter (\r\n StorageAssociationUnderResourceSpecific | where startofday(TimeGenerated) == AsonDay | project StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemUniqueId, TimeGenerated, ResourceId, StorageReplicationType\r\n) on BackupItemUniqueId\r\n| project BackupItemUniqueId, TimeGenerated, ProtectedContainerUniqueId = ProtectedContainerUniqueId1, ProtectedContainerName, ProtectedContainerFriendlyName, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupManagementServerUniqueId, ResourceId, StorageReplicationType \r\n};\r\nlet LatestBackupItemAssociationAndStorageConsumptionTable = ()\r\n{\r\nLatestBackupItemDimensionTable | join \r\n(CombinedTable | union isfuzzy = true \r\n(BackupItemAssociationAndStorageConsumptionUnderAzureDiagnostics()\r\n),\r\n(BackupItemAssociationAndStorageConsumptionUnderResourceSpecific())\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId)\r\n on BackupItemUniqueId\r\n| project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupManagementServerUniqueId, \r\nBackupManagementType, BackupItemType, PolicyUniqueId, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState, TimeGenerated, ResourceId, StorageReplicationType\r\n};\r\nlet LatestBackupItemInfoTable = (){\r\n// projecting TimeRangeDay to distill the report for RangeEndDay\r\nLatestBackupItemAssociationAndStorageConsumptionTable | project BackupItemUniqueId, BackupItemName, BackupItemFriendlyName, BackupManagementType, BackupItemType, PolicyUniqueId, ProtectedContainerUniqueId, ProtectedContainerName, ProtectedContainerFriendlyName, BackupItemFrontEndSize, StorageConsumedInMBs, StorageAllocatedInMBs, BackupItemProtectionState, TimeRangeEndDay = startofday(TimeGenerated), CustomBackupManagementType = BackupManagementType, ResourceId, StorageReplicationType\r\n};\r\nlet LatestProtectedContainerInfoTableExcludingDPMVMs = (){\r\n// projecting TimeRangeDay to distill the report for RangeEndDay\r\nLatestBackupItemAssociationAndStorageConsumptionTable\r\n| where not((BackupManagementType has \"DPM\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"DPM\" and BackupItemType has \"HyperVVM\") \r\nor (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"HyperVVM\"))\r\n// CustomBackupManagementType needed to distinguish 'AzureWorkload' \r\n| summarize StorageConsumedInMBs = sum(StorageConsumedInMBs), StorageAllocatedInMBs= sum(StorageAllocatedInMBs), BackupItemFrontEndSize = sum(BackupItemFrontEndSize), ProtectedContainerName = any(ProtectedContainerName), ProtectedContainerFriendlyName= any(ProtectedContainerFriendlyName), TimeRangeEndDay = startofday(any(TimeGenerated)), \r\nBackupManagementType = any(BackupManagementType), CustomBackupManagementType = iff((any(BackupManagementType) has \"AzureWorkload\"), any(strcat(BackupManagementType, \"/\", BackupItemType)), any(BackupManagementType)), StorageReplicationType = any(StorageReplicationType), ResourceId = any(ResourceId) by ProtectedContainerUniqueId\r\n};\r\nlet LatestProtectedInstanceTable = (isProtectedContainerBillingType:bool) \r\n{CombinedTable | union isfuzzy = true \r\n(ProtectedInstanceUnderAzureDiagnostics(isProtectedContainerBillingType)),\r\n(ProtectedInstanceUnderResourceSpecific(isProtectedContainerBillingType))\r\n| where startofday(TimeGenerated) == AsonDay\r\n// ProtectedInstance is at BillingEntity level. CustomBackupManagementType can be the filter used.\r\n| where BackupManagementType in (BackupManagementTypeParam) or '*' in (BackupManagementTypeParam)\r\n| summarize arg_max(TimeGenerated, *) by BackupItemUniqueId, ProtectedContainerUniqueId\r\n| project BackupItemUniqueId, ProtectedContainerUniqueId, BackupManagementType, ResourceId, TimeGenerated, ProtectedInstanceCount, TimeRangeEndDay = startofday(TimeGenerated), StorageReplicationType\r\n};\r\nlet LatestProtectedInstanceTableFromProtectedContainerUniqueId = ()\r\n{ \r\nLatestProtectedInstanceTable(true)\r\n| join kind= rightouter (LatestProtectedContainerInfoTableExcludingDPMVMs ) on ProtectedContainerUniqueId\r\n| project TimeRangeEndDay = TimeRangeEndDay1, ProtectedInstanceCount, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, BackupManagementType = BackupManagementType1, CustomBackupManagementType, BillingEntityType = \"ProtectedContainer\", BillingEntityName = ProtectedContainerFriendlyName, \r\n BillingEntityUniqueId = ProtectedContainerUniqueId1, ResourceId = ResourceId1, StorageReplicationType = StorageReplicationType1, ProtectedContainerName\r\n};\r\nlet LatestProtectedInstanceTableFromBackupItemUniqueId = ()\r\n{ \r\n(LatestProtectedInstanceTable(false)\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\"))\r\n| join kind= rightouter \r\n// applicable only for DPM VM Scenarios\r\n(LatestBackupItemInfoTable | where ((BackupManagementType has \"DPM\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"DPM\" and BackupItemType has \"HyperVVM\") \r\nor (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"VMwareVM\") or (BackupManagementType has \"AzureBackupServer\" and BackupItemType has \"HyperVVM\")))\r\non BackupItemUniqueId\r\n| project TimeRangeEndDay = TimeRangeEndDay1, ProtectedInstanceCount, BackupItemFrontEndSize,\r\n StorageConsumedInMBs, BackupManagementType, CustomBackupManagementType, BillingEntityType = \"BackupItem\", BillingEntityName = BackupItemFriendlyName, \r\n BillingEntityUniqueId = BackupItemUniqueId1, ResourceId = ResourceId1, StorageReplicationType = StorageReplicationType1\r\n};\r\n// Special handling for DPM, AzureBackupServer Cluster scenario - Node PS has ProtectedInstance, whereas Cluster PS has storage Consumption\r\nlet LatestProtectedInstanceTableFromDPMNodeProtectedContainerUniqueId = ()\r\n{ \r\n(\r\n(LatestProtectedInstanceTable(true)\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\")\r\n| where ProtectedInstanceCount > 0)\r\n| join kind= leftanti (LatestProtectedContainerInfoTableExcludingDPMVMs ) on ProtectedContainerUniqueId\r\n| project ProtectedContainerUniqueId, BackupManagementType, ResourceId, TimeGenerated, ProtectedInstanceCount, TimeRangeEndDay, StorageReplicationType)\r\n| join (\r\nCombinedTable | union isfuzzy = true \r\n(ProtectedContainerUnderAzureDiagnostics()),\r\n(ProtectedContainerUnderResourceSpecific())\r\n| where BackupManagementType in (\"DPM\",\"AzureBackupServer\")\r\n| summarize arg_max(TimeGenerated, *) by ProtectedContainerUniqueId)\r\n on ProtectedContainerUniqueId\r\n // BackupItemFrontEndSize and StorageConsumed will be 0.0 as the same will be calculated at cluster level \r\n // As it is DPM or AzureBackupServer, no extra handling needed for AzureWorkload\r\n| project TimeRangeEndDay, ProtectedInstanceCount, BackupItemFrontEndSize = 0.0,\r\n StorageConsumedInMBs = 0.0, BackupManagementType, CustomBackupManagementType = BackupManagementType,\r\n BillingEntityType = \"ProtectedContainer\", BillingEntityName = ProtectedContainerFriendlyName, \r\n BillingEntityUniqueId = ProtectedContainerUniqueId, ResourceId, StorageReplicationType, ProtectedContainerName\r\n};\r\nlet ProtectedInstanceMetric = ( ) \r\n{ union \r\n(LatestProtectedInstanceTableFromBackupItemUniqueId() ),\r\n(LatestProtectedInstanceTableFromProtectedContainerUniqueId()),\r\n(LatestProtectedInstanceTableFromDPMNodeProtectedContainerUniqueId)\r\n| where BillingEntityName contains (BillingEntityNameParam) or '*' in (BillingEntityNameParam)\r\n| summarize arg_max(TimeRangeEndDay, *) by BillingEntityUniqueId \r\n};\r\n// Display Tweaks for AFS and null ProtectedInstanceCount\r\n// Billing Entity is at BackupManagementType level and not at DS level. \r\nlet OutputTable = () {ProtectedInstanceMetric\r\n| project CustomBackupManagementType, BackupItemFrontEndSize = todouble(BackupItemFrontEndSize / 1), StorageConsumedInMBs = todouble(StorageConsumedInMBs / 1), BillingEntityUniqueId, BillingEntityName, ProtectedInstanceCount = todouble(ProtectedInstanceCount)/10, ResourceId, BillingEntityType, StorageReplicationType, ProtectedContainerName\r\n| project BillingEntityUniqueId, BillingEntityType, BillingEntityName, CustomBackupManagementType, ProtectedInstanceCount = iff(isempty(ProtectedInstanceCount) or CustomBackupManagementType == \"AzureStorage\", 0.0 ,ProtectedInstanceCount), \r\n StorageConsumedInMBs = iff(isempty(StorageConsumedInMBs), todouble(0), StorageConsumedInMBs), BackupItemFrontEndSize = iff(isempty(BackupItemFrontEndSize), todouble(0), BackupItemFrontEndSize), ResourceId, StorageReplicationType, ProtectedContainerName\r\n| extend TempColumn = column_ifexists(tostring('{ProtectedInstanceMetricSortBy}'), \"sum_StorageConsumedInMBs\")\r\n| extend ColumnToBeSorted = iff(tostring('{ProtectedInstanceMetricOrder}') == \"Ascending\", todouble(TempColumn) - 90000000, 90000000 - todouble(TempColumn))\r\n| sort by ColumnToBeSorted asc nulls last, BillingEntityUniqueId asc\r\n| extend row_num = row_number()\r\n| extend page_num = tostring(((row_num-1)/{ProtectedInstanceMetricRowsPerGrid} + 1))\r\n| where page_num has ('{ProtectedInstanceMetricPageNumber}') or '*' in ('{ProtectedInstanceMetricPageNumber}')\r\n| extend container_array = split(ProtectedContainerName,\";\")\r\n| extend container_arraylen = array_length(container_array)\r\n| project ContainerFriendlyName = BillingEntityName, ContainerResourceGroup = iff(container_arraylen == 3, container_array[(container_arraylen-2)], \"(none)\"), BillingEntityType, CustomBackupManagementType, ProtectedInstanceCount, StorageConsumedInMBs, StorageReplicationType, BackupItemFrontEndSize, ResourceId, BillingEntityName \r\n| parse ResourceId with * \"/SUBSCRIPTIONS/\" SubscriptionId:string \"/RESOURCEGROUPS/\" VaultResourceGroup:string \"/PROVIDERS/\" *};\r\nlet CustomOutputTable = () {BMSTypeMappingTable\r\n| join kind= rightouter (OutputTable) \r\non CustomBackupManagementType\r\n| project BillingEntityName, ContainerFriendlyName, ContainerResourceGroup, BillingEntityType, CustomBackupManagementType = iff(CustomBMSType == \"\",CustomBackupManagementType1,CustomBMSType), ProtectedInstanceCount, StorageConsumedInGBs = StorageConsumedInMBs/1024, StorageReplicationType, BackupItemFrontEndSize, ResourceId, VaultResourceGroup, SubscriptionId};\r\nCustomOutputTable ", + "size": 3, + "noDataMessage": "No records found for the selected time range and scope", + "exportFieldName": "BillingEntityUniqueId", + "exportParameterName": "SelectedBillingEntityUniqueId", + "exportDefaultValue": "*", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "BillingEntityName", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Name of the Billed Entity" + } + }, + { + "columnMatch": "ContainerFriendlyName", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ContainerResourceGroup", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Resouce Group of the Billed Entity" + } + }, + { + "columnMatch": "BillingEntityType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Type of the Billed Entity, whether it is a Protected Container or Backup Item" + } + }, + { + "columnMatch": "CustomBackupManagementType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Backup Management Type" + } + }, + { + "columnMatch": "ProtectedInstanceCount", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + }, + "tooltipFormat": { + "tooltip": "Number of Protected Instances associated with the Billed Entity, as of the end of the selected time range. A Billed Entity with frontend size under 50GB is said to have 0.5 Protected Instances" + } + }, + { + "columnMatch": "StorageConsumedInGBs", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "minimumFractionDigits": 2, + "maximumFractionDigits": 2 + } + }, + "tooltipFormat": { + "tooltip": "Total Cloud Storage consumed by the Billed Entity, as of the end of the selected time range." + } + }, + { + "columnMatch": "StorageReplicationType", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Storage Replication Type associated with the Billed Entity" + } + }, + { + "columnMatch": "BackupItemFrontEndSize", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ResourceId", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Vault associated with the Backup Item" + } + }, + { + "columnMatch": "VaultResourceGroup", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Resource Group of the Vault" + } + }, + { + "columnMatch": "SubscriptionId", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Subscription in which the Vault exists" + } + } + ], + "labelSettings": [ + { + "columnId": "BillingEntityName", + "label": "Billed Entity" + }, + { + "columnId": "ContainerFriendlyName" + }, + { + "columnId": "ContainerResourceGroup", + "label": "Billed Entity Resource Group" + }, + { + "columnId": "BillingEntityType", + "label": "Billed Entity Type" + }, + { + "columnId": "CustomBackupManagementType", + "label": "Backup Management Type" + }, + { + "columnId": "ProtectedInstanceCount", + "label": "# Protected Instances" + }, + { + "columnId": "StorageConsumedInGBs", + "label": "Cloud Storage (GB)" + }, + { + "columnId": "StorageReplicationType", + "label": "Storage Replication Type" + }, + { + "columnId": "BackupItemFrontEndSize" + }, + { + "columnId": "ResourceId", + "label": "Vault" + }, + { + "columnId": "VaultResourceGroup", + "label": "Vault Resource Group" + }, + { + "columnId": "SubscriptionId", + "label": "Subscription" + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Key", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + } + }, + "conditionalVisibility": { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + "conditionalVisibilities": [ + { + "parameterName": "TabName", + "comparison": "isEqualTo", + "value": "Usage" + }, + { + "parameterName": "Workspaces", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ErrorHandle", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "CustomBackupManagementTypeParam", + "comparison": "isNotEqualTo" + } + ], + "showPin": true, + "name": "Usage-Grid1", + "styleSettings": { + "margin": "-30px 0% 0% 0%", + "padding": "0% 0% 0% 0%", + "showBorder": true + } + } + ] + }, + "name": "group - 0" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Blockchain/Alerts/README b/Azure Blockchain/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Azure Blockchain/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Azure Blockchain/Queries/README b/Azure Blockchain/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Azure Blockchain/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Azure Blockchain/Workbooks/Workbench Troubleshooting/WorkbenchTroubleshooting.workbook b/Azure Blockchain/Workbooks/Workbench Troubleshooting/WorkbenchTroubleshooting.workbook new file mode 100644 index 0000000..777d309 --- /dev/null +++ b/Azure Blockchain/Workbooks/Workbench Troubleshooting/WorkbenchTroubleshooting.workbook @@ -0,0 +1,200 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "## Azure Blockchain Workbench Logs & Troubleshooting Guide\n---\n\nThis workbook is designed to give you some ways to root cause your failures. \nPlug in the requestId to follow the request's flow and view its logs.
\nTo understand some of the common errors, please view the \"Common errors seen in logs\" section of our [Github troubleshooting guide](https://aka.ms/workbenchtroubleshooting)." + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Logs Table\n---" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "6e3a7661-a6f1-42a1-bbad-d5f1ab577030", + "version": "KqlParameterItem/1.0", + "name": "requestId", + "type": 1, + "isRequired": true, + "value": "", + "isHiddenWhenLocked": false, + "timeContextFromParameter": null + }, + { + "id": "c0b75247-9888-4698-8e97-a275ab3b8143", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "type": 4, + "isRequired": false, + "value": { + "durationMs": 604800000, + "createdTime": "2018-11-13T18:43:43.112Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "isHiddenWhenLocked": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 604800000, + "createdTime": "2018-11-13T18:43:43.112Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ] + }, + "timeContextFromParameter": null + }, + { + "id": "49ec9aaa-8b2a-45d7-8998-56e4360b5d6e", + "version": "KqlParameterItem/1.0", + "name": "isRequestNotSuccessful", + "type": 1, + "isRequired": false, + "query": "traces\r\n| union exceptions\r\n| where customDimensions.LogLevel == 'Error'\r\n| limit 1\r\n| project Result = tostring(1)\r\n", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-11-13T19:39:09.242Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let requestId = '{requestId}';\r\n// Get txHash if it exists\r\nlet txHash = toscalar(\r\ntraces\r\n| union exceptions\r\n| sort by timestamp asc\r\n| extend thisRequestId = tostring(customDimensions.RequestId)\r\n| where thisRequestId== requestId\r\nand message has (' is submitted to transaction pool successfully.')\r\n| summarize txHash=any(tostring(split(split(message, \"Transaction \")[1], \" is submitted to\")[0]))\r\n);\r\n// Display the logs\r\ntraces\r\n| union exceptions\r\n| sort by timestamp desc\r\n| extend thisRequestId = tostring(customDimensions.RequestId), thisTxHash = tostring(customDimensions.transactionHash)\r\n// If requestId is available and txHash is null, then never got to submit the transaction, so show events with requestId\r\n// If requestId AND txHash is available, then it at least got to submit the transaction, show events with requestId AND txHash\r\n| where (\r\n (requestId != '' and txHash == '' and thisRequestId == requestId) or\r\n (requestId != '' and txHash != '' and (thisRequestId == requestId or thisTxHash == txHash))\r\n ) and not(message has 'Microsoft.')\r\n| project LogLevel=customDimensions.LogLevel, created=format_datetime(timestamp, 'yyyy-MM-dd [hh:mm:ss tt]'), Message=iff(itemType=='exception', details[0].message, message), ServiceName=customDimensions.ServiceName, SourceContext=customDimensions.SourceContext, Method=iif(customDimensions.ServiceName == 'appbuilder.api', customDimensions.RequestPath, customDimensions.MessageName), Exception=type", + "showQuery": false, + "size": 2, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": true, + "title": "Workbench Logs", + "noDataMessage": "Please enter a valid requestId above.", + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-11-13T19:38:53.339Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "timeRange", + "resourceType": "microsoft.insights/components", + "gridSettings": { + "filter": true + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "##### How to export:\nClick on the icon to the top right of the Workbench logs table below and click on 'Export' on the top right panel." + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "
\n
\n
\n
\n\n## Potential Liveness Issues\n---\nIn the below tables you can see whether any of your requests from Workbench has gotten the system in a state with a liveness issue. This means that the requests are not being processed as expected and will continue to try submitting infinitely.\nNote that these issues are generally not caused by bugs in the Workbench codebase, but rather issues that arise from services being down.\n\n### TryCommitContractAction counter\nIf there has been over 10 tries to commit the contract/contract action to the blockchain and the transaction receipt had not arrived, then one of two things could be happening:\n1. The eth-watcher is down.\n2. The blockchain is unresponsive or taking a long time to process.\n\nThis table shows the requests that could have such issues, along with the number of times the system (eth-tx-submitter) has tried to commit the contract action to the blockchain. " + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "2f8ee2c0-5349-42c3-a8c4-799bc19c45b5", + "version": "KqlParameterItem/1.0", + "name": "hasLivenessBugInLast24hrs", + "type": 1, + "isRequired": false, + "query": "// Get txHashes if it exists\r\nlet txHashToRequestId = \r\ntraces\r\n| union exceptions\r\n| sort by timestamp asc\r\n| where message has (' is submitted to transaction pool successfully.')\r\n| project\r\n created=format_datetime(timestamp, 'yyyy-MM-dd [hh:mm:ss tt]'),\r\n RequestId = tostring(customDimensions.RequestId), txHash=tostring(split(split(message, \"Transaction \")[1], \" is submitted to\")[0]);\r\n// Request Id to App,Contract, and Method\r\nlet requestIdToAppAndContractAndMethod =\r\ntraces\r\n| union exceptions\r\n| sort by timestamp asc\r\n| where message has ('Get work item detail: ')\r\n| project \r\n RequestId = tostring(customDimensions.RequestId),\r\n ContractName=tostring(split(split(message, \"contractName: \")[1], ';')[0]),\r\n // If its empty \r\n MethodName=tostring(iif(array_length(split(message, \"methodName: \")) == 1, 'ContractCreation', split(message, \"methodName: \")[1]));\r\n// See if there are more than one estimate gas tries (b/c then that means that blockchain is alive)\r\nlet requestIdToEstimateGasTries =\r\ntraces\r\n| union exceptions\r\n| sort by timestamp asc\r\n| where message has ('Estimating gas for')\r\n| summarize EstimateGasCount = count() by RequestId = tostring(customDimensions.RequestId);\r\n// See if eth-watcher is alive\r\n//let requestIdToEthWatcher =\r\n//traces\r\n//| union exceptions\r\n//| project txHash = tostring(customDimensions.transactionHash)\r\n//| join (txHashToRequestId) on $left.txHash == $right.txHash\r\n//| project RequestId, IsEthWatcherAlive=isnotnull(txHash);\r\n// Get txHashes if it exists\r\nlet quotations = '\\\"';\r\nlet txHashToCount =\r\ntraces\r\n| union exceptions\r\n| sort by timestamp asc\r\n| where message has ('Execute [dbo].[TryCommitContractAction] ')\r\n| summarize count() by txHash=trim(quotations, tostring(split(message, \"transactionHash = \")[1]));\r\n// Join\r\nlet table =\r\ntxHashToRequestId\r\n| join (txHashToCount) on $left.txHash == $right.txHash\r\n| join (requestIdToAppAndContractAndMethod) on $left.RequestId == $right.RequestId\r\n| join (requestIdToEstimateGasTries) on $left.RequestId == $right.RequestId\r\n| project created, RequestId, ContractName, MethodName, Count=count_, EstimateGasCount;\r\n\r\n// Check if submitter successfully finished creating after the loop\r\nlet successfulSubmit =\r\ntraces\r\n| union exceptions\r\n| sort by timestamp asc\r\n| where message has ('Getting transaction receipt ')\r\n| project TxHash = tostring(customDimensions.transactionHash), placeholder='placeholder'\r\n| join kind=inner (txHashToRequestId) on $left.TxHash == $right.txHash\r\n| project RequestId, placeholder;\r\n\r\nlet liveness_bugs =\r\ntable\r\n| distinct *\r\n| join kind=leftouter (successfulSubmit) on $left.RequestId == $right.RequestId\r\n// If placeholder is not null then it means it has successfully completed\r\n| where Count >= 10 and placeholder == 'placeholder'\r\n| project created, RequestId, ContractName, MethodName, Count, IsBlockchainAlive=EstimateGasCount>1\r\n| sort by created desc;\r\n\r\nliveness_bugs\r\n| project Result = tostring(1)", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.insights/components" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "There are no liveness issues in the last 24 hours!" + }, + "conditionalVisibility": { + "parameterName": "hasLivenessBugInLast24hrs", + "comparison": "isNotEqualTo", + "value": "1" + } + }, + { + "type": 1, + "content": { + "json": "There are potential liveness issues :(" + }, + "conditionalVisibility": { + "parameterName": "hasLivenessBugInLast24hrs", + "comparison": "isEqualTo", + "value": "1" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// Get txHashes if it exists\r\nlet txHashToRequestId = \r\ntraces\r\n| union exceptions\r\n| sort by timestamp asc\r\n| where message has (' is submitted to transaction pool successfully.')\r\n| extend RequestId = tostring(customDimensions.RequestId)\r\n| project\r\n created=format_datetime(timestamp, 'yyyy-MM-dd [hh:mm:ss tt]'),\r\n RequestId, txHash=tostring(split(split(message, \"Transaction \")[1], \" is submitted to\")[0]);\r\n// Request Id to App,Contract, and Method\r\nlet requestIdToAppAndContractAndMethod =\r\ntraces\r\n| union exceptions\r\n| sort by timestamp asc\r\n| where message has ('Get work item detail: ')\r\n| extend RequestId = tostring(customDimensions.RequestId)\r\n| project \r\n RequestId,\r\n ContractName=tostring(split(split(message, \"contractName: \")[1], ';')[0]),\r\n // If its empty \r\n MethodName=tostring(iif(array_length(split(message, \"methodName: \")) == 1, 'ContractCreation', split(message, \"methodName: \")[1]));\r\n// See if there are more than one estimate gas tries (b/c then that means that blockchain is alive)\r\nlet requestIdToEstimateGasTries =\r\ntraces\r\n| union exceptions\r\n| sort by timestamp asc\r\n| where message has ('Estimating gas for')\r\n| extend thisRequestId = tostring(customDimensions.RequestId)\r\n| summarize EstimateGasCount = count() by RequestId = thisRequestId;\r\n// See if eth-watcher is alive\r\n//let requestIdToEthWatcher =\r\n//traces\r\n//| union exceptions\r\n//| project txHash = tostring(customDimensions.transactionHash)\r\n//| join (txHashToRequestId) on $left.txHash == $right.txHash\r\n//| project RequestId, IsEthWatcherAlive=isnotnull(txHash);\r\n// Get txHashes if it exists\r\nlet quotations = '\\\"';\r\nlet txHashToCount =\r\ntraces\r\n| union exceptions\r\n| sort by timestamp asc\r\n| where message has ('Execute [dbo].[TryCommitContractAction] ')\r\n| summarize count() by txHash=trim(quotations, tostring(split(message, \"transactionHash = \")[1]));\r\n// Join\r\nlet table =\r\ntxHashToRequestId\r\n| join (txHashToCount) on $left.txHash == $right.txHash\r\n| join (requestIdToAppAndContractAndMethod) on $left.RequestId == $right.RequestId\r\n| join (requestIdToEstimateGasTries) on $left.RequestId == $right.RequestId\r\n| project created, RequestId, ContractName, MethodName, Count=count_, EstimateGasCount;\r\n// Check if submitter successfully finished creating after the loop\r\nlet successfulSubmit =\r\ntraces\r\n| union exceptions\r\n| sort by timestamp asc\r\n| where message has ('Getting transaction receipt ')\r\n| project TxHash = tostring(customDimensions.transactionHash), placeholder='placeholder'\r\n| join kind=inner (txHashToRequestId) on $left.TxHash == $right.txHash\r\n| project RequestId, placeholder;\r\ntable\r\n| distinct *\r\n| join kind=leftouter (successfulSubmit) on $left.RequestId == $right.RequestId\r\n// If placeholder is not null then it means it has successfully completed\r\n| where Count >= 10 and placeholder != 'placeholder'\r\n| project created, RequestId, ContractName, MethodName, Count, IsBlockchainAlive=EstimateGasCount>1\r\n| sort by created desc;", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": true, + "title": "TryCommitContractAction Counter", + "noDataMessage": "No liveness issues detected!", + "timeContextFromParameter": null, + "resourceType": "microsoft.insights/components", + "gridSettings": { + "filter": true + } + }, + "conditionalVisibility": { + "parameterName": "hasLivenessBug", + "comparison": "isEqualTo", + "value": "1" + } + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Blockchain/Workbooks/Workbench Troubleshooting/settings.json b/Azure Blockchain/Workbooks/Workbench Troubleshooting/settings.json new file mode 100644 index 0000000..7e975f3 --- /dev/null +++ b/Azure Blockchain/Workbooks/Workbench Troubleshooting/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Workbench Troubleshooting", + "author": "Azure Blockchain", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.insights/components", "order": 100 }] +} \ No newline at end of file diff --git a/Azure Blockchain/Workbooks/categoryResources.json b/Azure Blockchain/Workbooks/categoryResources.json new file mode 100644 index 0000000..27a86d7 --- /dev/null +++ b/Azure Blockchain/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Azure Blockchain", "description": " ", "order": 700} +} \ No newline at end of file diff --git a/Azure Monitor - Applications/Alerts/README b/Azure Monitor - Applications/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Azure Monitor - Applications/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Azure Monitor - Applications/Queries/README b/Azure Monitor - Applications/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Azure Monitor - Applications/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Azure Monitor - Applications/Workbooks/Failure Analysis/Failure Analysis.workbook b/Azure Monitor - Applications/Workbooks/Failure Analysis/Failure Analysis.workbook new file mode 100644 index 0000000..03d04be --- /dev/null +++ b/Azure Monitor - Applications/Workbooks/Failure Analysis/Failure Analysis.workbook @@ -0,0 +1,448 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Application Failure Analysis" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "value::selected" + ], + "parameters": [ + { + "id": "ccd5adcd-8d59-4cfe-99ec-98075de2e253", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription_Internal", + "type": 1, + "isRequired": true, + "query": "where type =~ 'microsoft.insights/components'\r\n| take 1\r\n| project subscriptionId", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "1ca69445-60fc-4806-b43d-ac7e6aad630a", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "multiSelect": false, + "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.insights/components'\n| project id", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::3" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.insights/components": true + }, + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::3" + ] + }, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": false, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 3600000 + } + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "
" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let apps = range i from 1 to 1 step 1\r\n| extend x = '{Apps:name}'\r\n| extend x = split(x, ', ')\r\n| mvexpand x to typeof(string) limit 100\r\n| project appName = x;\r\nrequests\r\n| summarize FailedRequests = countif(success == false), Count = count() by appName\r\n| join kind = inner (\r\n requests\r\n | make-series Trend = countif(success == false) default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by appName\r\n) on appName\r\n| project-away appName1, timestamp\r\n| join kind = fullouter (apps) on appName\r\n| extend appName = appName1, FailedRequests = iff(appName == '', 0, FailedRequests), Count = iff(appName == '', 0, Count), Trend = iff(appName == '', repeat(0, toint(({TimeRange:end} - {TimeRange:start}) / {TimeRange:grain})), Trend)\r\n| extend MetricKind = 'Failures'\r\n| order by FailedRequests desc\r\n", + "showQuery": false, + "size": 3, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "appName", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "MetricKind", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "FailedRequests", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "palette": "red", + "showIcon": true + } + }, + "showBorder": false + } + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let appCount = 5;\r\nlet requestCount = 5;\r\nlet selectedApps = range i from 1 to 1 step 1\r\n| extend x = '{Apps:name}'\r\n| extend x = split(x, ', ')\r\n| mvexpand x to typeof(string) limit 100\r\n| project appName = x;\r\nlet topItems = requests\r\n| top-nested appCount of appName by AppMetric = countif(success == false) desc, top-nested requestCount of name by RequestMetric = countif(success == false) desc;\r\nlet topApps = topItems | summarize by appName;\r\nlet topRequests = topItems | summarize by strcat(appName, '::', name);\r\nlet rawData = requests\r\n| extend name = iff(strcat(appName, '::', name) in (topRequests), name, 'Other Requests'), appName = iff(appName in (topApps), appName, 'Other Apps');\r\nlet apps = rawData\r\n| summarize FailedRequests = countif(success == false), AllRequests = count(), Users = dcount(user_Id) by appName\r\n| project Id = appName, ParentId = '', Name = strcat('☁️ ', appName), Kind = 'Application', FailedRequests, AllRequests, Users\r\n| join kind = inner (\r\n rawData\r\n | make-series Trend = countif(success == false) default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Id = appName\r\n) on Id\r\n| project-away Id1, timestamp\r\n| join kind = fullouter (selectedApps) on $left.Id == $right.appName\r\n| extend Id = appName, Name = strcat('☁️ ', appName), Kind = 'Application', FailedRequests = iff(Id == '', 0, FailedRequests), AllRequests = iff(Id == '', 0, AllRequests), Users = iff(Id == '', 0, Users), Trend = iff(Id == '', repeat(0, toint(({TimeRange:end} - {TimeRange:start}) / {TimeRange:grain})), Trend);\r\nlet requests = rawData\r\n| summarize FailedRequests = countif(success == false), AllRequests = count(), Users = dcount(user_Id) by appName, name\r\n| project Id = strcat(appName, '::', name), ParentId = appName, Name = strcat('🌐 ', name), Kind = 'Request', FailedRequests, AllRequests, Users\r\n| join kind = inner (\r\n rawData\r\n | make-series Trend = countif(success == false) default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Id = strcat(appName, '::', name)\r\n) on Id\r\n| project-away Id1, timestamp;\r\nrequests\r\n| union (apps)\r\n| extend Rank = iff(Name contains 'Other Apps' or Name contains 'Other Requests', 2, 1)\r\n| order by Rank asc, FailedRequests desc\r\n| project Id, ParentId, Name, Kind, ['Failed Requests'] = FailedRequests, ['Failed Request Trend'] = Trend, ['All Requests'] = AllRequests, ['Success Rate'] = 1.0 * (AllRequests - FailedRequests) / AllRequests, Users", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "exportParameterName": "Row", + "exportDefaultValue": "{}", + "showAnalytics": false, + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ParentId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Failed Requests", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Failed Request Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "max": 1, + "palette": "greenRed", + "showIcon": true + } + }, + { + "columnMatch": "All Requests", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Success Rate", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 1, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "percent", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Users", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "filter": true, + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "ParentId", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": true + } + } + }, + "conditionalVisibility": null, + "alwaysShowPin": true + }, + { + "type": 1, + "content": { + "json": "💡 _Select a row in the table above to see more details_\r\n
\r\n
\r\n" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Failed Requests" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### All Requests" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Row});\r\nrequests\r\n| where '{Row}' == '{}' or (row.Kind == 'Application' and row.Id == appName) or (row.Kind == 'Request' and row.Id == strcat(appName, \"::\", name))\r\n| make-series Metric = countif(success == false) default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n| mvexpand timestamp to typeof(datetime), Metric to typeof(int) limit 1000\r\n| project timestamp, ['Failed Requests'] = Metric", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "color": "red", + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Row});\r\nrequests\r\n| where '{Row}' == '{}' or (row.Kind == 'Application' and row.Id == appName) or (row.Kind == 'Request' and row.Id == strcat(appName, \"::\", name))\r\n| make-series Metric = count() default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n| mvexpand timestamp to typeof(datetime), Metric to typeof(int) limit 1000\r\n| project timestamp, ['All Requests'] = Metric", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "color": "green", + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Monitor - Applications/Workbooks/Failure Analysis/settings.json b/Azure Monitor - Applications/Workbooks/Failure Analysis/settings.json new file mode 100644 index 0000000..3ca87c7 --- /dev/null +++ b/Azure Monitor - Applications/Workbooks/Failure Analysis/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Failure Analysis", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "order": 100 }] +} \ No newline at end of file diff --git a/Azure Monitor - Applications/Workbooks/Performance Analysis/Performance Analysis.workbook b/Azure Monitor - Applications/Workbooks/Performance Analysis/Performance Analysis.workbook new file mode 100644 index 0000000..04830df --- /dev/null +++ b/Azure Monitor - Applications/Workbooks/Performance Analysis/Performance Analysis.workbook @@ -0,0 +1,448 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Application Performance Analysis" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "value::selected" + ], + "parameters": [ + { + "id": "ccd5adcd-8d59-4cfe-99ec-98075de2e253", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription_Internal", + "type": 1, + "isRequired": true, + "query": "where type =~ 'microsoft.insights/components'\r\n| take 1\r\n| project subscriptionId", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "1ca69445-60fc-4806-b43d-ac7e6aad630a", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "multiSelect": false, + "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.insights/components'\n| project id", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::3" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.insights/components": true + }, + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::3" + ] + }, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": false, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 3600000 + } + }, + { + "id": "9fb8e529-2818-4000-bdf0-48808de48eb7", + "version": "KqlParameterItem/1.0", + "name": "Metric", + "type": 2, + "isRequired": true, + "multiSelect": false, + "value": "percentile(duration, 95)", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"avg(duration)\", \"label\":\"Mean\", \"selected\":true},\r\n { \"value\":\"percentile(duration, 50)\", \"label\":\"Median\", \"selected\":false},\r\n { \"value\":\"percentile(duration, 80)\", \"label\":\"p80\", \"selected\":false},\r\n { \"value\":\"percentile(duration, 95)\", \"label\":\"p95\", \"selected\":false},\r\n { \"value\":\"percentile(duration, 99)\", \"label\":\"p99\", \"selected\":false}\r\n]", + "timeContextFromParameter": null + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "
" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let apps = range i from 1 to 1 step 1\r\n| extend x = '{Apps:name}'\r\n| extend x = split(x, ', ')\r\n| mvexpand x to typeof(string) limit 100\r\n| project appName = x;\r\nrequests\r\n| summarize Metric = {Metric}, Count = count() by appName\r\n| join kind = inner (\r\n requests\r\n | make-series Trend = {Metric} default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by appName\r\n) on appName\r\n| project-away appName1, timestamp\r\n| join kind = fullouter (apps) on appName\r\n| extend appName = appName1, Metric = iff(appName == '', 0.0, Metric), Count = iff(appName == '', 0, Count), Trend = iff(appName == '', repeat(0, toint(({TimeRange:end} - {TimeRange:start}) / {TimeRange:grain})), Trend)\r\n| extend MetricKind = '{Metric:label}', Relevance = Metric * Count\r\n| order by Relevance desc\r\n", + "showQuery": false, + "size": 3, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "appName", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "MetricKind", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Metric", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let appCount = 5;\r\nlet requestCount = 5;\r\nlet selectedApps = range i from 1 to 1 step 1\r\n| extend x = '{Apps:name}'\r\n| extend x = split(x, ', ')\r\n| mvexpand x to typeof(string) limit 100\r\n| project appName = x;\r\nlet topItems = requests\r\n| top-nested appCount of appName by AppMetric = {Metric} * count() desc, top-nested requestCount of name by RequestMetric = {Metric} * count() desc;\r\nlet topApps = topItems | summarize by appName;\r\nlet topRequests = topItems | summarize by strcat(appName, '::', name);\r\nlet rawData = requests\r\n| extend name = iff(strcat(appName, '::', name) in (topRequests), name, 'Other Requests'), appName = iff(appName in (topApps), appName, 'Other Apps');\r\nlet apps = rawData\r\n| summarize Metric = {Metric}, Count = count(), Users = dcount(user_Id) by appName\r\n| project Id = appName, ParentId = '', Name = strcat('☁️ ', appName), Kind = 'Application', Metric, Count, Users\r\n| join kind = inner (\r\n rawData\r\n | make-series Trend = {Metric} default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Id = appName\r\n) on Id\r\n| project-away Id1, timestamp\r\n| join kind = fullouter (selectedApps) on $left.Id == $right.appName\r\n| extend Id = appName, Name = strcat('☁️ ', appName), Kind = 'Application', Metric = iff(Id == '', 0.0, Metric), Count = iff(Id == '', 0, Count), Users = iff(Id == '', 0, Users), Trend = iff(Id == '', repeat(0, toint(({TimeRange:end} - {TimeRange:start}) / {TimeRange:grain})), Trend);\r\nlet requests = rawData\r\n| summarize Metric = {Metric}, Count = count(), Users = dcount(user_Id) by appName, name\r\n| project Id = strcat(appName, '::', name), ParentId = appName, Name = strcat('🌐 ', name), Kind = 'Request', Metric, Count, Users\r\n| join kind = inner (\r\n rawData\r\n | make-series Trend = {Metric} default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Id = strcat(appName, '::', name)\r\n) on Id\r\n| project-away Id1, timestamp;\r\nrequests\r\n| union (apps)\r\n| extend Rank = iff(Name contains 'Other Apps' or Name contains 'Other Requests', 2, 1), \r\n Relevance = Metric * Count\r\n| order by Rank asc, Relevance desc\r\n| project Id, ParentId, Name, Kind, {Metric:label} = Metric, ['Trend'] = Trend, Count, Users", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "exportParameterName": "Row", + "exportDefaultValue": "{}", + "showAnalytics": false, + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ParentId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Mean|Median|p80|p95|p99", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Users", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "filter": true, + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "ParentId", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": true + } + } + }, + "conditionalVisibility": null, + "alwaysShowPin": true + }, + { + "type": 1, + "content": { + "json": "💡 _Select a row in the table above to see more details_\r\n
\r\n
\r\n" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Request Duration (milliseconds)" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Request Count" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Row});\r\nrequests\r\n| where '{Row}' == '{}' or (row.Kind == 'Application' and row.Id == appName) or (row.Kind == 'Request' and row.Id == strcat(appName, \"::\", name))\r\n| make-series Metric = {Metric} default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n| mvexpand timestamp to typeof(datetime), Metric to typeof(real) limit 1000\r\n| project timestamp, {Metric:label} = Metric", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Row});\r\nrequests\r\n| where '{Row}' == '{}' or (row.Kind == 'Application' and row.Id == appName) or (row.Kind == 'Request' and row.Id == strcat(appName, \"::\", name))\r\n| make-series Metric = count() default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n| mvexpand timestamp to typeof(datetime), Metric to typeof(real) limit 1000\r\n| project timestamp, ['Request Counts'] = Metric", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "color": "green", + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Monitor - Applications/Workbooks/Performance Analysis/settings.json b/Azure Monitor - Applications/Workbooks/Performance Analysis/settings.json new file mode 100644 index 0000000..903a196 --- /dev/null +++ b/Azure Monitor - Applications/Workbooks/Performance Analysis/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance Analysis", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "order": 200 }] +} \ No newline at end of file diff --git a/Azure Monitor - Applications/Workbooks/Usage Analysis/Usage Analysis.workbook b/Azure Monitor - Applications/Workbooks/Usage Analysis/Usage Analysis.workbook new file mode 100644 index 0000000..4d372e0 --- /dev/null +++ b/Azure Monitor - Applications/Workbooks/Usage Analysis/Usage Analysis.workbook @@ -0,0 +1,459 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Usage Analysis\r\nUse this report to understand usage of your applications.\r\n\r\nUse the `Subscription` and `Apps` parameters to pick the application you want to analyze. The `Sources` parameter will allow you to switch to analyzing page views, custom events or requests. `Count` allows you to switch between _anonymous_ and _authenticated_ users." + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "ccd5adcd-8d59-4cfe-99ec-98075de2e253", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription_Internal", + "type": 1, + "isRequired": true, + "query": "where type =~ 'microsoft.insights/components'\r\n| take 1\r\n| project subscriptionId", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "1ca69445-60fc-4806-b43d-ac7e6aad630a", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "multiSelect": false, + "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.insights/components'\n| project id", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::3" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.insights/components": true + }, + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::3" + ] + }, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": false, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 86400000 + } + }, + { + "id": "44e91e36-ec54-4d22-94ad-ecf72097556e", + "version": "KqlParameterItem/1.0", + "name": "Sources", + "type": 2, + "isRequired": true, + "multiSelect": false, + "isHiddenWhenLocked": false, + "typeSettings": { + "limitSelectTo": 0, + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\"value\": \"pageViews\", \"label\":\"Page Views\", \"selected\": true},\r\n {\"value\": \"customEvents\", \"label\":\"Custom Events\"},\r\n {\"value\": \"requests\", \"label\":\"Requests\"}\r\n]", + "timeContextFromParameter": null + }, + { + "id": "769c9e62-1829-4b7f-9be6-9bf69ed7ca12", + "version": "KqlParameterItem/1.0", + "name": "Count", + "type": 2, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "limitSelectTo": 0, + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\"value\":\"user_Id\", \"label\":\"Anonymous Users\", \"selected\":true },\r\n {\"value\":\"user_AuthenticatedId\", \"label\":\"Authenticated Users\" }\r\n]", + "timeContextFromParameter": null + } + ], + "style": "above", + "queryType": 0 + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let apps = range i from 1 to 1 step 1\r\n| extend x = '{Apps:name}'\r\n| extend x = split(x, ', ')\r\n| mvexpand x to typeof(string) limit 100\r\n| project appName = x;\r\n{Sources}\r\n| summarize Users = dcount({Count}) by appName\r\n| join kind = inner (\r\n requests\r\n | make-series Trend = dcount({Count}) default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by appName\r\n) on appName\r\n| project-away appName1, timestamp\r\n| join kind = fullouter (apps) on appName\r\n| extend appName = appName1, Users = iff(appName == '', 0, Users), Trend = iff(appName == '', repeat(0, toint(({TimeRange:end} - {TimeRange:start}) / {TimeRange:grain})), Trend)\r\n| extend MetricKind = 'Unique Users'\r\n| order by Users desc\r\n", + "showQuery": false, + "size": 3, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "appName", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "MetricKind", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Users", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let appCount = 5;\r\nlet requestCount = 5;\r\nlet selectedApps = range i from 1 to 1 step 1\r\n| extend x = '{Apps:name}'\r\n| extend x = split(x, ', ')\r\n| mvexpand x to typeof(string) limit 100\r\n| project appName = x;\r\nlet topItems = union {Sources}\r\n| top-nested appCount of appName by AppMetric = dcount({Count}) desc, top-nested requestCount of name by RequestMetric = dcount({Count}) desc;\r\nlet topApps = topItems | summarize by appName;\r\nlet topRequests = topItems | summarize by strcat(appName, '::', name);\r\nlet rawData = union {Sources}\r\n| extend name = iff(strcat(appName, '::', name) in (topRequests), name, 'Other {Sources}'), appName = iff(appName in (topApps), appName, 'Other Apps');\r\nlet apps = rawData\r\n| summarize Users = dcount({Count}), Sessions = dcount(session_Id), Views = count() by appName\r\n| project Id = appName, ParentId = '', Name = strcat('☁️ ', appName), Kind = 'Application', Users, Sessions, Views\r\n| join kind = inner (\r\n rawData\r\n | make-series Trend = dcount({Count}) default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Id = appName\r\n) on Id\r\n| project-away Id1, timestamp\r\n| join kind = fullouter (selectedApps) on $left.Id == $right.appName\r\n| extend Id = appName, Name = strcat('☁️ ', appName), Kind = 'Application', Users = iff(Id == '', 0, Users), Sessions = iff(Id == '', 0, Sessions), Views = iff(Id == '', 0, Views), Trend = iff(Id == '', repeat(0, toint(({TimeRange:end} - {TimeRange:start}) / {TimeRange:grain})), Trend);\r\nlet requests = rawData\r\n| summarize Users = dcount({Count}), Sessions = dcount(session_Id), Views = count() by appName, name, itemType\r\n| project Id = strcat(appName, '::', name), ParentId = appName, Name = strcat(case(itemType == \"customEvent\", \"⚡\", itemType == \"pageView\", \"📃\", \"🌐\"), ' ', name), Kind = case(itemType == \"customEvent\", \"Custom Event\", itemType == \"pageView\", \"Page View\", \"Request\"), Users, Sessions, Views\r\n| join kind = inner (\r\n rawData\r\n | make-series Trend = dcount({Count}) default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Id = strcat(appName, '::', name)\r\n) on Id\r\n| project-away Id1, timestamp;\r\nrequests\r\n| union (apps)\r\n| extend Rank = iff(Name contains 'Other Apps' or Name contains 'Other {Sources}', 2, 1)\r\n| order by Rank asc, Users desc, Sessions desc, Views desc\r\n| project Id, ParentId, Name, Kind, ['Unique Users'] = Users, ['Unique Users Trend'] = Trend, ['Unique Sessions'] = Sessions, Views", + "showQuery": false, + "size": 3, + "aggregation": 0, + "showAnnotations": false, + "exportParameterName": "Row", + "exportDefaultValue": "{}", + "showAnalytics": false, + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ParentId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Unique Users", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Unique Users Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Unique Sessions", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Views", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true + } + } + ], + "filter": true, + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "ParentId", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": true + } + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "💡 _Select a row in the table above to see more details_\r\n
\r\n
\r\n" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Row});\r\n{Sources}\r\n| where '{Row}' == '{}' or (row.Kind == 'Application' and row.Id == appName) or (row.Kind != 'Application' and row.Id == strcat(appName, \"::\", name))\r\n| make-series Metric = dcount({Count}) default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n| mvexpand timestamp to typeof(datetime), Metric to typeof(int) limit 1000\r\n| project timestamp, ['Unique Users'] = Metric", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "title": "Unique Users", + "color": "blue", + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Row});\r\n{Sources}\r\n| where '{Row}' == '{}' or (row.Kind == 'Application' and row.Id == appName) or (row.Kind != 'Application' and row.Id == strcat(appName, \"::\", name))\r\n| make-series Metric = dcount(session_Id) default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n| mvexpand timestamp to typeof(datetime), Metric to typeof(int) limit 1000\r\n| project timestamp, ['Unique Sessions'] = Metric", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "title": "Unique Sessions", + "color": "green", + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Row});\r\n{Sources}\r\n| where '{Row}' == '{}' or (row.Kind == 'Application' and row.Id == appName) or (row.Kind != 'Application' and row.Id == strcat(appName, \"::\", name))\r\n| make-series Metric = count() default = 0 on timestamp from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n| mvexpand timestamp to typeof(datetime), Metric to typeof(int) limit 1000\r\n| project timestamp, ['Views'] = Metric", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "title": "Views", + "color": "yellow", + "noDataMessage": "The Application Insights resource you selected has no data.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 1, + "content": { + "json": "⚠️ _Unique count aggregations across applications from different domains may not be accurate for anonymous users_" + }, + "conditionalVisibility": null + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Monitor - Applications/Workbooks/Usage Analysis/settings.json b/Azure Monitor - Applications/Workbooks/Usage Analysis/settings.json new file mode 100644 index 0000000..7603f2c --- /dev/null +++ b/Azure Monitor - Applications/Workbooks/Usage Analysis/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Usage Analysis", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "order": 300 }] +} \ No newline at end of file diff --git a/Azure Monitor - Applications/Workbooks/categoryResources.json b/Azure Monitor - Applications/Workbooks/categoryResources.json new file mode 100644 index 0000000..b818fb2 --- /dev/null +++ b/Azure Monitor - Applications/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Applications", "description": " ", "order": 200} +} \ No newline at end of file diff --git a/Azure Monitor - Getting Started/Alerts/README b/Azure Monitor - Getting Started/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Azure Monitor - Getting Started/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Azure Monitor - Getting Started/Queries/README b/Azure Monitor - Getting Started/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Azure Monitor - Getting Started/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Azure Monitor - Getting Started/Workbooks/Getting Started Resources/Helpful Links.workbook b/Azure Monitor - Getting Started/Workbooks/Getting Started Resources/Helpful Links.workbook new file mode 100644 index 0000000..f869ec2 --- /dev/null +++ b/Azure Monitor - Getting Started/Workbooks/Getting Started Resources/Helpful Links.workbook @@ -0,0 +1,13 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Getting started resources\r\n\r\n## Azure Monitor Workbooks Overview\r\nYou can find our official documentation [here](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/workbooks-overview).\r\n\r\n## Additional Documentation\r\nHere are some more helpful links to find out more about certain features of Workbooks.\r\n- [Parameters](https://github.com/microsoft/Application-Insights-Workbooks/blob/master/Documentation/Parameters/Parameters.md)\r\n- [Data Sources](https://github.com/microsoft/Application-Insights-Workbooks/blob/master/Documentation/DataSources/DataSources.md)\r\n- [Resource Centric Logs](https://github.com/microsoft/Application-Insights-Workbooks/blob/master/Documentation/DataSources/ResourceCentricLogs.md)\r\n- [Visualizations](https://github.com/microsoft/Application-Insights-Workbooks/blob/master/Documentation/Visualizations/Visualizations.md)\r\n- [JSONPath](https://github.com/microsoft/Application-Insights-Workbooks/blob/master/Documentation/Transformations/JSONPath.md)\r\n- [Links](https://github.com/microsoft/Application-Insights-Workbooks/blob/master/Documentation/Links/Links.md)\r\n- [Interactive Workbooks](https://github.com/microsoft/Application-Insights-Workbooks/blob/master/Documentation/Interactivity.md)\r\n- [Programatically manage Workbooks](https://github.com/microsoft/Application-Insights-Workbooks/blob/master/Documentation/Programmatically.md)\r\n\r\n## Samples\r\nBrowse some of our samples [here](https://github.com/microsoft/Application-Insights-Workbooks/tree/master/Documentation/Samples).\r\n\r\n## Are you coming from View Designer?\r\nHere's how you can make the shift to Workbooks.\r\n- [View Designer to Workbooks Transition Guide](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-overview)\r\n- [Accessing Workbooks & Viewing Permissions](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-access)\r\n- [Common Steps](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-tasks)\r\n- [Conversion Options](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-options)\r\n- [Tile Conversions](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-tiles)\r\n\r\n---\r\n\r\nFind out more about [contributing](https://github.com/microsoft/Application-Insights-Workbooks/blob/master/Documentation/Contributing.md) to Workbooks.\r\n" + }, + "name": "text - 0" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Azure Monitor - Getting Started/Workbooks/Getting Started Resources/settings.json b/Azure Monitor - Getting Started/Workbooks/Getting Started Resources/settings.json new file mode 100644 index 0000000..cac48f5 --- /dev/null +++ b/Azure Monitor - Getting Started/Workbooks/Getting Started Resources/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Documentation", + "description":"Links to official Workbooks documentation", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "order": 100 }] +} \ No newline at end of file diff --git a/Azure Monitor - Getting Started/Workbooks/Resource Picker/Full.png b/Azure Monitor - Getting Started/Workbooks/Resource Picker/Full.png new file mode 100644 index 0000000..ecb725f Binary files /dev/null and b/Azure Monitor - Getting Started/Workbooks/Resource Picker/Full.png differ diff --git a/Azure Monitor - Getting Started/Workbooks/Resource Picker/Parameter.png b/Azure Monitor - Getting Started/Workbooks/Resource Picker/Parameter.png new file mode 100644 index 0000000..54e6382 Binary files /dev/null and b/Azure Monitor - Getting Started/Workbooks/Resource Picker/Parameter.png differ diff --git a/Azure Monitor - Getting Started/Workbooks/Resource Picker/Readme.md b/Azure Monitor - Getting Started/Workbooks/Resource Picker/Readme.md new file mode 100644 index 0000000..fb0836a --- /dev/null +++ b/Azure Monitor - Getting Started/Workbooks/Resource Picker/Readme.md @@ -0,0 +1,36 @@ +# Picking a set of resources to analyze in workbooks + +The `Resource Picker` template gets you started with subscription, resource group and resource parameters to set up the input context of your workbook. The default parameters are set to pick virtual machines, but you can configure it to pick any type of resource. The template also has a ARG query control that shows you how to use the parameters in your analyses. + +![Image](Full.png) + +## Setting up the resource type to pick + +1. Use `Edit` on the workbook toolbar. +2. You will now be able to see a drop down `Resource type` before `Subscriptions`: + + ![Image](Parameter.png) +3. Expand the drop down and select the resource types you want picked. This will update the subscription, resource group and resources drop down to match your selection. +4. Click the `Edit` button at the bottom right of the parameter control. +5. In the parameters grid, for the row `Resources`, change the `Display name` column from _Virtual machines_ to friendly name of your selected resource type (e.g. _Storage Accounts_) +6. Click `Done Editing` in the workbooks toolbar. + +## Selecting more or less than 10 resources by default + +1. Use `Edit` on the workbook toolbar. +2. Click the `Edit` button at the bottom right of the parameter control. +3. In the parameters grid, select the row for `Resources` +4. Click on the `Edit` (or pencil) icon control toolbar. +5. In the `Edit Parameter` pane that pops up, scroll down to the `Azure Resource Graph Query` editor. It should have a query that looks like this: + ```sql + Resources + | where type in~({ResourceTypes}) + | extend resourceGroupId = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup) + | where resourceGroupId in~({ResourceGroups}) or '*' in~({ResourceGroups}) + | order by name asc + | extend Rank = row_number() + | project value = id, label = name, selected = Rank <= 10, group = resourceGroup + ``` + The code for resource selection is in the last line of the query: `selected = Rank <= 10`. + +6. Change the value from 10 to a different one to change the default selection \ No newline at end of file diff --git a/Azure Monitor - Getting Started/Workbooks/Resource Picker/Resource Picker.workbook b/Azure Monitor - Getting Started/Workbooks/Resource Picker/Resource Picker.workbook new file mode 100644 index 0000000..e3c0ac5 --- /dev/null +++ b/Azure Monitor - Getting Started/Workbooks/Resource Picker/Resource Picker.workbook @@ -0,0 +1,174 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "0e85e0e4-a7e8-4ea8-b291-e444c317843a", + "version": "KqlParameterItem/1.0", + "name": "ResourceTypes", + "label": "Resource types", + "type": 7, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + "microsoft.compute/virtualmachines" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [], + "includeAll": true + } + }, + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All subscriptions with Storage accounts", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type in~ ({ResourceTypes})\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "b616a3a3-4271-4208-b1a9-a92a78efed08", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroups", + "label": "Resource groups", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type in~ ({ResourceTypes})\r\n| summarize Count = count() by subscriptionId, resourceGroup\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), label = resourceGroup, selected = false", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "f60ea0a0-3703-44ca-a59b-df0246423f41", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "Virtual machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type in~({ResourceTypes})\r\n| extend resourceGroupId = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)\r\n| where resourceGroupId in~({ResourceGroups}) or '*' in~({ResourceGroups})\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = name, selected = Rank <= 10, group = resourceGroup", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Resources\r\n| where id in~ ({Resources})\r\n| project Resource = id, Subscription = subscriptionId, ['Resource group'] = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), Location = location", + "size": 1, + "title": "Resource information", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Resource", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 15, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Resource group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Location", + "formatter": 17, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 1000, + "filter": true + } + }, + "showPin": true, + "name": "Resource information" + }, + { + "type": 1, + "content": { + "json": "💡 [Learn how to use this template](https://github.com/microsoft/Application-Insights-Workbooks/tree/master/Workbooks/Azure%20Monitor%20-%20Getting%20Started/Resource%20Picker)" + }, + "name": "Help message", + "styleSettings": { + "margin": "20px 0 0 0" + } + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Monitor - Getting Started/Workbooks/Resource Picker/settings.json b/Azure Monitor - Getting Started/Workbooks/Resource Picker/settings.json new file mode 100644 index 0000000..4a9fd3c --- /dev/null +++ b/Azure Monitor - Getting Started/Workbooks/Resource Picker/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Resource Picker", + "description":"Allows selection of resources to analyze", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "order": 200 }] +} \ No newline at end of file diff --git a/Azure Monitor - Getting Started/Workbooks/categoryResources.json b/Azure Monitor - Getting Started/Workbooks/categoryResources.json new file mode 100644 index 0000000..82259db --- /dev/null +++ b/Azure Monitor - Getting Started/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Getting started with workbooks", "description": " ", "order": 2000} +} \ No newline at end of file diff --git a/Azure Monitor - Workspaces/Alerts/README b/Azure Monitor - Workspaces/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Azure Monitor - Workspaces/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Azure Monitor - Workspaces/Queries/README b/Azure Monitor - Workspaces/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Azure Monitor - Workspaces/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Azure Monitor - Workspaces/Workbooks/Agent Health/Agent Health.workbook b/Azure Monitor - Workspaces/Workbooks/Agent Health/Agent Health.workbook new file mode 100644 index 0000000..59604fb --- /dev/null +++ b/Azure Monitor - Workspaces/Workbooks/Agent Health/Agent Health.workbook @@ -0,0 +1,618 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Agent health\r\nUse this report to learn about the health of the agents in your workspace. \r\n
\r\n
" + }, + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspace}" + ], + "parameters": [ + { + "id": "cb5e40b4-020b-4f01-88a6-50e6225e2fb9", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription_Internal", + "type": 1, + "isRequired": true, + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "20fb47ba-f521-47ea-9fb7-66339ad9c56a", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "50ed33e8-3c82-4f2d-8599-517bde7c3a18", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id", + "crossComponentResources": [ + "{Subscription}" + ], + "value": "value::1", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 1209600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ], + "allowCustom": null + } + }, + { + "id": "c4d8d055-6dbe-451b-bf64-2be8d9e21fd8", + "version": "KqlParameterItem/1.0", + "name": "UnhealthyCriteria", + "label": "Unhealthy Criteria", + "type": 2, + "isRequired": true, + "value": "1h", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"1m\", \"label\":\"1 minute without heartbeat\", \"selected\":false },\r\n { \"value\":\"5m\", \"label\":\"5 minutes without heartbeat\", \"selected\":false },\r\n { \"value\":\"30m\", \"label\":\"30 minutes without heartbeat\", \"selected\":false },\r\n { \"value\":\"1h\", \"label\":\"1 hour without heartbeat\", \"selected\":true },\r\n { \"value\":\"2h\", \"label\":\"2 hours without heartbeat\", \"selected\":false },\r\n { \"value\":\"8h\", \"label\":\"8 hours without heartbeat\", \"selected\":false },\r\n { \"value\":\"1d\", \"label\":\"1 day without heartbeat\", \"selected\":false },\r\n { \"value\":\"2d\", \"label\":\"2 days without heartbeat\", \"selected\":false },\r\n { \"value\":\"7d\", \"label\":\"7 days without heartbeat\", \"selected\":false }\r\n]" + }, + { + "id": "ee9b95be-40b2-48f9-856a-36d747adbcc2", + "version": "KqlParameterItem/1.0", + "name": "HasHearbeat", + "type": 2, + "isRequired": true, + "query": "Heartbeat\r\n| take 1\r\n| summarize count() ", + "crossComponentResources": [ + "{Workspace}" + ], + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "
\r\n### ⚠️ No agent health data found\r\n---\r\n\r\nLooks like no Log Analytics agent is sending health data to this workspace.\r\n\r\nPlease select another workspace or check out the detailed documentation on how to enable Log Analytics agent for your environment [here](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent)." + }, + "conditionalVisibility": { + "parameterName": "HasHearbeat", + "comparison": "isEqualTo", + "value": "0" + }, + "name": "text - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "datatable(State:string, Rank:int)[\"Unhealthy\", 0, \"Healthy\", 1]\r\n| join kind = leftouter (Heartbeat\r\n| where TimeGenerated {TimeRange:query}\r\n| summarize LastHeartbeat = max(TimeGenerated) by Computer\r\n| extend State = iff(LastHeartbeat < ago({UnhealthyCriteria}), 'Unhealthy', 'Healthy')\r\n| summarize Count = dcount(Computer) by State) on State\r\n| extend Count = iff(isempty(State1), 0, Count)\r\n| project-away State1\r\n| extend Rank = iff(State == 'Unhealthy' and Count == 0, 2, Rank)\r\n| order by Rank asc", + "size": 3, + "exportDefaultValue": "All Tables", + "showAnalytics": true, + "exportToExcelOptions": "visible", + "noDataMessage": "Looks like you have no agents sending heartbeat information in this time range. Pick a larger time range or a different workspace.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "tiles", + "gridSettings": { + "formatters": [ + { + "columnMatch": "ComputerEnvironment", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Computer", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "OSType", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Category", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "LastHeartbeat", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "HasHeartbeat", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ] + }, + "tileSettings": { + "titleContent": { + "columnMatch": "State", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "rightContent": { + "columnMatch": "State", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Unhealthy", + "representation": "4", + "text": "" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "" + } + ] + } + }, + "secondaryContent": { + "columnMatch": "AgentText", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": false + } + }, + "conditionalVisibility": { + "parameterName": "HasHearbeat", + "comparison": "isNotEqualTo", + "value": "0" + }, + "showPin": true, + "name": "query - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Heartbeat\r\n| where TimeGenerated {TimeRange:query}\r\n| summarize LastHeartbeat = max(TimeGenerated) by Computer\r\n| extend State = iff(LastHeartbeat < ago({UnhealthyCriteria}), 'Unhealthy', 'Healthy')\r\n| extend TimeFromNow = now() - LastHeartbeat\r\n| extend [\"TimeAgo\"] = strcat(case(TimeFromNow < 2m, strcat(toint(TimeFromNow / 1m), ' seconds'), TimeFromNow < 2h, strcat(toint(TimeFromNow / 1m), ' minutes'), TimeFromNow < 2d, strcat(toint(TimeFromNow / 1h), ' hours'), strcat(toint(TimeFromNow / 1d), ' days')), ' ago')\r\n| join (\r\nHeartbeat\r\n| where TimeGenerated {TimeRange:query}\r\n| extend Packed = pack_all()\r\n) on Computer\r\n| where TimeGenerated == LastHeartbeat\r\n| join (\r\nHeartbeat\r\n| where TimeGenerated {TimeRange:query}\r\n| make-series InternalTrend=iff(count() > 0, 1, 0) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {UnhealthyCriteria} by Computer\r\n| extend Trend=array_slice(InternalTrend, array_length(InternalTrend) - 30, array_length(InternalTrend)-1)\r\n| extend (s_min, s_minId, s_max, s_maxId, s_avg, s_var, s_stdev) = series_stats(Trend)\r\n| project Computer, Trend, s_avg\r\n) on Computer\r\n| order by State, s_avg asc, TimeAgo\r\n| project [\"_ComputerName_\"] = Computer, [\"Computer\"]=strcat('🖥️ ', Computer), State, [\"Environment\"] = iff(ComputerEnvironment == \"Azure\", ComputerEnvironment, Category), [\"OS\"]=iff(isempty(OSName), OSType, OSName), [\"Azure Resource\"]=ResourceId, [\"Time\"]=strcat('🕒 ', TimeAgo), [\"Heartbeat Trend\"]=Trend, [\"Details\"]=Packed", + "size": 2, + "exportFieldName": "_ComputerName_", + "exportParameterName": "ComputerName", + "exportDefaultValue": "\"\"", + "showAnalytics": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "title": "Agent details", + "noDataMessage": "Looks like you have no agents sending heartbeat information to this workspace. Pick a different workspace.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "_ComputerName_", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Computer", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "State", + "formatter": 18, + "formatOptions": { + "linkColumn": "Details", + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Unhealthy", + "representation": "4", + "text": "{0}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}" + } + ] + }, + "tooltipFormat": { + "tooltip": "Click to see details of the last event sent by this computer." + } + }, + { + "columnMatch": "Environment", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "OS", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Azure Resource", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Time", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Heartbeat Trend", + "formatter": 10, + "formatOptions": { + "palette": "redGreen", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Each bar represents the bucket of time based on the Unhealthy Criteria. Showing last 30 buckets max." + } + }, + { + "columnMatch": "Details", + "formatter": 5, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "🔍 View Details", + "linkIsContextBlade": true, + "showIcon": true + } + }, + { + "columnMatch": "ResourceId", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Category", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "OS Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Time Ago", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "OSType", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ComputerEnvironment", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "LastHeartbeat", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true, + "labelSettings": [ + { + "columnId": "_ComputerName_", + "label": "_ComputerName_" + }, + { + "columnId": "Computer", + "label": "Computer" + }, + { + "columnId": "State", + "label": "State" + }, + { + "columnId": "Environment", + "label": "Environment" + }, + { + "columnId": "OS", + "label": "OS" + }, + { + "columnId": "Azure Resource", + "label": "Azure Resource" + }, + { + "columnId": "Time", + "label": "Last Heartbeat" + }, + { + "columnId": "Heartbeat Trend", + "label": "Heartbeat Trend" + }, + { + "columnId": "Details", + "label": "Details" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "HasHearbeat", + "comparison": "isNotEqualTo", + "value": "0" + }, + "showPin": true, + "name": "query - 2 - Copy", + "styleSettings": { + "progressStyle": "spinner" + } + }, + { + "type": 1, + "content": { + "json": "💡 _Click on a row to see more details about the machine._" + }, + "conditionalVisibility": { + "parameterName": "HasHearbeat", + "comparison": "isNotEqualTo", + "value": "0" + }, + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "
\r\n### Details about {ComputerName}" + }, + "conditionalVisibility": { + "parameterName": "ComputerName", + "comparison": "isNotEqualTo", + "value": "\"\"" + }, + "name": "text - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Heartbeat\r\n| where Computer == \"{ComputerName}\"\r\n| make-series Trend=count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {UnhealthyCriteria} by Computer", + "size": 0, + "showAnalytics": true, + "exportToExcelOptions": "visible", + "title": "Heartbeat volume trend", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "areachart", + "chartSettings": {} + }, + "conditionalVisibility": { + "parameterName": "ComputerName", + "comparison": "isNotEqualTo", + "value": "\"\"" + }, + "showPin": true, + "name": "query - 6", + "styleSettings": { + "progressStyle": "spinner" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Heartbeat\r\n| where Computer == \"{ComputerName}\"", + "size": 0, + "showAnalytics": true, + "exportToExcelOptions": "visible", + "title": "Heartbeat events", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ] + }, + "conditionalVisibility": { + "parameterName": "ComputerName", + "comparison": "isNotEqualTo", + "value": "\"\"" + }, + "name": "query - 4", + "styleSettings": { + "progressStyle": "spinner" + } + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Monitor - Workspaces/Workbooks/Agent Health/settings.json b/Azure Monitor - Workspaces/Workbooks/Agent Health/settings.json new file mode 100644 index 0000000..aa62f91 --- /dev/null +++ b/Azure Monitor - Workspaces/Workbooks/Agent Health/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Agent Health", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "order": 200 }] +} \ No newline at end of file diff --git a/Azure Monitor - Workspaces/Workbooks/Workspace Usage/Workspace Usage.workbook b/Azure Monitor - Workspaces/Workbooks/Workspace Usage/Workspace Usage.workbook new file mode 100644 index 0000000..bec78a9 --- /dev/null +++ b/Azure Monitor - Workspaces/Workbooks/Workspace Usage/Workspace Usage.workbook @@ -0,0 +1,419 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Workspace Usage\r\nUse this report to analyze the the sizes of the different tables in your workspace. \r\n
\r\n
" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "value::selected" + ], + "parameters": [ + { + "id": "ccd5adcd-8d59-4cfe-99ec-98075de2e253", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription_Internal", + "type": 1, + "isRequired": true, + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "1ca69445-60fc-4806-b43d-ac7e6aad630a", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "multiSelect": false, + "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\n| project id", + "crossComponentResources": [ + "{Subscription}" + ], + "value": "value::1", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": false, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 3600000 + } + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union withsource=TableName *\r\n| summarize Entries = count(), Size = sum(estimate_data_size(*)) by TableName\r\n| order by Size desc\r\n| project ['Table Name'] = TableName, ['Table Entries'] = Entries, ['Table Size'] = Size, ['Size per Entry'] = 1.0 * Size / Entries\r\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "exportFieldName": "Table Name", + "exportParameterName": "Table", + "exportDefaultValue": "All Tables", + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Table Entries", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Table Size", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Size per Entry", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "alwaysShowPin": true + }, + { + "type": 1, + "content": { + "json": "💡_Click on a row in the table above to see more details_\n
\n
" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Table Entries" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Table Size" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union withsource=TableName *\r\n| where '{Table}' == 'All Tables' or TableName == '{Table}'\r\n| make-series TableSize = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n| mvexpand TableSize to typeof(real), TimeGenerated to typeof(datetime) limit 1000\r\n| project TimeGenerated, ['{Table}'] = TableSize", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "exportFieldName": "Namespace", + "exportParameterName": "Namespace", + "exportDefaultValue": "All", + "showAnalytics": true, + "color": "green", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "areachart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Table Entries", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Table Size", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Table Size Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "customWidth": "50", + "alwaysShowPin": true + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union withsource=TableName *\r\n| where '{Table}' == 'All Tables' or TableName == '{Table}'\r\n| make-series TableSize = sum(estimate_data_size(*)) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} \r\n| mvexpand TableSize to typeof(real), TimeGenerated to typeof(datetime) limit 1000\r\n| project TimeGenerated, ['{Table}'] = TableSize", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "exportFieldName": "Namespace", + "exportParameterName": "Namespace", + "exportDefaultValue": "All", + "showAnalytics": true, + "color": "blue", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "areachart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Table Entries", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Table Size", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Table Size Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "customWidth": "50", + "alwaysShowPin": true + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Monitor - Workspaces/Workbooks/Workspace Usage/settings.json b/Azure Monitor - Workspaces/Workbooks/Workspace Usage/settings.json new file mode 100644 index 0000000..1fb3498 --- /dev/null +++ b/Azure Monitor - Workspaces/Workbooks/Workspace Usage/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Workspace Usage", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "order": 200 }] +} \ No newline at end of file diff --git a/Azure Monitor - Workspaces/Workbooks/categoryResources.json b/Azure Monitor - Workspaces/Workbooks/categoryResources.json new file mode 100644 index 0000000..488f6e9 --- /dev/null +++ b/Azure Monitor - Workspaces/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Log Analytics workspaces", "description": " ", "order": 1000} +} \ No newline at end of file diff --git a/Azure Resources/Alerts/README b/Azure Resources/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Azure Resources/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Azure Resources/Queries/README b/Azure Resources/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Azure Resources/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Azure Resources/Workbooks/Alerts/Alerts.workbook b/Azure Resources/Workbooks/Alerts/Alerts.workbook new file mode 100644 index 0000000..ba02e9f --- /dev/null +++ b/Azure Resources/Workbooks/Alerts/Alerts.workbook @@ -0,0 +1,615 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "includeAll": false, + "showDefault": false + } + }, + { + "id": "b616a3a3-4271-4208-b1a9-a92a78efed08", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroups", + "label": "Resource groups", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| summarize by resourceGroup\r\n| order by resourceGroup asc\r\n| project id=resourceGroup, resourceGroup", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "0e85e0e4-a7e8-4ea8-b291-e444c317843a", + "version": "KqlParameterItem/1.0", + "name": "ResourceTypes", + "label": "Resource types", + "type": 7, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where \"*\" in ({ResourceGroups}) or resourceGroup in ({ResourceGroups})\r\n| summarize by type\r\n| project type, label=type\r\n", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "f60ea0a0-3703-44ca-a59b-df0246423f41", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where \"*\" in ({ResourceTypes}) or type in~({ResourceTypes})\r\n| where '*' in~({ResourceGroups}) or resourceGroup in~({ResourceGroups}) \r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = name, selected = Rank <= 10, group = resourceGroup", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*", + "defaultItemsText": "First 10" + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "015d1a5e-357f-4e01-ac77-598e7b493db0", + "version": "KqlParameterItem/1.0", + "name": "timeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + } + ], + "allowCustom": true + } + }, + { + "id": "bd6d6075-dc8f-43d3-829f-7e2245a3eb21", + "version": "KqlParameterItem/1.0", + "name": "State", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "{\"version\":\"1.0.0\",\"content\":\"[ \\r\\n {\\\"id\\\":\\\"New\\\", \\\"label\\\": \\\"New\\\"},\\r\\n {\\\"id\\\":\\\"Acknowledged\\\", \\\"label\\\": \\\"Acknowledged\\\"},\\r\\n {\\\"id\\\":\\\"Closed\\\", \\\"label\\\": \\\"Closed\\\"}\\r\\n]\",\"transformers\":null}", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*", + "showDefault": false + }, + "queryType": 8 + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Common/noSubscriptions", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isEqualTo" + }, + "name": "no subscriptions" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AlertsManagementResources | where type =~ 'microsoft.alertsmanagement/alerts'\r\n| where properties.essentials.startDateTime {timeRange} \r\n| where \"*\" in ({ResourceGroups}) or properties.essentials.targetResourceGroup in~ ({ResourceGroups})\r\n| where \"*\" in ({ResourceTypes}) or properties.essentials.targetResourceType in~ ({ResourceTypes})\r\n| where \"*\" in ({Resources}) or properties.essentials.targetResource in~ ({Resources})\r\n| extend State=tostring(properties.essentials.alertState)\r\n| where \"*\" in ({State}) or State in ({State})\r\n| summarize Count=count(), New=countif(State==\"New\"), \r\nAcknowledged=countif(State==\"Acknowledged\"), \r\nClosed=countif(State==\"Closed\") \r\nby Severity=tostring(properties.essentials.severity)\r\n| order by Severity asc", + "size": 3, + "title": "Alert Summary", + "noDataMessage": "No alerts found", + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "Severity", + "parameterName": "Severity", + "parameterType": 1 + } + ], + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Severity", + "formatter": 11 + }, + { + "columnMatch": "Count", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "State", + "formatter": 1 + } + ] + } + }, + "showPin": true, + "name": "Alert Summary" + }, + { + "type": 1, + "content": { + "json": "💡 Select one or more severities to see more information." + }, + "conditionalVisibility": { + "parameterName": "Severity", + "comparison": "isEqualTo" + }, + "name": "click to select info" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Alert Details", + "subTarget": "details", + "style": "link" + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Alerts by Region", + "subTarget": "location", + "style": "link" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Severity", + "comparison": "isNotEqualTo" + }, + "name": "tabs" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AlertsManagementResources | where type =~ 'microsoft.alertsmanagement/alerts'\r\n| where properties.essentials.startDateTime {timeRange} \r\n| extend Severity=tostring(properties.essentials.severity)\r\n| where Severity in ({Severity})\r\n| extend State=tostring(properties.essentials.alertState)\r\n| where \"*\" in ({State}) or State in ({State})\r\n| where \"*\" in ({ResourceTypes}) or properties.essentials.targetResourceType in~ ({ResourceTypes})\r\n| where \"*\" in ({ResourceGroups}) or properties.essentials.targetResourceGroup in~ ({ResourceGroups})\r\n| where \"*\" in ({Resources}) or properties.essentials.targetResource in~ ({Resources})\r\n| project AlertId=id, StartTime=todatetime(tostring(properties.essentials.startDateTime)), Severity, State=tostring(properties.essentials.alertState), Name=name, \r\n TargetResource = tostring(properties.essentials.targetResource), \r\n MonitorService = tostring(properties.essentials.monitorService),\r\n SignalType=tostring(properties.essentials.signalType), Description=tostring(properties.essentials.description)\r\n| order by StartTime desc\r\n", + "size": 0, + "title": "{$rowCount} {Severity} Alerts", + "noDataMessage": "No alerts found", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "AlertId", + "formatter": 5, + "formatOptions": { + "linkTarget": "Resource" + } + }, + { + "columnMatch": "StartTime", + "formatter": 6 + }, + { + "columnMatch": "Severity", + "formatter": 11 + }, + { + "columnMatch": "State", + "formatter": 1 + }, + { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkIsContextBlade": true, + "bladeOpenContext": { + "bladeName": "AlertDetailsTemplateBlade", + "extensionName": "Microsoft_Azure_Monitoring", + "bladeParameters": [ + { + "name": "alertId", + "source": "column", + "value": "AlertId" + }, + { + "name": "alertName", + "source": "column", + "value": "Name" + }, + { + "name": "invokedFrom", + "source": "static", + "value": "Workbooks" + } + ] + } + }, + "tooltipFormat": { + "tooltip": "View alert details" + } + }, + { + "columnMatch": "TargetResource", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "alerts", + "showIcon": true + } + }, + { + "columnMatch": "essentials", + "formatter": 5, + "formatOptions": { + "linkTarget": "CellDetails", + "linkIsContextBlade": true + } + } + ], + "rowLimit": 1000, + "filter": true + } + }, + "conditionalVisibility": { + "parameterName": "Severity", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Severity", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "details" + } + ], + "showPin": true, + "name": "Alerts for severity" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AlertsManagementResources | where type =~ 'microsoft.alertsmanagement/alerts'\r\n| where properties.essentials.startDateTime {timeRange} \r\n| extend Severity=tostring(properties.essentials.severity)\r\n| where Severity in ({Severity})\r\n| extend State=tostring(properties.essentials.alertState)\r\n| where \"*\" in ({State}) or State in ({State})\r\n| where \"*\" in ({ResourceTypes}) or properties.essentials.targetResourceType in~ ({ResourceTypes})\r\n| where \"*\" in ({ResourceGroups}) or properties.essentials.targetResourceGroup in~ ({ResourceGroups})\r\n| where \"*\" in ({Resources}) or properties.essentials.targetResource in~ ({Resources})\r\n| summarize Alerts=count(), New=countif(State==\"New\"), \r\nAcknowledged=countif(State==\"Acknowledged\"), \r\nClosed=countif(State==\"Closed\")\r\nby Resource=tostring(properties.essentials.targetResource )\r\n| order by Alerts desc\r\n", + "size": 0, + "title": "{Severity} Alerts by Region", + "noDataMessage": "No alerts found", + "exportMultipleValues": true, + "exportAggregateParts": true, + "exportedParameters": [ + { + "parameterName": "Selected", + "parameterType": 1, + "quote": "" + } + ], + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "visualization": "map", + "gridSettings": { + "rowLimit": 1000 + }, + "mapSettings": { + "locInfo": "AzureResource", + "locInfoColumn": "Resource", + "sizeSettings": "Alerts", + "sizeAggregation": "Sum", + "defaultSize": 0, + "legendMetric": "Alerts", + "legendAggregation": "Sum", + "itemColorSettings": { + "nodeColorField": "Alerts", + "colorAggregation": "Sum", + "type": "heatmap", + "heatmapPalette": "greenRed" + } + } + }, + "conditionalVisibility": { + "parameterName": "Severity", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Severity", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "location" + } + ], + "showPin": true, + "name": "Alerts map" + }, + { + "type": 1, + "content": { + "json": "💡 Select one or more regions to see Azure resources with alerts in those regions." + }, + "conditionalVisibility": { + "parameterName": "Selected", + "comparison": "isEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Selected", + "comparison": "isEqualTo" + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "location" + }, + { + "parameterName": "Severity", + "comparison": "isNotEqualTo" + } + ], + "name": "map selection text" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"1.0.0\",\"content\":\"[{Selected}]\",\"transformers\":null}", + "size": 0, + "title": "Resources with {Severity} Alerts in the Selected Regions", + "noDataMessage": "No alerts found", + "queryType": 8, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "regionName", + "formatter": 5 + }, + { + "columnMatch": "Resource", + "formatter": 5 + }, + { + "columnMatch": "Alerts", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "New", + "formatter": 0, + "formatOptions": { + "aggregation": "Sum" + } + }, + { + "columnMatch": "Acknowledged", + "formatter": 0, + "formatOptions": { + "aggregation": "Sum" + } + }, + { + "columnMatch": "Closed", + "formatter": 0, + "formatOptions": { + "aggregation": "Sum" + } + } + ], + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "regionName" + ], + "expandTopLevel": true, + "finalBy": "Resource" + }, + "labelSettings": [ + { + "columnId": "regionName", + "label": "Region" + }, + { + "columnId": "Resource" + }, + { + "columnId": "Alerts" + }, + { + "columnId": "New" + }, + { + "columnId": "Acknowledged" + }, + { + "columnId": "Closed" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "Selected", + "comparison": "isNotEqualTo" + }, + "name": "selected map items" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isNotEqualTo" + }, + "name": "visible if subscriptions selected" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Azure Resources/Workbooks/Alerts/settings.json b/Azure Resources/Workbooks/Alerts/settings.json new file mode 100644 index 0000000..0664df6 --- /dev/null +++ b/Azure Resources/Workbooks/Alerts/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Alerts", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "order": 101 } + ] +} \ No newline at end of file diff --git a/Azure Resources/Workbooks/Azure Resource Locations/Azure Resource Locations.workbook b/Azure Resources/Workbooks/Azure Resource Locations/Azure Resource Locations.workbook new file mode 100644 index 0000000..cd41de3 --- /dev/null +++ b/Azure Resources/Workbooks/Azure Resource Locations/Azure Resource Locations.workbook @@ -0,0 +1,265 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "bfe50469-7469-4c4d-a33e-0edbb43546c4", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + "value::5" + ], + "typeSettings": { + "limitSelectTo": 100, + "additionalResourceOptions": [ + "value::5" + ], + "includeAll": true + } + }, + { + "id": "bb1c10ec-cc9a-436e-8abc-7536ff78a19e", + "version": "KqlParameterItem/1.0", + "name": "ResourceType", + "label": "Resource Type", + "type": 7, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "summarize by type", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::3" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::3", + "value::all" + ] + }, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 1" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "tabView", + "linkTarget": "parameter", + "linkLabel": "Map View", + "subTarget": "Map", + "preText": "Map View", + "style": "link" + }, + { + "cellValue": "tabView", + "linkTarget": "parameter", + "linkLabel": "Resource View", + "subTarget": "Resource", + "preText": "Resource View", + "style": "link" + } + ] + }, + "name": "links - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "where type in ({ResourceType})\r\n| summarize count() by location", + "size": 2, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "visualization": "map", + "mapSettings": { + "locInfo": "AzureLoc", + "locInfoColumn": "location", + "sizeSettings": "count_", + "sizeAggregation": "Sum", + "minSize": 20, + "labelSettings": "location", + "legendMetric": "count_", + "legendAggregation": "Sum", + "itemColorSettings": { + "nodeColorField": "count_", + "colorAggregation": "Sum", + "type": "heatmap", + "heatmapPalette": "blue", + "heatmapMin": -10 + } + } + }, + "conditionalVisibility": { + "parameterName": "tabView", + "comparison": "isEqualTo", + "value": "Map" + }, + "showPin": true, + "name": "query - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "f95580c4-ff07-44c4-8b58-350552faadd3", + "version": "KqlParameterItem/1.0", + "name": "Location", + "type": 2, + "description": "Filter resources by location", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "distinct location\r\n| order by location asc", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::1", + "value::all" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "tabView", + "comparison": "isEqualTo", + "value": "Resource" + }, + "name": "parameters - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "where type in ({ResourceType})\r\n| where location in ({Location})\r\n| project location,id,resourceGroup\r\n| order by location asc", + "size": 0, + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "visualization": "table", + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "linkIsContextBlade": false, + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Location" + } + }, + { + "columnMatch": "location", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "resourceGroup", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "location" + ], + "expandTopLevel": true, + "finalBy": "id" + }, + "labelSettings": [ + { + "columnId": "location", + "label": "Location" + }, + { + "columnId": "resourceGroup", + "label": "Resource Group" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "tabView", + "comparison": "isEqualTo", + "value": "Resource" + }, + "name": "query - 2" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Azure Resources/Workbooks/Azure Resource Locations/settings.json b/Azure Resources/Workbooks/Azure Resource Locations/settings.json new file mode 100644 index 0000000..c5002e2 --- /dev/null +++ b/Azure Resources/Workbooks/Azure Resource Locations/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Azure Resource Locations", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "order": 100 } + ] +} diff --git a/Azure Resources/Workbooks/categoryResources.json b/Azure Resources/Workbooks/categoryResources.json new file mode 100644 index 0000000..95f6bfd --- /dev/null +++ b/Azure Resources/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Azure Resources", "description": "", "order": 300} +} diff --git a/Business Hypotheses/Alerts/README b/Business Hypotheses/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Business Hypotheses/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Business Hypotheses/Queries/README b/Business Hypotheses/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Business Hypotheses/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Business Hypotheses/Workbooks/Improving User Retention/Improving User Retention.workbook b/Business Hypotheses/Workbooks/Improving User Retention/Improving User Retention.workbook new file mode 100644 index 0000000..231972f --- /dev/null +++ b/Business Hypotheses/Workbooks/Improving User Retention/Improving User Retention.workbook @@ -0,0 +1,235 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Hypothesis - _[proposed change]_ will improve user retention by _[expected improvement]_\n---\nA good hypothesis is the heart of data-driven decision making. Hypotheses help you turn information about your customers' usage of your app into actionable proposal for improvements. Use this workbook to craft a hypothesis about improving the retention rates of your users." + } + }, + { + "type": 1, + "content": { + "json": "## Problem - _[problem statement]_\nAdd a summary of the problem in the section. The summary should be concise and not more than a few sentences long. Clearly state the problem and avoid nonessential details. \n\n\n" + } + }, + { + "type": 1, + "content": { + "json": "### What's the retention problem?\nModify the parameters below to show the retention rate of activities you are analyzing. Your goal should be highlighting a retention problem in your app." + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e552c6ce-183d-4b5d-8405-d60313b3eb8e", + "version": "KqlParameterItem/1.0", + "name": "Activities", + "type": 2, + "description": "", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\r\n| where timestamp >= ago(7d)\r\n| summarize count() by name\r\n| order by count_ desc\r\n| project Id=name, Title=name, Selected=false\r\n| union (\r\ndatatable(Id:string, Title:string, Selected:boolean)[\r\n'*', 'All Events and Page Views', true\r\n]\r\n)" + }, + { + "id": "68b8c1f5-9f24-401a-bea4-9739a7438069", + "version": "KqlParameterItem/1.0", + "name": "RetentionPeriod", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(key:string, display:string) \r\n[ \r\n\"1d\", \"Day over Day\", \r\n\"7d\", \"Week over Week\", \r\n\"28d\", \"Month over Month (28 days)\", \r\n\"30d\", \"Month over Month (30 days)\"\r\n] ", + "value": "28d" + }, + { + "id": "7813b809-0b92-4531-ad05-90add0674de0", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(key:string, display:string) \r\n[ \r\n\"7d\", \"Last 7 days\", \r\n\"14d\", \"Last 14 days\", \r\n\"30d\", \"Last 30 days\", \r\n] ", + "value": "30d" + } + ] + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\r\nlet monthDefinition = {RetentionPeriod};\r\nlet hlls = union customEvents, pageViews\r\n| where timestamp >= startofmonth(now() - timeRange - 2 * monthDefinition)\r\n| where name in ({Activities}) or '*' in ({Activities})\r\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\r\n| project DaysToMerge = timestamp, Hlls;\r\nlet churnSeriesWithHllsToInclude = materialize(range d from 0d to (timeRange) step 1d\r\n| extend Day = startofday(now() - d)\r\n| extend R = range(0d, monthDefinition - 1d, 1d)\r\n| mvexpand R\r\n| extend ThisMonth = Day - totimespan(R)\r\n| extend LastMonth = Day - monthDefinition - totimespan(R)\r\n| project Day, ThisMonth, LastMonth);\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = ThisMonth\r\n| join kind= inner (hlls) on DaysToMerge \r\n| project Day, ThisMonthHlls = Hlls\r\n| union (\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = LastMonth\r\n| join kind= inner (hlls) on DaysToMerge\r\n| project Day, LastMonthHlls = Hlls)\r\n| summarize ThisMonth = hll_merge(ThisMonthHlls), LastMonth = hll_merge(LastMonthHlls) by Day\r\n| evaluate dcount_intersect(ThisMonth, LastMonth)\r\n| where Day >= startofday(now() - timeRange)\r\n| extend ChurnedUsers = (dcount_hll(LastMonth) - s1) // Last Months Users - Returning Users\r\n| project Day, [\"Retention Rate\"] = iff((s1 + ChurnedUsers) == 0, 0.0, 100.0 * s1 / (s1 + ChurnedUsers))\r\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "timechart" + } + }, + { + "type": 1, + "content": { + "json": "### As a benchmark, what's the retention rate of a similar feature?\nUse this section to compare the retention of your activities with similar ones. This will help set the context of the improvements you are trying to make." + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "35df6f18-6009-4c8c-898a-3d47414ee7cd", + "version": "KqlParameterItem/1.0", + "name": "RelatedActivities", + "type": 2, + "description": "", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\r\n| where timestamp >= ago(7d)\r\n| summarize count() by name\r\n| order by count_ desc\r\n| project Id=name, Title=name, Selected=false\r\n| union (\r\ndatatable(Id:string, Title:string, Selected:boolean)[\r\n'*', 'All Events and Page Views', true\r\n]\r\n)" + } + ] + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\r\nlet monthDefinition = {RetentionPeriod};\r\nlet hlls = union customEvents, pageViews\r\n| where timestamp >= startofmonth(now() - timeRange - 2 * monthDefinition)\r\n| where name in ({RelatedActivities}) or '*' in ({RelatedActivities})\r\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\r\n| project DaysToMerge = timestamp, Hlls;\r\nlet churnSeriesWithHllsToInclude = materialize(range d from 0d to (timeRange) step 1d\r\n| extend Day = startofday(now() - d)\r\n| extend R = range(0d, monthDefinition - 1d, 1d)\r\n| mvexpand R\r\n| extend ThisMonth = Day - totimespan(R)\r\n| extend LastMonth = Day - monthDefinition - totimespan(R)\r\n| project Day, ThisMonth, LastMonth);\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = ThisMonth\r\n| join kind= inner (hlls) on DaysToMerge \r\n| project Day, ThisMonthHlls = Hlls\r\n| union (\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = LastMonth\r\n| join kind= inner (hlls) on DaysToMerge\r\n| project Day, LastMonthHlls = Hlls)\r\n| summarize ThisMonth = hll_merge(ThisMonthHlls), LastMonth = hll_merge(LastMonthHlls) by Day\r\n| evaluate dcount_intersect(ThisMonth, LastMonth)\r\n| where Day >= startofday(now() - timeRange)\r\n| extend ChurnedUsers = (dcount_hll(LastMonth) - s1) // Last Months Users - Returning Users\r\n| project Day, [\"Retention Rate\"] = iff((s1 + ChurnedUsers) == 0, 0.0, 100.0 * s1 / (s1 + ChurnedUsers))\r\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "timechart" + } + }, + { + "type": 1, + "content": { + "json": "### Why do we suspect retention for this feature is low?\nThis section provides explanations for why the retention could be low. The solution you propose will address some or all of the issues identified here." + } + }, + { + "type": 1, + "content": { + "json": "### What's the potential benefit to your business if you improve retention for this feature?\nThis section helps you understand the improvements in monthly active users you can see if your retention increased. Use the _RetentionGoal_ parameter to set the goal for retention with the proposed solution." + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "5d3b9f2b-ae31-41c1-a9c3-b540185fa7de", + "version": "KqlParameterItem/1.0", + "name": "RetentionGoal", + "type": 1, + "description": "The goal for Retention Rate expressed as percentage (0-100)", + "isRequired": true, + "query": "let timeRange = {TimeRange};\r\nlet monthDefinition = {RetentionPeriod};\r\nlet hlls = union customEvents, pageViews\r\n| where timestamp >= startofmonth(now() - timeRange - 2 * monthDefinition)\r\n| where name in ({Activities}) or '*' in ({Activities})\r\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\r\n| project DaysToMerge = timestamp, Hlls;\r\nlet churnSeriesWithHllsToInclude = materialize(range d from 0d to 0d step 1d\r\n| extend Day = startofday(now() - d)\r\n| extend R = range(0d, monthDefinition - 1d, 1d)\r\n| mvexpand R\r\n| extend ThisMonth = Day - totimespan(R)\r\n| extend LastMonth = Day - monthDefinition - totimespan(R)\r\n| project Day, ThisMonth, LastMonth);\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = ThisMonth\r\n| join kind= inner (hlls) on DaysToMerge \r\n| project Day, ThisMonthHlls = Hlls\r\n| union (\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = LastMonth\r\n| join kind= inner (hlls) on DaysToMerge\r\n| project Day, LastMonthHlls = Hlls)\r\n| summarize ThisMonth = hll_merge(ThisMonthHlls), LastMonth = hll_merge(LastMonthHlls) by Day\r\n| evaluate dcount_intersect(ThisMonth, LastMonth)\r\n| where Day >= startofday(now() - timeRange)\r\n| extend ChurnedUsers = (dcount_hll(LastMonth) - s1) // Last Months Users - Returning Users\r\n| project Retention = round(iff((s1 + ChurnedUsers) == 0, 0.0, 100.0 * s1 / (s1 + ChurnedUsers)) * 1.1, 1)\r\n| extend Retention = iff(Retention > 100, 100.0, Retention)\r\n" + } + ] + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let retentionRate = {RetentionGoal};\r\nlet timeRange = {TimeRange};\r\nlet monthDefinition = {RetentionPeriod};\r\nlet hlls = union customEvents, pageViews\r\n| where timestamp >= startofmonth(now() - timeRange - 2 * monthDefinition)\r\n| where name in ({Activities}) or '*' in ({Activities})\r\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\r\n| project DaysToMerge = timestamp, Hlls;\r\nlet churnSeriesWithHllsToInclude = materialize(range d from 0d to (timeRange) step 1d\r\n| extend Day = startofday(now() - d)\r\n| extend R = range(0d, monthDefinition - 1d, 1d)\r\n| mvexpand R\r\n| extend ThisMonth = Day - totimespan(R)\r\n| extend LastMonth = Day - monthDefinition - totimespan(R)\r\n| project Day, ThisMonth, LastMonth);\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = ThisMonth\r\n| join kind= inner (hlls) on DaysToMerge \r\n| project Day, ThisMonthHlls = Hlls\r\n| union (\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = LastMonth\r\n| join kind= inner (hlls) on DaysToMerge\r\n| project Day, LastMonthHlls = Hlls)\r\n| summarize ThisMonth = hll_merge(ThisMonthHlls), LastMonth = hll_merge(LastMonthHlls) by Day\r\n| evaluate dcount_intersect(ThisMonth, LastMonth)\r\n| where Day >= startofday(now() - timeRange)\r\n| extend NewUsers = s0 - s1\r\n| extend ChurnedUsers = (dcount_hll(LastMonth) - s1) // Last Months Users - Returning Users\r\n| project Day, [\"MAU at {RetentionGoal}% Retention\"] = (0.01 * retentionRate * s0) + NewUsers, [\"MAU\"] = s1 + NewUsers", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "timechart" + } + }, + { + "type": 1, + "content": { + "json": "### What customer evidence do you have?\nAdd customer feedback that confirms that the existence of the problem and that your proposed solution will truly address it." + } + }, + { + "type": 1, + "content": { + "json": "### How are your competitors solving this problem?\nUse this section to show how your competitors address this problem in their apps.\n" + } + }, + { + "type": 1, + "content": { + "json": "### Open Questions\nList all questions or discussions that are still unresolved." + } + }, + { + "type": 1, + "content": { + "json": "## Potential solution - _[solution description]_\nUse this section describe the proposed solution.\n" + } + }, + { + "type": 1, + "content": { + "json": "### Why it will work?\nDescribe your theory of user behavior that will result in this proposal leading to greater user retention." + } + }, + { + "type": 1, + "content": { + "json": "### Why might it not work?\nThink about and list reason why the solution may not result in meeting the goals you have set - e.g. alternate theories for the cause of the problem." + } + }, + { + "type": 1, + "content": { + "json": "### Will it affect other scenarios?\nList the other features and scenarios that could be affected by the proposed solution. " + } + }, + { + "type": 1, + "content": { + "json": "## Expected outcome - User retention improves to {RetentionGoal}%\nThis section clearly lists out the measurable outcomes of implementing the proposed solution.\n\n" + } + }, + { + "type": 1, + "content": { + "json": "### Primary Goal - Retention Rate hits {RetentionGoal}%\n" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\nlet monthDefinition = {RetentionPeriod};\nlet hlls = union customEvents, pageViews\n| where timestamp >= startofmonth(now() - timeRange - 2 * monthDefinition)\n| where name in ({Activities}) or '*' in ({Activities})\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\n| project DaysToMerge = timestamp, Hlls;\nlet churnSeriesWithHllsToInclude = materialize(range d from 0d to (timeRange + monthDefinition) step 1d\n| extend Day = startofday(now() - d)\n| extend R = range(0d, monthDefinition - 1d, 1d)\n| mvexpand R\n| extend ThisMonth = Day - totimespan(R)\n| extend LastMonth = Day - monthDefinition - totimespan(R)\n| project Day, ThisMonth, LastMonth);\nchurnSeriesWithHllsToInclude\n| extend DaysToMerge = ThisMonth\n| join kind= inner (hlls) on DaysToMerge \n| project Day, ThisMonthHlls = Hlls\n| union (\nchurnSeriesWithHllsToInclude\n| extend DaysToMerge = LastMonth\n| join kind= inner (hlls) on DaysToMerge\n| project Day, LastMonthHlls = Hlls)\n| summarize ThisMonth = hll_merge(ThisMonthHlls), LastMonth = hll_merge(LastMonthHlls) by Day\n| evaluate dcount_intersect(ThisMonth, LastMonth)\n| where Day >= startofday(now() - timeRange)\n| extend ChurnedUsers = (dcount_hll(LastMonth) - s1) // Last Months Users - Returning Users\n| project Day, [\"Retention Rate\"] = iff((s1 + ChurnedUsers) == 0, 0.0, 100.0 * s1 / (s1 + ChurnedUsers)), Goal = {RetentionGoal}\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "timechart" + } + }, + { + "type": 1, + "content": { + "json": "### Other Goals\nList any secondary goals you may have related to this effort. " + } + } + ] +} \ No newline at end of file diff --git a/Business Hypotheses/Workbooks/Improving User Retention/settings.json b/Business Hypotheses/Workbooks/Improving User Retention/settings.json new file mode 100644 index 0000000..9f40e0d --- /dev/null +++ b/Business Hypotheses/Workbooks/Improving User Retention/settings.json @@ -0,0 +1,18 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Improving User Retention", + "author": "Microsoft", + "order": 100, + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 100 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 100 + } + ] +} \ No newline at end of file diff --git a/Business Hypotheses/Workbooks/Increasing Active Users/Increasing Active Users.workbook b/Business Hypotheses/Workbooks/Increasing Active Users/Increasing Active Users.workbook new file mode 100644 index 0000000..cb25aa6 --- /dev/null +++ b/Business Hypotheses/Workbooks/Increasing Active Users/Increasing Active Users.workbook @@ -0,0 +1,217 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Hypothesis - _[proposed change]_ will increase active users by _[expected improvement]_\n---\nA good hypothesis is the heart of data-driven decision making. Hypotheses help you turn information about your customers' usage of your app into actionable proposal for improvements. Use this workbook to craft a hypothesis about improving the monthly (MAU), weekly (WAU) or daily (DAU) active users of your app." + } + }, + { + "type": 1, + "content": { + "json": "## Problem - _[problem statement]_\nAdd a summary of the problem in the section. The summary should be concise and not more than a few sentences long. Clearly state the problem and avoid nonessential details. \n\n\n" + } + }, + { + "type": 1, + "content": { + "json": "### What's the active usage problem?\nModify the parameters below to show the active usage of activities you are analyzing. Your goal should be highlighting an active usage problem in your app." + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e552c6ce-183d-4b5d-8405-d60313b3eb8e", + "version": "KqlParameterItem/1.0", + "name": "Activities", + "type": 2, + "description": "A comma separated set of Page views or Events that are to be counted as activities. Or user '*' to include all events.", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\r\n| where timestamp >= ago(7d)\r\n| summarize count() by name\r\n| order by count_ desc\r\n| project Id=name, Title=name, Selected=false\r\n| union (\r\ndatatable(Id:string, Title:string, Selected:boolean)[\r\n'*', 'All Events and Page Views', true\r\n]\r\n)" + }, + { + "id": "68b8c1f5-9f24-401a-bea4-9739a7438069", + "version": "KqlParameterItem/1.0", + "name": "Metric", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(key:string, display:string) \r\n[ \r\n\"1d\", \"Daily Active Users\", \r\n\"7d\", \"Weekly Active Users\", \r\n\"28d\", \"Monthly Active Users (28 days)\", \r\n\"30d\", \"Monthly Active Users (30 days)\"\r\n] ", + "value": "28d" + }, + { + "id": "7813b809-0b92-4531-ad05-90add0674de0", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(key:string, display:string) \r\n[ \r\n\"7d\", \"Last 7 days\", \r\n\"14d\", \"Last 14 days\", \r\n\"30d\", \"Last 30 days\", \r\n] ", + "value": "30d" + } + ] + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\r\nlet monthDefinition = {Metric};\r\nlet hlls = union customEvents, pageViews\r\n| where timestamp >= startofmonth(now() - timeRange - monthDefinition)\r\n| where name in ({Activities}) or '*' in ({Activities})\r\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\r\n| project DaysToMerge = timestamp, Hlls;\r\nrange d from 0d to timeRange step 1d\r\n| extend Day = startofday(now() - d)\r\n| extend R = range(0d, monthDefinition - 1d, 1d)\r\n| mvexpand R\r\n| extend DaysToMerge = Day - totimespan(R)\r\n| join kind= inner (hlls) on DaysToMerge \r\n| project Day, ThisMonthHlls = Hlls\r\n| summarize ThisMonth = hll_merge(ThisMonthHlls) by Day\r\n| project Day, [\"Monthly Active Users\"] = dcount_hll(ThisMonth) \r\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "timechart" + } + }, + { + "type": 1, + "content": { + "json": "### As a benchmark, what's the usage of a similar feature?\nUse this section to compare the active users of your activities with similar ones. This will help set the context of the improvements you are trying to make." + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "35df6f18-6009-4c8c-898a-3d47414ee7cd", + "version": "KqlParameterItem/1.0", + "name": "RelatedActivities", + "type": 2, + "description": "Select the set of custom events and page views to use as benchmark activities.", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\r\n| where timestamp >= ago(7d)\r\n| summarize count() by name\r\n| order by count_ desc\r\n| project Id=name, Title=name, Selected=false\r\n| union (\r\ndatatable(Id:string, Title:string, Selected:boolean)[\r\n'*', 'All Events and Page Views', true\r\n]\r\n)" + } + ] + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\r\nlet monthDefinition = {Metric};\r\nlet hlls = union customEvents, pageViews\r\n| where timestamp >= startofmonth(now() - timeRange - monthDefinition)\r\n| where name in ({RelatedActivities}) or '*' in ({RelatedActivities})\r\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\r\n| project DaysToMerge = timestamp, Hlls;\r\nrange d from 0d to timeRange step 1d\r\n| extend Day = startofday(now() - d)\r\n| extend R = range(0d, monthDefinition - 1d, 1d)\r\n| mvexpand R\r\n| extend DaysToMerge = Day - totimespan(R)\r\n| join kind= inner (hlls) on DaysToMerge \r\n| project Day, ThisMonthHlls = Hlls\r\n| summarize ThisMonth = hll_merge(ThisMonthHlls) by Day\r\n| project Day, [\"Monthly Active Users\"] = dcount_hll(ThisMonth) \r\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "timechart" + } + }, + { + "type": 1, + "content": { + "json": "### Why do you suspect active usage of this feature is low?\nThis section provides explanations for why the active users numbers could be low. The solution you propose will address some or all of the issues identified here." + } + }, + { + "type": 1, + "content": { + "json": "### What customer evidence do you have?\nAdd customer feedback that confirms that the existence of the problem and that your proposed solution will truly address it." + } + }, + { + "type": 1, + "content": { + "json": "### How are your competitors solving this problem?\nUse this section to show how your competitors address this problem in their apps.\n" + } + }, + { + "type": 1, + "content": { + "json": "### Open Questions\nList all questions or discussions that are still unresolved." + } + }, + { + "type": 1, + "content": { + "json": "## Potential solution - _[solution description]_\nUse this section describe the proposed solution.\n" + } + }, + { + "type": 1, + "content": { + "json": "### Why it will work?\nDescribe your theory of user behavior that will result in this proposal leading to greater numbers of active users." + } + }, + { + "type": 1, + "content": { + "json": "### Why might it not work?\nThink about and list reasons why the solution may not result in meeting the goals you have set - e.g. alternate theories for the cause of the problem." + } + }, + { + "type": 1, + "content": { + "json": "### Will it affect other scenarios?\nList the other features and scenarios that could be affected by the proposed solution. " + } + }, + { + "type": 1, + "content": { + "json": "## Expected outcome - Active usage hits _[threshold]_\nThis section clearly lists out the measurable outcomes of implementing the proposed solution.\n\n" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "ed501437-ae26-454f-bc58-db07649f4c0c", + "version": "KqlParameterItem/1.0", + "name": "Goal", + "type": 1, + "description": null, + "isRequired": true, + "query": "let monthDefinition = {Metric};\r\nunion customEvents, pageViews\r\n| where timestamp >= startofday(now() - monthDefinition + 1d)\r\n| where name in ({Activities}) or '*' in ({Activities})\r\n| summarize MAU=dcount(user_Id)\r\n| extend Goal = round(MAU * 1.1), lg = exp10(bin(log10(MAU), 1) - 1)\r\n| project AdjustedGoal = case(lg <= 0.1, round(MAU * 1.5), round(round(Goal / lg) * lg))" + } + ] + } + }, + { + "type": 1, + "content": { + "json": "### Primary Goal - Active usage hits {Goal}\nThe default goal chosen is about 10% higher than current MAU. Change this to the goal for your app. " + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\nlet monthDefinition = {Metric};\nlet hlls = union customEvents, pageViews\n| where timestamp >= startofmonth(now() - timeRange - monthDefinition)\n| where name in ({Activities}) or '*' in ({Activities})\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\n| project DaysToMerge = timestamp, Hlls;\nrange d from 0d to timeRange step 1d\n| extend Day = startofday(now() - d)\n| extend R = range(0d, monthDefinition - 1d, 1d)\n| mvexpand R\n| extend DaysToMerge = Day - totimespan(R)\n| join kind= inner (hlls) on DaysToMerge \n| project Day, ThisMonthHlls = Hlls\n| summarize ThisMonth = hll_merge(ThisMonthHlls) by Day\n| project Day, [\"Monthly Active Users\"] = dcount_hll(ThisMonth), Goal = {Goal}\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "timechart" + } + }, + { + "type": 1, + "content": { + "json": "### Other Goals\nList any secondary goals you may have related to this effort. " + } + } + ] +} \ No newline at end of file diff --git a/Business Hypotheses/Workbooks/Increasing Active Users/settings.json b/Business Hypotheses/Workbooks/Increasing Active Users/settings.json new file mode 100644 index 0000000..291a941 --- /dev/null +++ b/Business Hypotheses/Workbooks/Increasing Active Users/settings.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Increasing Active Users", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 200 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 200 + } + ] +} \ No newline at end of file diff --git a/Business Hypotheses/Workbooks/categoryResources.json b/Business Hypotheses/Workbooks/categoryResources.json new file mode 100644 index 0000000..0c4dd55 --- /dev/null +++ b/Business Hypotheses/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Business Hypotheses", "description": " ", "order": 600} +} \ No newline at end of file diff --git a/Common/Alerts/README b/Common/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Common/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Common/Queries/README b/Common/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Common/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Common/Workbooks/categoryResources.json b/Common/Workbooks/categoryResources.json new file mode 100644 index 0000000..4ac1033 --- /dev/null +++ b/Common/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Common", "description": "Any common workbook templates that can be loaded into other workbooks", "order": 100} +} \ No newline at end of file diff --git a/Common/Workbooks/noSubscriptions/noSubscriptions.workbook b/Common/Workbooks/noSubscriptions/noSubscriptions.workbook new file mode 100644 index 0000000..44de876 --- /dev/null +++ b/Common/Workbooks/noSubscriptions/noSubscriptions.workbook @@ -0,0 +1,62 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "f77b57bf-1658-4a64-91b7-c188ba2027a8", + "version": "KqlParameterItem/1.0", + "name": "ResourceImageUrl", + "type": 1, + "isHiddenWhenLocked": true, + "value": "" + }, + { + "id": "7210b865-0844-438f-9b2a-59b185f80aa6", + "version": "KqlParameterItem/1.0", + "name": "ResourceName", + "type": 1, + "isHiddenWhenLocked": true, + "value": "" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 2" + }, + { + "type": 1, + "content": { + "json": "## No Subscriptions are selected.\r\n\r\nSelect one or more subscriptions to get started. If no subscriptions appear, we could not find any {ResourceName} resources in your subscriptions and you may need to [update your default subscription filter](https://azure.microsoft.com/en-us/updates/updates-to-subscription-filtering/)." + }, + "name": "No Subscription text" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "\"{ResourceName}\"" + }, + "name": "text - 0" + } + ] + }, + "conditionalVisibility": { + "parameterName": "ResourceImageUrl", + "comparison": "isNotEqualTo" + }, + "name": "ResourceImageUrl" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Common/Workbooks/noSubscriptions/settings.json b/Common/Workbooks/noSubscriptions/settings.json new file mode 100644 index 0000000..131ca99 --- /dev/null +++ b/Common/Workbooks/noSubscriptions/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"noSubscriptions", + "description": "Template used for insights when no default subscriptions are selected.", + "author": "Microsoft", + "galleries": [] +} \ No newline at end of file diff --git a/CosmosDb/Alerts/README b/CosmosDb/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/CosmosDb/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/CosmosDb/Queries/README b/CosmosDb/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/CosmosDb/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/CosmosDb/Workbooks/Overview/Overview.workbook b/CosmosDb/Workbooks/Overview/Overview.workbook new file mode 100644 index 0000000..f2ac85e --- /dev/null +++ b/CosmosDb/Workbooks/Overview/Overview.workbook @@ -0,0 +1,1267 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All subscriptions with CosmosDB accounts", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'Microsoft.DocumentDB/databaseAccounts'\r\n\t| summarize Count = count() by subscriptionId\r\n\t| order by Count desc\r\n\t| extend Rank = row_number()\r\n\t| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "138881c1-d041-4acd-acc9-e7a7af02d2ef", + "version": "KqlParameterItem/1.0", + "name": "CosmosDB", + "label": "Azure Cosmos DB", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'Microsoft.DocumentDB/databaseAccounts'\r\n\t| order by name asc\r\n\t| extend Rank = row_number()\r\n\t| project value = id, label = id, selected = Rank <= 5\r\n", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "type": 4, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "9b48988f-dcd2-48cc-b233-5999ed32149f", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "where type =~ 'Microsoft.DocumentDB/databaseAccounts'\n| summarize Selected = countif(id in ({CosmosDB:value})), Total = count()\n| extend Selected = iff(Selected > 200, 200, Selected)\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "9aab8378-c97c-4b28-b034-7538d6fdfffa", + "version": "KqlParameterItem/1.0", + "name": "ResourceName", + "type": 1, + "description": "Used for the 'No Subscriptions' Workbook template", + "value": "Azure Cosmos DB", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'Azure Cosmos DB'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "Azure Cosmos DB" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "9fac27da-f78b-466f-ab1f-d4b5a8be2d31", + "version": "KqlParameterItem/1.0", + "name": "ResourceImageUrl", + "type": 1, + "description": "Used for the 'No Subscriptions' workbook template", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "cosmosDB account parameters", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Common/noSubscriptions", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isEqualTo", + "value": "" + }, + "name": "No Subscriptions group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "{Message}\r\n_Azure Cosmos DB accounts_\r\n
\r\n
" + }, + "name": "CosmosDBAccounts", + "styleSettings": { + "margin": "15px 0 10px 10px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Failures", + "subTarget": "Failures", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Capacity", + "subTarget": "Capacity", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Operations", + "subTarget": "Operation", + "style": "link" + } + ] + }, + "name": "links-tabs", + "styleSettings": { + "margin": "-15px 0px -15px 0px" + } + }, + { + "type": 1, + "content": { + "json": "### Start editing the Overview section here" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "OverviewSectionEditStart" + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{CosmosDB}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.documentdb/databaseaccounts", + "resourceParameter": "CosmosDB", + "metrics": [ + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "aggregation": 7, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount", + "aggregation": 4, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-DataUsage", + "aggregation": 4, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-ProvisionedThroughput", + "aggregation": 3, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "gridFormatType": 2, + "filters": [ + { + "id": "1", + "key": "CollectionName", + "operator": 1, + "values": [ + "" + ], + "valueParam": null + } + ], + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests$|microsoft.documentdb/databaseaccounts-Requests-MetadataRequests$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "Request failures", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Request failures Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DataUsage", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DataUsage Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-ProvisionedThroughput", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "gray", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-ProvisionedThroughput Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequestUnits", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequestUnits Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": ".*\\/Total Requests$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "429/Total Requests", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "3", + "text": "{0}{1}" + } + ] + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-TotalRequests$|microsoft.documentdb/databaseaccounts-Requests-MetadataRequests$_4", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "Segment", + "label": "CollectionName" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "label": "Requests" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests Timeline", + "label": "Requests Timeline" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount", + "label": "Documents" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount Timeline", + "label": "Document Count (Average) Timeline" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DataUsage", + "label": "Data Usage" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DataUsage Timeline", + "label": "Data Usage (Average) Timeline" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-ProvisionedThroughput", + "label": "Provisioned throughput (RUs/5m)" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-ProvisionedThroughput Timeline", + "label": "Provisioned Throughput (Max) Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-TotalRequests$|microsoft.documentdb/databaseaccounts-Requests-MetadataRequests$_4", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "showPin": true, + "name": "cosmosDB account metrics" + }, + { + "type": 1, + "content": { + "json": "### Start editing the Failures section here" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "FailureSectionEditStart" + }, + { + "type": 10, + "content": { + "chartId": "workbook0efdd8cd-3252-4cee-9fc3-948f48df25af", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{CosmosDB}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.documentdb/databaseaccounts", + "resourceParameter": "CosmosDB", + "metrics": [ + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "aggregation": 7, + "splitBy": null + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "aggregation": 7, + "splitBy": "StatusCode", + "splitBySortOrder": -1, + "splitByLimit": 10, + "columnName": "response" + } + ], + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "(20|30).*\\/response", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "(401|404)/response", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "gray", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": ".*\\/response$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-TotalRequests_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "label": "Total Requests (Count)" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests Timeline", + "label": "Total Requests Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-TotalRequests_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Failures" + }, + "showPin": true, + "name": "cosmosDB account failures" + }, + { + "type": 1, + "content": { + "json": "### Start editing the Capacity section here\r\n" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "CapacitySectionEditStart" + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{CosmosDB}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.documentdb/databaseaccounts", + "resourceParameter": "CosmosDB", + "metrics": [ + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount", + "aggregation": 4, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-DataUsage", + "aggregation": 4, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-IndexUsage", + "aggregation": 4, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-AvailableStorage", + "aggregation": 4, + "splitBy": "CollectionName", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "gridFormatType": 2, + "filters": [ + { + "id": "1", + "key": "CollectionName", + "operator": 1, + "values": [ + "" + ], + "valueParam": null + } + ], + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DataUsage|microsoft.documentdb/databaseaccounts-Requests-IndexUsage", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-DataUsage Timeline", + "formatter": 5, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-IndexUsage Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-AvailableStorage", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "gray", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-AvailableStorage Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-DocumentCount_4", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "Segment", + "label": "CollectionName" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount", + "label": "Documents" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DocumentCount Timeline", + "label": "Documents Timeline" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DataUsage", + "label": "Data Usage" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-DataUsage Timeline", + "label": "Data Usage (Sum) Timeline" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-IndexUsage", + "label": "Index Usage" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-IndexUsage Timeline", + "label": "Index Usage (Sum) Timeline" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-AvailableStorage", + "label": "Available Storage" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-AvailableStorage Timeline", + "label": "Available Storage (Sum) Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-DocumentCount_4", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Capacity" + }, + "showPin": true, + "name": "cosmosDB account capacity" + }, + { + "type": 1, + "content": { + "json": "### Start editing the Operations section here\r\n" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "OperationSectionEditStarts" + }, + { + "type": 10, + "content": { + "chartId": "workbook31d87d8f-2f6e-4f40-b780-a06fbf7c2967", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{CosmosDB}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.documentdb/databaseaccounts", + "resourceParameter": "CosmosDB", + "metrics": [ + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "aggregation": 7, + "splitBy": null + }, + { + "namespace": "microsoft.documentdb/databaseaccounts", + "metric": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "aggregation": 7, + "splitBy": "OperationType", + "splitBySortOrder": -1, + "splitByLimit": 3, + "columnName": "operation" + } + ], + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": ".*\\/operation", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-TotalRequests_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests", + "label": "Requests" + }, + { + "columnId": "microsoft.documentdb/databaseaccounts-Requests-TotalRequests Timeline", + "label": "Requests Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.documentdb/databaseaccounts-Requests-TotalRequests_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Operation" + }, + "showPin": true, + "name": "cosmosDB account operations" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "Azure Cosmos DB accounts" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/CosmosDb/Workbooks/Overview/settings.json b/CosmosDb/Workbooks/Overview/settings.json new file mode 100644 index 0000000..8a6134b --- /dev/null +++ b/CosmosDb/Workbooks/Overview/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Azure Cosmos DB Overview", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorInsights", "order": 100 }, { "type": "cosmosdb-insights", "resourceType": "Azure Monitor", "order": 100 }] +} \ No newline at end of file diff --git a/CosmosDb/Workbooks/categoryResources.json b/CosmosDb/Workbooks/categoryResources.json new file mode 100644 index 0000000..b31d024 --- /dev/null +++ b/CosmosDb/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Azure Cosmos DB", "description": "Provides insights for your Azure Cosmos DBs", "order": 300} +} \ No newline at end of file diff --git a/Failures/Alerts/README b/Failures/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Failures/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Failures/Queries/README b/Failures/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Failures/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Failures/Workbooks/Failure Insights/Failure Insights.workbook b/Failures/Workbooks/Failure Insights/Failure Insights.workbook new file mode 100644 index 0000000..abf0fc4 --- /dev/null +++ b/Failures/Workbooks/Failure Insights/Failure Insights.workbook @@ -0,0 +1,345 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Failures Insights\n" + }, + "conditionalVisibility": null, + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.insights/components": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + }, + "value": [ + "value::3" + ] + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": false, + "value": { + "durationMs": 14400000 + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + } + ], + "allowCustom": null + }, + "timeContextFromParameter": null + }, + { + "id": "1014e6d9-72b9-4729-a3a0-f5704768854e", + "version": "KqlParameterItem/1.0", + "name": "Operation", + "type": 1, + "isRequired": false, + "isHiddenWhenLocked": true, + "value": "{\"App\":\"\",\"Operation\":\"\"}" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null, + "name": "parameters - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = requests\n| where timestamp {TimeRange};\ndata\n| summarize Users = dcount(user_Id), CountFailed = countif(success == false), Count = count() by name, appName\n| project App = appName, Operation = name, ['Count (Failed)'] = CountFailed, Count, ['Success %'] = round(100.0 * (Count - CountFailed) / Count, 2), Users\n| union (data\n | summarize Users = dcount(user_Id), CountFailed = countif(success == false), Count = count()\n | project App = '🔸 All Apps', Operation = '🔸 All operations', Users, ['Count (Failed)'] = CountFailed, Count, ['Success %'] = round(100.0 * (Count - CountFailed) / Count, 2))\n| order by ['Count (Failed)'] desc\n", + "size": 0, + "exportParameterName": "Operation", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Count (Failed)", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Success %", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "redGreen" + } + }, + { + "columnMatch": "Users", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blueDark" + } + } + ] + } + }, + "conditionalVisibility": null, + "name": "query - 2" + }, + { + "type": 1, + "content": { + "json": "💡 *Click on the rows of the table above to see details for other operations*" + }, + "conditionalVisibility": null, + "name": "text - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "66e58e14-2fcf-469f-9936-d05ed2622954", + "version": "KqlParameterItem/1.0", + "name": "SelectedOperation", + "type": 1, + "isRequired": true, + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nrange i from 1 to 1 step 1\n| project Operation = iff((operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps'), 'all operations', operation)", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null, + "name": "parameters - 4" + }, + { + "type": 1, + "content": { + "json": "## Details -- {SelectedOperation}\n" + }, + "conditionalVisibility": null, + "name": "text - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nrequests\n| where timestamp {TimeRange}\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\n| make-series FailedRequest = countif(success == false) default = 0 on timestamp in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain})\n| mvexpand timestamp to typeof(datetime), FailedRequest to typeof(long)\n", + "size": 1, + "title": "Failed Operations", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "query - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nrequests\n| where timestamp {TimeRange}\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\n| make-series Requests = count() default = 0 on timestamp in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain})\n| mvexpand timestamp to typeof(datetime), Requests to typeof(long)\n", + "size": 1, + "title": "All Operations", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "query - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nrequests\n| where timestamp {TimeRange}\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\n| where success == false\n| summarize ['Failing Requests'] = count() by ['Result Code'] = tostring(resultCode)\n| top 4 by ['Failing Requests'] desc\n", + "size": 1, + "title": "Top Failure Codes", + "noDataMessage": "No failiures found.", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Failing Requests", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "query - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nlet operations = toscalar(requests\n| where timestamp {TimeRange}\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\n| summarize by operation_Id\n| summarize makelist(operation_Id, 1000000));\nexceptions\n| where timestamp {TimeRange}\n| where operation_Id in (operations)\n| summarize ['Failing Requests'] = count() by ['Exception'] = type\n| top 4 by ['Failing Requests'] desc\n", + "size": 1, + "title": "Top Exceptions", + "noDataMessage": "No exceptions found.", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Failing Requests", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + }, + { + "columnMatch": "Impacted Users", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "orange" + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "query - 13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\r\nlet operation = tostring(row.Operation);\r\nlet app = tostring(row.App);\r\nlet operations = toscalar(requests\r\n| where timestamp {TimeRange}\r\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\r\n| summarize by operation_Id\r\n| summarize makelist(operation_Id, 1000000));\r\ndependencies\r\n| where timestamp {TimeRange}\r\n| where operation_Id in (operations)\r\n| where success == false\r\n| summarize ['Failing Dependencies'] = count() by ['Dependency'] = name\r\n| top 4 by ['Failing Dependencies'] desc\r\n", + "size": 0, + "title": "Top Failing Dependencies", + "noDataMessage": "No failed dependencies found.", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Failing Dependencies", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "query - 15" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Failures/Workbooks/Failure Insights/settings.json b/Failures/Workbooks/Failure Insights/settings.json new file mode 100644 index 0000000..2816eb7 --- /dev/null +++ b/Failures/Workbooks/Failure Insights/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Failure Analysis", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.insights/components", "order": 100 }] +} \ No newline at end of file diff --git a/Failures/Workbooks/New Failures Analysis/New Failures Analysis.workbook b/Failures/Workbooks/New Failures Analysis/New Failures Analysis.workbook new file mode 100644 index 0000000..2a002f2 --- /dev/null +++ b/Failures/Workbooks/New Failures Analysis/New Failures Analysis.workbook @@ -0,0 +1,469 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# New Failures Analysis\nThis workbook will help you identify any new failures that may have begun in your app. It looks at your app's failures from three telemetry sources:\n* Requests served by app\n* Exceptions in your app\n* Dependency calls made by you app\n\nThe report provides you with a bunch of information to help you triage and diagnose these new issues. Use it in conjunction with the Failure report in App Insights to understand the failures in your app." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "84caf619-7585-48e0-a9c3-85c364aaa13b", + "version": "KqlParameterItem/1.0", + "name": "Show", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(x:string, y:string)[\r\n\"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\", 'New and Existing Failures',\r\n\"['New Failure Rate (%)']\", 'Only New Failures',\r\n\"['Existing Failure Rate (%)']\", 'Only Existing Failures',\r\n]", + "value": "['New Failure Rate (%)'], ['Existing Failure Rate (%)']" + }, + { + "id": "6ab5c1cb-bad0-4d96-8e63-d439d0681c6e", + "version": "KqlParameterItem/1.0", + "name": "In", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "requests\n| where timestamp >= ago(1d)\n| summarize Count = count() by operation_Name\n| order by Count desc\n| project v = operation_Name, t = operation_Name, s = false\n| union (datatable(v:string, t:string, s:boolean)[\n'*', 'All Operations', true\n])" + }, + { + "id": "eac9cbf1-6364-4f28-9c61-a9b038c035d7", + "version": "KqlParameterItem/1.0", + "name": "OverTimeRange", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(value:string, text:string)[\r\n'30m', 'Last 30 minutes', \r\n'1h', 'Last hour', \r\n'2h', 'Last 2 hours', \r\n'4h', 'Last 4 hours', \r\n'24h', 'Last 24 hours', \r\n'2d', 'Last 2 days',\r\n'3d', 'Last 3 days',\r\n'7d', 'Last 7 days',\r\n'14d', 'Last 14 days',\r\n'28d', 'Last 28 days',\r\n]", + "value": "24h" + }, + { + "id": "03c0d4b0-299d-4bea-b9ca-b96bb3237f0d", + "version": "KqlParameterItem/1.0", + "name": "WithGrain", + "type": 1, + "description": null, + "isRequired": true, + "query": "let t = totimespan({OverTimeRange});\r\nlet w = case(t == 30m, '30s', t == 1h, '1m', t == 2h, '1m', t == 4h, '5m', t == 24h, '30m', t == 2d, '1h', t == 3d, '2h', t >= 7d, '1d', '1h');\r\nrange i from 1 to 1 step 1\r\n| project x = w" + }, + { + "id": "6f0de137-0136-48f0-b463-640de7109c05", + "version": "KqlParameterItem/1.0", + "name": "UseComparisonTimeRangeOf", + "type": 1, + "description": null, + "isRequired": true, + "query": "let t = totimespan({OverTimeRange});\r\nlet w = case(t <= 1d, '7d', t <= 3d, '14d', t <= 14d, '28d', '60d');\r\nrange i from 1 to 1 step 1\r\n| project x = w" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "---\n## Request Failures Analysis\n" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "7a6716e6-3b5d-426b-a091-76e25325563a", + "version": "KqlParameterItem/1.0", + "name": "RequestFilters", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let timeRange = {OverTimeRange};\r\nrequests\r\n| where timestamp >= ago(timeRange)\r\n| where operation_Name in ({In}) or '*' in ({In})\r\n| summarize Count = count(), Users = dcount(user_Id) by name\r\n| project v = name, t = name, s=false\r\n| union (datatable(v:string, t:string, s:boolean)[\r\n'*', 'All Requests', true\r\n])" + }, + { + "id": "fa3ae272-8e65-4b87-a5a6-ef256a8a1956", + "version": "KqlParameterItem/1.0", + "name": "IncludeResultCodes", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "datatable(x:string, y:string, z:boolean)[\r\n'*', 'All', true,\r\n'@', 'All 500s', false,\r\n'#', 'All 400s', false\r\n]\r\n| union (requests\r\n| where timestamp >= ago({OverTimeRange})\r\n| where success == false\r\n| summarize by resultCode\r\n| order by resultCode asc\r\n| project x = resultCode, y = resultCode, z = false)", + "isHiddenWhenLocked": false + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### Failures Rates\nThis section will help you see how your request failure rates change over time -- segmented by new vs. existing failures." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {OverTimeRange};\nlet grain = {WithGrain};\nlet bigWindowTimeRange = {UseComparisonTimeRangeOf};\nlet existingFailures = requests\n| where timestamp >= ago(bigWindowTimeRange) and timestamp < bin(ago(timeRange), grain)\n| where operation_Name in ({In}) or '*' in ({In})\n| where name in ({RequestFilters}) or '*' in ({RequestFilters})\n| where resultCode in ({IncludeResultCodes}) or '*' in ({IncludeResultCodes}) or iff('@' in ({IncludeResultCodes}), resultCode startswith '5', false) or iff('#' in ({IncludeResultCodes}), resultCode startswith '4', false)\n| extend Key = strcat(name, '-', resultCode)\n| summarize makeset(Key, 10000);\nrequests\n| where timestamp >= bin(ago(timeRange), grain)\n| where operation_Name in ({In}) or '*' in ({In})\n| where name in ({RequestFilters}) or '*' in ({RequestFilters})\n| extend IncludeInFailures = resultCode in ({IncludeResultCodes}) or '*' in ({IncludeResultCodes}) or iff('@' in ({IncludeResultCodes}), resultCode startswith '5', false) or iff('#' in ({IncludeResultCodes}), resultCode startswith '4', false)\n| extend Key = strcat(name, '-', resultCode)\n| summarize NewFailures = countif(success == false and Key !in (existingFailures) and IncludeInFailures), ExistingFailures = countif(success == false and Key in (existingFailures) and IncludeInFailures), All = count() by bin(timestamp, grain)\n| project timestamp, ['New Failure Rate (%)'] = 100.0 * NewFailures / All, ['Existing Failure Rate (%)'] = 100.0 * ExistingFailures / All\n| project timestamp, {Show}", + "showQuery": false, + "size": 0, + "aggregation": 2, + "showAnnotations": true, + "visualization": "barchart" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### Requests Volume\nThis chart shows you request volumes or load over time. Changes in volume can impact failures and performance. This data will set the context in which any failures have occured." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {OverTimeRange};\nlet grain = {WithGrain};\nlet bigWindowTimeRange = {UseComparisonTimeRangeOf};\nlet existingFailures = requests\n| where timestamp >= ago(bigWindowTimeRange) and timestamp < bin(ago(timeRange), grain)\n| where operation_Name in ({In}) or '*' in ({In})\n| where name in ({RequestFilters}) or '*' in ({RequestFilters})\n| extend Key = strcat(name, '-', resultCode)\n| summarize makeset(Key, 10000);\nrequests\n| where timestamp >= bin(ago(timeRange), grain)\n| where operation_Name in ({In}) or '*' in ({In})\n| where name in ({RequestFilters}) or '*' in ({RequestFilters})\n| extend IncludeAsFailure = resultCode in ({IncludeResultCodes}) or '*' in ({IncludeResultCodes}) or iff('@' in ({IncludeResultCodes}), resultCode startswith '5', false) or iff('#' in ({IncludeResultCodes}), resultCode startswith '4', false)\n| extend Key = strcat(name, '-', resultCode)\n| summarize NewFailures = countif(success == false and Key !in (existingFailures) and IncludeAsFailure == true), ExistingFailures = countif(success == false and Key in (existingFailures) and IncludeAsFailure), All = count() by bin(timestamp, grain)\n| project timestamp, ['Passing'] = All - NewFailures - ExistingFailures, ['Existing Failures'] = ExistingFailures, ['New Failures'] = NewFailures", + "showQuery": false, + "size": 1, + "aggregation": 2, + "showAnnotations": true, + "visualization": "barchart" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Request Details\nThis table shows all failing requests in your app and their result codes - sorted by users impacted. This information will help you know the various failures in your app and their severity. The report also indicates if a failure is new or existing - so you see failures just started happening -- usually the most interesting ones." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "\n🔸 New Failure 🔹 Existing Failure" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {OverTimeRange};\nlet grain = {WithGrain};\nlet bigWindowTimeRange = {UseComparisonTimeRangeOf};\nlet bigWindow = requests\n| where timestamp >= ago(bigWindowTimeRange) and timestamp < bin(ago(timeRange), grain)\n| where success == false\n| where operation_Name in ({In}) or '*' in ({In})\n| where name in ({RequestFilters}) or '*' in ({RequestFilters})\n| where resultCode in ({IncludeResultCodes}) or '*' in ({IncludeResultCodes}) or iff('@' in ({IncludeResultCodes}), resultCode startswith '5', false) or iff('#' in ({IncludeResultCodes}), resultCode startswith '4', false)\n| summarize by name, resultCode\n| summarize makelist(strcat(name, '-', resultCode), 10000);\nrequests\n| where timestamp >= ago(timeRange)\n| where operation_Name in ({In}) or '*' in ({In})\n| where name in ({RequestFilters}) or '*' in ({RequestFilters})\n| where resultCode in ({IncludeResultCodes}) or '*' in ({IncludeResultCodes}) or iff('@' in ({IncludeResultCodes}), resultCode startswith '5', false) or iff('#' in ({IncludeResultCodes}), resultCode startswith '4', false)\n| where success == false\n| summarize Count = count(), Users = dcount(user_Id) by name, resultCode\n| extend IsNew = strcat(name, '-', resultCode) !in (bigWindow)\n| where \"{Show}\" == \"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\" or IsNew == true\n| order by Users desc, Count desc, name asc\n| project ['Request Name'] = iff(IsNew, strcat('🔸 ', name), strcat('🔹 ', name)), ['Failed with Result Code'] = resultCode, ['Request Failures'] = Count, ['Users Affected'] = Users", + "showQuery": false, + "size": 0, + "aggregation": 2, + "showAnnotations": false, + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Request Failures", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "yellow" + } + }, + { + "columnMatch": "Users Affected", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "---\n## Exceptions Analysis\n" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "481f99f9-eec9-453b-a342-064a91cc4ed6", + "version": "KqlParameterItem/1.0", + "name": "ProblemFilter", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let timeRange = {OverTimeRange};\r\nexceptions\r\n| where timestamp >= ago(timeRange)\r\n| where operation_Name in ({In}) or '*' in ({In})\r\n| summarize Count = count() by problemId\r\n| order by Count desc\r\n| project v = problemId, t = problemId, s=false\r\n| union (datatable(v:string, t:string, s:boolean)[\r\n'*', 'All Exceptions', true\r\n])" + }, + { + "id": "8b14a6a5-f37a-46f9-8438-cef1349478b2", + "version": "KqlParameterItem/1.0", + "name": "Source", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(x:string, y:string)[\r\n'1 == 1', 'Server and Client Exceptions',\r\n'client_Type <> \"Browser\"', 'Only Server Exceptions',\r\n'client_Type == \"Browser\"', 'Only Client Exceptions',\r\n]", + "isHiddenWhenLocked": false, + "value": "1 == 1" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### Exception Trends" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {OverTimeRange};\nlet grain = {WithGrain};\nlet bigWindowTimeRange = {UseComparisonTimeRangeOf};\nlet bigWindow = exceptions\n| where timestamp >= ago(bigWindowTimeRange) and timestamp < bin(ago(timeRange), grain)\n| where operation_Name in ({In}) or '*' in ({In})\n| where {Source}\n| where problemId in ({ProblemFilter}) or '*' in ({ProblemFilter})\n| summarize makeset(problemId, 10000);\nexceptions\n| where timestamp >= ago(timeRange)\n| where operation_Name in ({In}) or '*' in ({In})\n| where {Source}\n| summarize Count = count() by bin(timestamp, grain), problemId\n| where problemId in ({ProblemFilter}) or '*' in ({ProblemFilter})\n| extend IsNew = problemId !in (bigWindow)\n| where \"{Show}\" == \"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\" or IsNew\n| project timestamp, problemId, Count\n", + "showQuery": false, + "size": 0, + "aggregation": 2, + "showAnnotations": true, + "visualization": "barchart" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### Exception Details\nThis table shows all exceptions in your app and related operation - sorted by users impacted. This information will help you know the various errors in your app and their severity. The report also indicates if an exception is new or existing - so you see exceptions that just started happening -- usually the most interesting ones." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "\n🔸 New Exception 🔹 Existing Exception" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {OverTimeRange};\nlet bigWindowTimeRange = {UseComparisonTimeRangeOf};\nlet grain = {WithGrain};\nlet bigWindow = exceptions\n| where timestamp >= ago(bigWindowTimeRange) and timestamp < bin(ago(timeRange), grain)\n| where operation_Name in ({In}) or '*' in ({In})\n| where {Source}\n| where problemId in ({ProblemFilter}) or '*' in ({ProblemFilter})\n| summarize makeset(problemId, 10000);\nexceptions\n| where timestamp >= ago(timeRange)\n| where operation_Name in ({In}) or '*' in ({In})\n| where {Source}\n| summarize Count = count(), Users = dcount(user_Id) by problemId\n| where problemId in ({ProblemFilter}) or '*' in ({ProblemFilter})\n| extend IsNew = iff(problemId !in (bigWindow), true, false)\n| where \"{Show}\" == \"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\" or IsNew\n| order by Users desc, Count desc, problemId asc\n| project Problem = iff(IsNew, strcat('🔸 ', problemId), strcat('🔹 ', problemId)), ['Exception Count'] = Count, ['Users Affected'] = Users", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Exception Count", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "yellow" + } + }, + { + "columnMatch": "Users Affected", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "---\n## Dependency Failure Analysis\n" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "42490f33-2004-4535-8e9f-69ede57f2542", + "version": "KqlParameterItem/1.0", + "name": "DependencyFilters", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let timeRange = {OverTimeRange};\r\ndependencies\r\n| where timestamp >= ago(timeRange)\r\n| where operation_Name in ({In}) or '*' in ({In})\r\n| summarize Count = count() by name\r\n| order by Count desc\r\n| project v = name, t = name, s=false\r\n| union (datatable(v:string, t:string, s:boolean)[\r\n'*', 'All Dependencies', true\r\n])" + }, + { + "id": "ac2d6138-9403-41fc-a29c-99857071abc9", + "version": "KqlParameterItem/1.0", + "name": "IncludeResultCodes", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "datatable(x:string, y:string, z:boolean)[\r\n'*', 'All', true,\r\n'@', 'All 500s', false,\r\n'#', 'All 400s', false\r\n]\r\n| union (dependencies\r\n| where timestamp >= ago({OverTimeRange})\r\n| where success == false\r\n| summarize by resultCode\r\n| order by resultCode asc\r\n| project x = resultCode, y = resultCode, z = false)", + "isHiddenWhenLocked": false + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### Failure Rates\nThis section will help you see how your dependency failure rates change over time -- segmented by new vs. existing failures." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {OverTimeRange};\nlet grain = {WithGrain};\nlet bigWindowTimeRange = {UseComparisonTimeRangeOf};\nlet existingFailures = dependencies\n| where timestamp >= ago(bigWindowTimeRange) and timestamp < bin(ago(timeRange), grain)\n| where operation_Name in ({In}) or '*' in ({In})\n| where name in ({RequestFilters}) or '*' in ({RequestFilters})\n| extend Key = strcat(name, '-', resultCode)\n| summarize makeset(Key, 10000);\ndependencies\n| where timestamp >= bin(ago(timeRange), grain)\n| where operation_Name in ({In}) or '*' in ({In})\n| where name in ({RequestFilters}) or '*' in ({RequestFilters})\n| extend IncludeAsFailure = resultCode in ({IncludeResultCodes}) or '*' in ({IncludeResultCodes}) or iff('@' in ({IncludeResultCodes}), resultCode startswith '5', false) or iff('#' in ({IncludeResultCodes}), resultCode startswith '4', false)\n| extend Key = strcat(name, '-', resultCode)\n| summarize NewFailures = countif(success == false and Key !in (existingFailures) and IncludeAsFailure), ExistingFailures = countif(success == false and Key in (existingFailures) and IncludeAsFailure), All = count() by bin(timestamp, grain)\n| project timestamp, ['New Failure Rate (%)'] = 100.0 * NewFailures / All, ['Existing Failure Rate (%)'] = 100.0 * ExistingFailures / All\n| project timestamp, {Show}", + "showQuery": false, + "size": 0, + "aggregation": 2, + "showAnnotations": true, + "visualization": "barchart" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### Dependency Volume\nThis chart shows you request volumes or load over time. Changes in volume can impact failures and performance. This data will set the context in which any failures have occured." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {OverTimeRange};\nlet grain = {WithGrain};\nlet bigWindowTimeRange = {UseComparisonTimeRangeOf};\nlet existingFailures = dependencies\n| where timestamp >= ago(bigWindowTimeRange) and timestamp < bin(ago(timeRange), grain)\n| where operation_Name in ({In}) or '*' in ({In})\n| where name in ({RequestFilters}) or '*' in ({RequestFilters})\n| extend Key = strcat(name, '-', resultCode)\n| summarize makeset(Key, 10000);\ndependencies\n| where timestamp >= bin(ago(timeRange), grain)\n| where operation_Name in ({In}) or '*' in ({In})\n| where name in ({RequestFilters}) or '*' in ({RequestFilters})\n| extend IncludeAsFailure = resultCode in ({IncludeResultCodes}) or '*' in ({IncludeResultCodes}) or iff('@' in ({IncludeResultCodes}), resultCode startswith '5', false) or iff('#' in ({IncludeResultCodes}), resultCode startswith '4', false)\n| summarize NewFailures = countif(success == false and strcat(name, '-', resultCode) !in (existingFailures) and IncludeAsFailure == true), ExistingFailures = countif(success == false and strcat(name, '-', resultCode) in (existingFailures) and IncludeAsFailure == true), All = count() by bin(timestamp, grain)\n| project timestamp, ['Passing'] = All - NewFailures - ExistingFailures, ['Existing Failures'] = ExistingFailures, ['New Failures'] = NewFailures", + "showQuery": false, + "size": 1, + "aggregation": 2, + "showAnnotations": true, + "visualization": "barchart" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### Dependency Details\nThis table shows all failing dependencies in your app and their result codes - sorted by users impacted. This information will help you know the various failures in your app and their severity. The report also indicates if a failure is new or existing - so you see failures just started happening -- usually the most interesting ones." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {OverTimeRange};\r\nlet bigWindowTimeRange = {UseComparisonTimeRangeOf};\r\nlet grain = {WithGrain};\r\nlet bigWindow = dependencies\r\n| where timestamp >= ago(bigWindowTimeRange) and timestamp < bin(ago(timeRange), grain)\r\n| where operation_Name in ({In}) or '*' in ({In})\r\n| where name in ({DependencyFilters}) or '*' in ({DependencyFilters})\r\n| where resultCode in ({IncludeResultCodes}) or '*' in ({IncludeResultCodes}) or iff('@' in ({IncludeResultCodes}), resultCode startswith '5', false) or iff('#' in ({IncludeResultCodes}), resultCode startswith '4', false)\r\n| where success == false\r\n| summarize by name, resultCode\r\n| summarize makelist(strcat(name, '-', resultCode));\r\ndependencies\r\n| where timestamp >= ago(timeRange)\r\n| where operation_Name in ({In}) or '*' in ({In})\r\n| where name in ({DependencyFilters}) or '*' in ({DependencyFilters})\r\n| where resultCode in ({IncludeResultCodes}) or '*' in ({IncludeResultCodes}) or iff('@' in ({IncludeResultCodes}), resultCode startswith '5', false) or iff('#' in ({IncludeResultCodes}), resultCode startswith '4', false)\r\n| where success == false\r\n| summarize Count = count(), Users = dcount(user_Id) by name, resultCode, operation_Name\r\n| extend IsNew = iff(strcat(name, '-', resultCode) !in (bigWindow), true, false)\r\n| where \"{Show}\" == \"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\" or IsNew == true\r\n| order by Users desc, Count desc, name asc\r\n| project ['Dependency Name'] = iff(IsNew == true, strcat('🔸 ', name), strcat('🔹 ', name)), ['Failed with Result Code'] = resultCode, Operation = operation_Name, ['Dependency Failures'] = Count, ['Users Affected'] = Users", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Dependency Failures", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "yellow" + } + }, + { + "columnMatch": "Users Affected", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null, + "halfWidth": false + } + ] +} \ No newline at end of file diff --git a/Failures/Workbooks/New Failures Analysis/settings.json b/Failures/Workbooks/New Failures Analysis/settings.json new file mode 100644 index 0000000..a7d5c60 --- /dev/null +++ b/Failures/Workbooks/New Failures Analysis/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"New Failures Analysis", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.insights/components", "order": 200 }] +} \ No newline at end of file diff --git a/Failures/Workbooks/categoryResources.json b/Failures/Workbooks/categoryResources.json new file mode 100644 index 0000000..f80a0ce --- /dev/null +++ b/Failures/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Failure", "description": "", "order": 200} +} \ No newline at end of file diff --git a/HDInsight/Alerts/README b/HDInsight/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/HDInsight/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/HDInsight/Queries/README b/HDInsight/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/HDInsight/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/HDInsight/Workbooks/Workload-Specific/Kafka.workbook b/HDInsight/Workbooks/Workload-Specific/Kafka.workbook new file mode 100644 index 0000000..a2b5201 --- /dev/null +++ b/HDInsight/Workbooks/Workload-Specific/Kafka.workbook @@ -0,0 +1,513 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# HDInsight Kafka Insights" + }, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "741603f6-06d5-431c-b989-7e53c252cda7", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "value": "", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ], + "includeAll": true + } + }, + { + "id": "a810dcd0-f912-4926-9317-a20f24c7c5ce", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id", + "crossComponentResources": [ + "{Subscription}" + ], + "value": "", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "sub-workspace-parameters" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Workspace}" + ], + "parameters": [ + { + "id": "b40de967-6c19-43e8-a365-e31df5b16c42", + "version": "KqlParameterItem/1.0", + "name": "KafkaMetricsTableExists", + "type": 1, + "isRequired": true, + "query": "let hasNonEmptyTable = (T:string) \r\n{ \r\n toscalar( union isfuzzy=true ( table(T) | count as Count ), (print Count=0) | summarize sum(Count) ) > 0\r\n};\r\nprint tolower(hasNonEmptyTable(\"metrics_cluster_alerts_CL\"))", + "crossComponentResources": [ + "{Workspace}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "hidden_parameters" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "metrics_kafka_CL\r\n| where InstanceName_s == \"kafka-KafkaController-ActiveControllerCount-Value\" or InstanceName_s == \"kafka-ReplicaManager-LeaderCount-Value\" or InstanceName_s == \"kafka-ReplicaManager-PartitionCount-Value\" or InstanceName_s == \"kafka-ReplicaManager-UnderReplicatedPartitions-Value\" or InstanceName_s == \"kafka-KafkaController-OfflinePartitionsCount-Value\"\r\n| summarize arg_max(TimeGenerated, *) by InstanceName_s, HostName_s\r\n| summarize \r\nAggControllerCount=avg(kafka_KafkaController_ActiveControllerCount_Value_value_d), \r\nAggLeaderCount=avg(kafka_ReplicaManager_LeaderCount_Value_value_d),\r\nAggPartitionCount=avg(kafka_ReplicaManager_PartitionCount_Value_value_d),\r\nAggUnderReplicatedPartitionCount=avg(kafka_ReplicaManager_UnderReplicatedPartitions_Value_value_d),\r\nAggOfflinePartitionCount=avg(kafka_KafkaController_OfflinePartitionsCount_Value_value_d)\r\nby bin(TimeGenerated, 5m), ClusterName_s, HostName_s\r\n| summarize \r\nActiveControllerCount=sum(AggControllerCount),\r\nLeaderCount=sum(AggLeaderCount),\r\nPartitionCount=sum(AggLeaderCount),\r\nUnderReplicatedPartitionCount=sum(AggUnderReplicatedPartitionCount),\r\nOfflinePartitionCount=sum(AggOfflinePartitionCount)\r\nby ClusterName_s\r\n| join kind=leftouter (\r\n metrics_kafka_CL\r\n | where InstanceName_s == \"kafka-ReplicaManager-PartitionCount-Value\"\r\n | distinct HostName_s, ClusterName_s\r\n | summarize BrokerCount=count() by ClusterName_s\r\n) on ClusterName_s\r\n| extend first6 = substring(ClusterName_s, 0, 6)\r\n| join kind=leftouter (\r\n Perf\r\n | where ObjectName == \"Logical Disk\" and (CounterName == \"Free Megabytes\" or CounterName == \"% Free Space\") and InstanceName contains \"data_disk\" and Computer startswith_cs \"wn\"\r\n | summarize arg_max(TimeGenerated, *) by Computer, CounterName, InstanceName\r\n | extend PercentFree=iff(CounterName == \"% Free Space\", CounterValue, real(0)), FreeMegabytes=iff(CounterName == \"Free Megabytes\", CounterValue, real(0))\r\n | summarize PercentFree=sum(PercentFree), FreeMegabytes=sum(FreeMegabytes) by Computer, InstanceName\r\n | extend TotalMegabytes=round(FreeMegabytes / PercentFree * 100)\r\n | extend first6 = trim_start(\".*-\", Computer)\r\n | summarize FreeMegabytesPerCluster = sum(FreeMegabytes), TotalMegabytesPerCluster = sum(TotalMegabytes) by first6\r\n | extend DiskPercentFree = round(FreeMegabytesPerCluster/TotalMegabytesPerCluster*100)\r\n) on first6\r\n| project Name=ClusterName_s, ActiveControllerCount, DiskPercentFree, PartitionsPerBroker=round(PartitionCount/BrokerCount), PartitionCount, UnderReplicatedPartitionCount, OfflinePartitionCount, LeaderCount\r\n\r\n", + "size": 3, + "aggregation": 5, + "title": "Kafka clusters overview - current status", + "color": "blue", + "noDataMessage": "No HDInsight Kafka clusters found linked to this workspace.", + "timeContext": { + "durationMs": 1800000 + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DiskPercentFree", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "redGreen", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "ActiveControllerCount", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "!=", + "thresholdValue": "1", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "LeaderCount", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "PartitionsPerBroker", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 4000, + "palette": "greenRed", + "showIcon": true + } + }, + { + "columnMatch": "PartitionCount", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "UnderReplicatedPartitionCount", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "OfflinePartitionCount", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "sortBy": [ + { + "itemKey": "$gen_heatmap_DiskPercentFree_2", + "sortOrder": 2 + } + ] + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "ClusterName_s", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "ClusterControllerCount", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "ClusterName_s", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "ClusterControllerCount", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "KafkaMetricsTableExists", + "comparison": "isEqualTo", + "value": "true" + }, + "customWidth": "100", + "showPin": true, + "name": "clusters-grid" + }, + { + "type": 1, + "content": { + "json": "## metrics_kafka_CL table not found\r\nEnsure you have at least 1 HDInsight Kafka cluster with Azure Monitor Logs integration enabled and linked to this workspace. See the documentation, Use Azure Monitor logs to monitor HDInsight clusters." + }, + "conditionalVisibility": { + "parameterName": "KafkaMetricsTableExists", + "comparison": "isEqualTo", + "value": "false" + }, + "name": "text - 10" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Workspace}" + ], + "parameters": [ + { + "id": "c43a8974-87d7-49ab-ace0-c15e4e5ec6ca", + "version": "KqlParameterItem/1.0", + "name": "Clusters", + "label": "Cluster(s)", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "metrics_kafka_CL\r\n| summarize by ClusterName_s", + "crossComponentResources": [ + "{Workspace}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "" + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6609fb2f-e23e-4c52-a0dd-c4ce30d9a145", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 2592000000 + } + ], + "allowCustom": true + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "graph-parameters" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "metrics_kafka_CL\r\n| where iff(\"{Clusters}\" == \"\", true, ClusterName_s in ({Clusters}))\r\n| where InstanceName_s == \"kafka-BrokerTopicMetrics-MessagesInPerSec-Count\"\r\n| summarize AggregatedValue = avg(kafka_BrokerTopicMetrics_MessagesInPerSec_Count_value_d) by ClusterName_s, HostName_s, bin(TimeGenerated, 1m)\r\n| summarize IncomingBytesPerSec=sum(AggregatedValue) by TimeGenerated, ClusterName_s\r\n| where TimeGenerated < ago(3m)\r\n| order by TimeGenerated desc", + "size": 0, + "aggregation": 5, + "title": "Incoming messages per second by cluster", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": { + "parameterName": "KafkaMetricsTableExists", + "comparison": "isEqualTo", + "value": "true" + }, + "customWidth": "50", + "showPin": true, + "name": "incoming-messages" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let Clusters = \"{Clusters}\";\r\nlet oneClusterSelected = indexof(Clusters, \",\") == -1;\r\nlet multipleClusters =\r\nPerf\r\n| extend first6 = trim_start(\".*-\", Computer)\r\n| where indexof(Clusters, first6) >= 0\r\n| where ObjectName == \"Logical Disk\" and CounterName == \"Free Megabytes\" and InstanceName contains \"data_disk\" and Computer startswith_cs \"wn\"\r\n| extend internalRG = extract(\"resourcegroups/(.*?)/\", 1, _ResourceId)\r\n//| extend clusterNameStartIndex=indexof(Clusters, first6)\r\n//| extend clusterName=substring(Clusters, clusterNameStartIndex, indexof(Clusters,\",\",clusterNameStartIndex)-clusterNameStartIndex)\r\n| summarize AggFreeMemoryPerDisk = avg(CounterValue) by bin(TimeGenerated, 1m), Computer, InstanceName, internalRG, first6\r\n| summarize FreeMemoryPerNode = sum(AggFreeMemoryPerDisk) by TimeGenerated, Computer, internalRG, first6\r\n| summarize FreeMemory = sum(FreeMemoryPerNode)/1000 by TimeGenerated, internalRG, first6\r\n| project-rename Name=first6;\r\nlet oneCluster =\r\nPerf\r\n| extend first6 = trim_start(\".*-\", Computer)\r\n| where indexof(Clusters, first6) >= 0\r\n| where ObjectName == \"Logical Disk\" and CounterName == \"Free Megabytes\" and InstanceName contains \"data_disk\" and Computer startswith_cs \"wn\"\r\n| summarize AggFreeMemoryPerDisk = avg(CounterValue) by bin(TimeGenerated, 1m), Computer, InstanceName\r\n| summarize FreeMemory = sum(AggFreeMemoryPerDisk)/1000 by TimeGenerated, Computer\r\n| project-rename Name=Computer;\r\nunion (oneCluster | where oneClusterSelected == true), (multipleClusters | where oneClusterSelected == false)\r\n| where TimeGenerated < ago(3m)\r\n| sort by TimeGenerated desc, Name asc", + "size": 0, + "aggregation": 5, + "title": "Disk usage - free GB", + "noDataMessage": "To see disk usage data, enable the \"Logical Disk(*)\\% Free Space\" and \"Logical Disk(*)\\Free Megabytes\" Linux performance counters. See instructions here: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-performance-counters See instructions here.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": { + "parameterName": "KafkaMetricsTableExists", + "comparison": "isEqualTo", + "value": "true" + }, + "customWidth": "50", + "showPin": true, + "name": "disk-usage" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "c41fe94e-118f-4e1d-a911-f3572db78ea2", + "version": "KqlParameterItem/1.0", + "name": "Units", + "type": 2, + "isRequired": true, + "value": "1000000", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\"label\": \"B\", \"value\": 1},\r\n {\"label\": \"KB\", \"value\": 1000},\r\n {\"label\": \"MB\", \"value\": 1000000},\r\n {\"label\": \"GB\", \"value\": 1000000000}\r\n]" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "metrics_kafka_CL\r\n| where iff(\"{Clusters}\" == \"\", true, ClusterName_s in ({Clusters}))\r\n| where InstanceName_s == \"kafka-BrokerTopicMetrics-BytesInPerSec-Count\"\r\n| summarize AggregatedValue = avg(kafka_BrokerTopicMetrics_BytesInPerSec_Count_value_d) by ClusterName_s, HostName_s, bin(TimeGenerated, 1m)\r\n| summarize IncomingBytesPerSec=sum(AggregatedValue)/toint('{Units}') by TimeGenerated, ClusterName_s\r\n| where TimeGenerated < ago(3m)\r\n| order by TimeGenerated desc", + "size": 0, + "aggregation": 5, + "title": "Incoming data per second by cluster", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "timechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "ClusterName_s", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "IncomingBytesPerSec", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "KafkaMetricsTableExists", + "comparison": "isEqualTo", + "value": "true" + }, + "customWidth": "50", + "showPin": true, + "name": "incoming-data" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "metrics_kafka_CL\r\n| where iff(\"{Clusters}\" == \"\", true, ClusterName_s in ({Clusters}))\r\n| where InstanceName_s == \"kafka-BrokerTopicMetrics-BytesOutPerSec-Count\"\r\n| summarize AggregatedValue = avg(kafka_BrokerTopicMetrics_BytesOutPerSec_Count_value_d) by ClusterName_s, HostName_s, bin(TimeGenerated, 1m)\r\n| summarize IncomingBytesPerSec=sum(AggregatedValue)/toint('{Units}') by TimeGenerated, ClusterName_s\r\n| where TimeGenerated < ago(3m)\r\n| order by TimeGenerated desc", + "size": 0, + "aggregation": 5, + "title": "Outgoing data per second by cluster", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "linechart" + }, + "conditionalVisibility": { + "parameterName": "KafkaMetricsTableExists", + "comparison": "isEqualTo", + "value": "true" + }, + "customWidth": "50", + "showPin": true, + "name": "outgoing-data" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/HDInsight/Workbooks/Workload-Specific/settings.json b/HDInsight/Workbooks/Workload-Specific/settings.json new file mode 100644 index 0000000..f89305c --- /dev/null +++ b/HDInsight/Workbooks/Workload-Specific/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"HDInsight Kafka Insights", + "author": "Microsoft", + "isPreview": true, + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "order": 100 }] +} \ No newline at end of file diff --git a/HDInsight/Workbooks/categoryResources.json b/HDInsight/Workbooks/categoryResources.json new file mode 100644 index 0000000..bbd518a --- /dev/null +++ b/HDInsight/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"HDInsight", "description": "", "order": 100} +} \ No newline at end of file diff --git a/Individual Storage/Alerts/README b/Individual Storage/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Individual Storage/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Individual Storage/Queries/README b/Individual Storage/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Individual Storage/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Individual Storage/Workbooks/Availability/Availability.workbook b/Individual Storage/Workbooks/Availability/Availability.workbook new file mode 100644 index 0000000..340040c --- /dev/null +++ b/Individual Storage/Workbooks/Availability/Availability.workbook @@ -0,0 +1,677 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "487a9f92-5350-4eec-8d68-15bdf2470550", + "version": "KqlParameterItem/1.0", + "name": "StorageAccount", + "type": 5, + "isRequired": true, + "value": "value::1", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.storage/storageaccounts" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "resource param" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "d04c2e2c-b67c-4ae1-9b80-a36e27310200", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "description": "The time range to analyze", + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + } + ], + "allowCustom": true + } + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.storage/storageaccounts" + }, + "name": "Availability params", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 10, + "content": { + "chartId": "workbook874420eb-4632-4961-9fb9-b29ef76d947b", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": 0, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Availability", + "aggregation": 4, + "splitBy": null, + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-Availability", + "aggregation": 4, + "splitBy": null, + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-Availability", + "aggregation": 4, + "splitBy": null, + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-Availability", + "aggregation": 4, + "splitBy": null, + "splitBySortOrder": -1, + "splitByLimit": 5, + "columnName": "" + }, + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-Availability", + "aggregation": 4, + "splitBy": null, + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "Metric", + "formatter": 1 + }, + { + "columnMatch": "Aggregation", + "formatter": 1 + }, + { + "columnMatch": "Segment Field", + "formatter": 5 + }, + { + "columnMatch": "Segment", + "formatter": 1 + }, + { + "columnMatch": "Value", + "formatter": 1 + }, + { + "columnMatch": "Timeline", + "formatter": 9 + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource" + } + } + ], + "labelSettings": [] + }, + "gridFormatType": 1, + "filters": [] + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "Latency Summary" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"5fb793f8-8e9d-4ba8-98b1-42243ea47051\",\"mergeType\":\"table\",\"leftTable\":\"Latency Summary\"}],\"projectRename\":[{\"originalName\":\"[Latency Summary].Subscription\",\"mergedName\":\"Subscription\"},{\"originalName\":\"[Latency Summary].Name\",\"mergedName\":\"Name\"},{\"originalName\":\"[Latency Summary].Namespace\",\"mergedName\":\"Namespace\"},{\"originalName\":\"[Latency Summary].Metric\",\"mergedName\":\"Metric\"},{\"originalName\":\"[Latency Summary].Aggregation\",\"mergedName\":\"Aggregation\"},{\"originalName\":\"[Latency Summary].Segment Field\",\"mergedName\":\"Segment Field\"},{\"originalName\":\"[Latency Summary].Segment\",\"mergedName\":\"Segment\"},{\"originalName\":\"[Latency Summary].Value\",\"mergedName\":\"Value\"},{\"originalName\":\"[Latency Summary].Timeline\",\"mergedName\":\"Timeline\"},{\"originalName\":\"[Latency Summary].Metric ID\",\"mergedName\":\"Metric ID\",\"fromId\":\"unknown\"}]}", + "size": 3, + "queryType": 7, + "resourceType": "microsoft.storage/storageaccounts", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Namespace", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 90, + "max": 99, + "palette": "redGreen", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + "showBorder": false + } + }, + "name": "Availability tiles" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"AzureHealthQuery/1.0\",\"queryType\":\"Detailed\"}", + "size": 4, + "title": "Storage health", + "queryType": 4, + "resourceType": "microsoft.storage/storageaccounts", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Availability state", + "formatter": 11, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "resourceHealth", + "showIcon": true + } + }, + { + "columnMatch": "Detailed status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Occurred time", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Reason chronicity", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Reason type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Reported time", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Summary", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Title", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Resource group", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "labelSettings": [] + } + }, + "name": "Health data", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 10, + "content": { + "chartId": "workbooka9383621-f16a-494c-95ae-f1a2355f6403", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": 0, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-Availability", + "aggregation": 4, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 25 + }, + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-Availability", + "aggregation": 4, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-Availability", + "aggregation": 4, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-Availability", + "aggregation": 4, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Namespace", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "labelSettings": [] + }, + "gridFormatType": 1, + "filters": [] + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "Availability data" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"3a881a4c-d5e3-4b9f-a456-eaf698410068\",\"mergeType\":\"table\",\"leftTable\":\"Availability data\"}],\"projectRename\":[{\"originalName\":\"[Availability data].Subscription\",\"mergedName\":\"Subscription\"},{\"originalName\":\"[Availability data].Name\",\"mergedName\":\"Name\"},{\"originalName\":\"[Availability data].Namespace\",\"mergedName\":\"Namespace\"},{\"originalName\":\"[Availability data].Metric\",\"mergedName\":\"Metric\"},{\"originalName\":\"[Availability data].Aggregation\",\"mergedName\":\"Aggregation\"},{\"originalName\":\"[Availability data].Segment Field\",\"mergedName\":\"Segment Field\"},{\"originalName\":\"[Availability data].Segment\",\"mergedName\":\"Segment\"},{\"originalName\":\"[Availability data].Value\",\"mergedName\":\"Availability (%)\"},{\"originalName\":\"[Availability data].Timeline\",\"mergedName\":\"Timeline\"}]}", + "size": 0, + "title": "Availability by API name", + "queryType": 7, + "resourceType": "microsoft.storage/storageaccounts", + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Namespace", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "min": 90, + "max": 99, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Availability (%)", + "formatter": 18, + "formatOptions": { + "min": 90, + "max": 99, + "palette": "redGreen", + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "is Empty", + "representation": "Blank", + "text": "-" + }, + { + "operator": "<", + "thresholdValue": "90", + "representation": "4", + "text": "{0}{1}" + }, + { + "operator": "<", + "thresholdValue": "99", + "representation": "warning", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ], + "aggregation": "Min" + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + } + ], + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Namespace" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "labelSettings": [] + } + }, + "customWidth": "50", + "showPin": true, + "name": "Availability by API name" + }, + { + "type": 10, + "content": { + "chartId": "workbookf8b2fd31-6a56-41d6-b143-358bded2752b", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-Availability", + "aggregation": 4, + "splitBy": null, + "columnName": "Blob availability" + }, + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-Availability", + "aggregation": 4, + "columnName": "File availability" + }, + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-Availability", + "aggregation": 4, + "columnName": "Queue availability" + }, + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-Availability", + "aggregation": 4, + "columnName": "Table availability" + } + ], + "title": "Availability trend", + "filters": [] + }, + "customWidth": "50", + "showPin": true, + "name": "Availability trend" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Individual Storage/Workbooks/Availability/settings.json b/Individual Storage/Workbooks/Availability/settings.json new file mode 100644 index 0000000..c659b64 --- /dev/null +++ b/Individual Storage/Workbooks/Availability/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Availability", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.storage/storageaccounts", "order": 400 }] +} \ No newline at end of file diff --git a/Individual Storage/Workbooks/Capacity/Capacity.workbook b/Individual Storage/Workbooks/Capacity/Capacity.workbook new file mode 100644 index 0000000..70680fe --- /dev/null +++ b/Individual Storage/Workbooks/Capacity/Capacity.workbook @@ -0,0 +1,316 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "487a9f92-5350-4eec-8d68-15bdf2470550", + "version": "KqlParameterItem/1.0", + "name": "StorageAccount", + "type": 5, + "isRequired": true, + "value": "value::1", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.storage/storageaccounts" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "resource param" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "d04c2e2c-b67c-4ae1-9b80-a36e27310200", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + } + ], + "allowCustom": true + }, + "label": "Time Range" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.storage/storageaccounts" + }, + "name": "Capacity params", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 10, + "content": { + "chartId": "workbook874420eb-4632-4961-9fb9-b29ef76d947b", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Capacity-UsedCapacity", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity", + "aggregation": 4 + }, + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity", + "aggregation": 4 + }, + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity", + "aggregation": 4 + }, + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity", + "aggregation": 4 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "Metric", + "formatter": 1 + }, + { + "columnMatch": "Aggregation", + "formatter": 1 + }, + { + "columnMatch": "Segment Field", + "formatter": 5 + }, + { + "columnMatch": "Segment", + "formatter": 1 + }, + { + "columnMatch": "Value", + "formatter": 1 + }, + { + "columnMatch": "Timeline", + "formatter": 9 + } + ] + }, + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Namespace", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "Metric", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "purpleBlueGreen", + "showIcon": true + }, + "numberFormat": { + "unit": 36, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + "showBorder": false + }, + "filters": [] + }, + "name": "Capacity Summary", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 10, + "content": { + "chartId": "workbook175d3b32-6968-45c4-a01a-2958cbb0a7d7", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity", + "aggregation": 4, + "splitBy": null, + "columnName": "" + }, + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity", + "aggregation": 4 + }, + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity", + "aggregation": 4 + }, + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity", + "aggregation": 4 + } + ], + "title": "Storage capacity", + "filters": [] + }, + "customWidth": "50", + "showPin": true, + "name": "Storage capacity" + }, + { + "type": 10, + "content": { + "chartId": "workbook175d3b32-6968-45c4-a01a-2958cbb0a7d7", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCount", + "aggregation": 4, + "splitBy": null, + "columnName": "" + }, + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCount", + "aggregation": 4 + }, + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCount", + "aggregation": 4 + }, + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCount", + "aggregation": 4 + } + ], + "title": "Storage units", + "filters": [] + }, + "customWidth": "50", + "showPin": true, + "name": "Storage units" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Individual Storage/Workbooks/Capacity/settings.json b/Individual Storage/Workbooks/Capacity/settings.json new file mode 100644 index 0000000..89f6658 --- /dev/null +++ b/Individual Storage/Workbooks/Capacity/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Capacity", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.storage/storageaccounts", "order": 500 }] +} \ No newline at end of file diff --git a/Individual Storage/Workbooks/Classic Storage Account/Classic Storage Account.workbook b/Individual Storage/Workbooks/Classic Storage Account/Classic Storage Account.workbook new file mode 100644 index 0000000..2bd1201 --- /dev/null +++ b/Individual Storage/Workbooks/Classic Storage Account/Classic Storage Account.workbook @@ -0,0 +1,14 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "


\r\n## Insights are not supported for Classic Storage Account. Go to Monitoring (classic)." + }, + "name": "text - 0" + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Individual Storage/Workbooks/Classic Storage Account/settings.json b/Individual Storage/Workbooks/Classic Storage Account/settings.json new file mode 100644 index 0000000..8a08aac --- /dev/null +++ b/Individual Storage/Workbooks/Classic Storage Account/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Classic Storage Account", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.classicstorage/storageaccounts", "order": 100 }] +} \ No newline at end of file diff --git a/Individual Storage/Workbooks/Failures/Failures.workbook b/Individual Storage/Workbooks/Failures/Failures.workbook new file mode 100644 index 0000000..9d79c6f --- /dev/null +++ b/Individual Storage/Workbooks/Failures/Failures.workbook @@ -0,0 +1,577 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "487a9f92-5350-4eec-8d68-15bdf2470550", + "version": "KqlParameterItem/1.0", + "name": "StorageAccount", + "type": 5, + "isRequired": true, + "value": "value::1", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.storage/storageaccounts" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "resource param" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "d04c2e2c-b67c-4ae1-9b80-a36e27310200", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + } + ], + "allowCustom": true + }, + "label": "Time Range" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.storage/storageaccounts" + }, + "name": "Failures params", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 10, + "content": { + "chartId": "workbook874420eb-4632-4961-9fb9-b29ef76d947b", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Transactions", + "aggregation": 1, + "splitBy": null, + "columnName": "Total Transactions" + } + ], + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "purpleBlueGreen", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "showBorder": false + }, + "filters": [] + }, + "customWidth": "15", + "name": "Total transactions" + }, + { + "type": 10, + "content": { + "chartId": "workbook874420eb-4632-4961-9fb9-b29ef76d947b", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Transactions", + "aggregation": 1, + "splitBy": "ResponseType" + } + ], + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Segment", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "purpleBlueGreen", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "showBorder": false + }, + "filters": [] + }, + "customWidth": "85", + "name": "Error Summary" + }, + { + "type": 10, + "content": { + "chartId": "workbook175d3b32-6968-45c4-a01a-2958cbb0a7d7", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Transactions", + "aggregation": 1, + "splitBy": "ResponseType", + "columnName": "Failures" + } + ], + "title": "Failing transactions", + "filters": [ + { + "key": "ResponseType", + "operator": 1, + "values": [ + "Success" + ] + } + ] + }, + "showPin": true, + "name": "Transaction trend", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 10, + "content": { + "chartId": "workbook53678d70-22d8-403b-96b1-1c24f90516ed", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 0, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-Transactions", + "aggregation": 1, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-Transactions", + "aggregation": 1, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-Transactions", + "aggregation": 1, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-Transactions", + "aggregation": 1, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "title": "Failing transactions by API name", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Namespace", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "$gen_group", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Namespace" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "labelSettings": [] + }, + "gridFormatType": 1, + "filters": [ + { + "key": "ResponseType", + "operator": 1, + "values": [ + "Success" + ] + } + ] + }, + "customWidth": "50", + "showPin": true, + "name": "Failing transactions by API name " + }, + { + "type": 10, + "content": { + "chartId": "workbook53678d70-22d8-403b-96b1-1c24f90516ed", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 0, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-Transactions", + "aggregation": 1, + "splitBy": "ResponseType", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-Transactions", + "aggregation": 1, + "splitBy": "ResponseType", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-Transactions", + "aggregation": 1, + "splitBy": "ResponseType", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-Transactions", + "aggregation": 1, + "splitBy": "ResponseType", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "title": "Failing transactions by Response type", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Namespace", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "$gen_group", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Namespace" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "labelSettings": [] + }, + "gridFormatType": 1, + "filters": [ + { + "key": "ResponseType", + "operator": 1, + "values": [ + "Success" + ] + } + ] + }, + "customWidth": "50", + "showPin": true, + "name": "Failing transactions by Response Type" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Individual Storage/Workbooks/Failures/settings.json b/Individual Storage/Workbooks/Failures/settings.json new file mode 100644 index 0000000..58f6134 --- /dev/null +++ b/Individual Storage/Workbooks/Failures/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Failures", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.storage/storageaccounts", "order": 200 }] +} \ No newline at end of file diff --git a/Individual Storage/Workbooks/Overview/Overview.workbook b/Individual Storage/Workbooks/Overview/Overview.workbook new file mode 100644 index 0000000..041ac38 --- /dev/null +++ b/Individual Storage/Workbooks/Overview/Overview.workbook @@ -0,0 +1,320 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "487a9f92-5350-4eec-8d68-15bdf2470550", + "version": "KqlParameterItem/1.0", + "name": "StorageAccount", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "d04c2e2c-b67c-4ae1-9b80-a36e27310200", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + } + ], + "allowCustom": true + }, + "label": "Time Range" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.storage/storageaccounts" + }, + "name": "resource param" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "overview", + "preText": "", + "style": "primary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Overview", + "typeSource": "workbook", + "gallerySource": "workbook" + } + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Failures", + "subTarget": "failures", + "style": "secondary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Failures", + "typeSource": "workbook", + "gallerySource": "workbook" + } + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Performance", + "subTarget": "performance", + "style": "secondary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Performance", + "typeSource": "workbook", + "gallerySource": "workbook" + } + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Availability", + "subTarget": "availability", + "style": "secondary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Availability", + "typeSource": "workbook", + "gallerySource": "workbook" + } + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Capacity", + "subTarget": "capacity", + "style": "secondary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Capacity", + "typeSource": "workbook", + "gallerySource": "workbook" + } + } + ] + }, + "name": "Navigation menu - Copy", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 10, + "content": "{\"chartId\":\"workbook1efde26e-1961-46f9-b562-e162894ddcf9\",\"version\":\"MetricsItem/2.0\",\"size\":4,\"chartType\":0,\"resourceIds\":[\"{StorageAccount}\"],\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"resourceType\":\"microsoft.storage/storageaccounts\",\"resourceParameter\":\"StorageAccount\",\"metrics\":[{\"namespace\":\"microsoft.storage/storageaccounts\",\"metric\":\"microsoft.storage/storageaccounts-Transaction-Availability\",\"aggregation\":4,\"splitBy\":null},{\"namespace\":\"microsoft.storage/storageaccounts\",\"metric\":\"microsoft.storage/storageaccounts-Transaction-Transactions\",\"aggregation\":1,\"splitBy\":null},{\"namespace\":\"microsoft.storage/storageaccounts\",\"metric\":\"microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency\",\"aggregation\":4,\"splitBy\":null},{\"namespace\":\"microsoft.storage/storageaccounts\",\"metric\":\"microsoft.storage/storageaccounts-Transaction-SuccessServerLatency\",\"aggregation\":4,\"splitBy\":null}],\"gridFormatType\":1,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Subscription\",\"formatter\":5},{\"columnMatch\":\"Metric\",\"formatter\":1},{\"columnMatch\":\"Aggregation\",\"formatter\":1},{\"columnMatch\":\"Segment Field\",\"formatter\":5},{\"columnMatch\":\"Segment\",\"formatter\":1},{\"columnMatch\":\"Value\",\"formatter\":1},{\"columnMatch\":\"Timeline\",\"formatter\":9},{\"columnMatch\":\"Name\",\"formatter\":13,\"formatOptions\":{\"linkTarget\":\"Resource\"}}],\"rowLimit\":10000}}", + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "Metrics Summary" + }, + { + "type": 3, + "content": "{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"Merge/1.0\\\",\\\"merges\\\":[{\\\"id\\\":\\\"3a881a4c-d5e3-4b9f-a456-eaf698410108\\\",\\\"mergeType\\\":\\\"table\\\",\\\"leftTable\\\":\\\"Metrics Summary\\\"}],\\\"projectRename\\\":[{\\\"originalName\\\":\\\"[Metrics Summary].Subscription\\\",\\\"mergedName\\\":\\\"Subscription\\\"},{\\\"originalName\\\":\\\"[Metrics Summary].Name\\\",\\\"mergedName\\\":\\\"Name\\\"},{\\\"originalName\\\":\\\"[Metrics Summary].Namespace\\\",\\\"mergedName\\\":\\\"Namespace\\\"},{\\\"originalName\\\":\\\"[Metrics Summary].Metric\\\",\\\"mergedName\\\":\\\"Metric\\\"},{\\\"originalName\\\":\\\"[Metrics Summary].Aggregation\\\",\\\"mergedName\\\":\\\"Aggregation\\\"},{\\\"originalName\\\":\\\"[Metrics Summary].Segment Field\\\",\\\"mergedName\\\":\\\"Segment Field\\\"},{\\\"originalName\\\":\\\"[Metrics Summary].Segment\\\",\\\"mergedName\\\":\\\"Segment\\\"},{\\\"originalName\\\":\\\"[Metrics Summary].Value\\\",\\\"mergedName\\\":\\\"Value\\\"},{\\\"originalName\\\":\\\"[Metrics Summary].Timeline\\\",\\\"mergedName\\\":\\\"Timeline\\\"},{\\\"originalName\\\":\\\"[Added column]\\\",\\\"mergedName\\\":\\\"Footer\\\",\\\"fromId\\\":null,\\\"isNewItem\\\":true,\\\"newItemData\\\":[{\\\"condition\\\":\\\"Metric == Availability Result is Average | Percentage\\\",\\\"newColumnContext\\\":{\\\"leftColumn\\\":\\\"Metric\\\",\\\"operator\\\":\\\"==\\\",\\\"rightValType\\\":\\\"static\\\",\\\"rightVal\\\":\\\"Availability\\\",\\\"resultValType\\\":\\\"static\\\",\\\"resultVal\\\":\\\"Average | Percentage\\\"}},{\\\"condition\\\":\\\"Metric == Transactions Result is Count\\\",\\\"newColumnContext\\\":{\\\"leftColumn\\\":\\\"Metric\\\",\\\"operator\\\":\\\"==\\\",\\\"rightValType\\\":\\\"static\\\",\\\"rightVal\\\":\\\"Transactions\\\",\\\"resultValType\\\":\\\"static\\\",\\\"resultVal\\\":\\\"Count\\\"}},{\\\"condition\\\":\\\"Metric startsWith Success Result is Average | Milliseconds\\\",\\\"newColumnContext\\\":{\\\"leftColumn\\\":\\\"Metric\\\",\\\"operator\\\":\\\"startsWith\\\",\\\"rightValType\\\":\\\"static\\\",\\\"rightVal\\\":\\\"Success\\\",\\\"resultValType\\\":\\\"static\\\",\\\"resultVal\\\":\\\"Average | Milliseconds\\\"}},{\\\"condition\\\":\\\"Default\\\",\\\"newColumnContext\\\":{\\\"operator\\\":\\\"Default\\\",\\\"rightValType\\\":\\\"column\\\",\\\"resultValType\\\":\\\"column\\\"}}]},{\\\"originalName\\\":\\\"[Added column]\\\",\\\"mergedName\\\":\\\"Subtitle\\\",\\\"fromId\\\":null,\\\"isNewItem\\\":true,\\\"newItemData\\\":[{\\\"condition\\\":\\\"Default\\\",\\\"newColumnContext\\\":{\\\"operator\\\":\\\"Default\\\",\\\"rightValType\\\":\\\"column\\\",\\\"resultValType\\\":\\\"static\\\",\\\"resultVal\\\":\\\"───\\\"}}]},{\\\"originalName\\\":\\\"[Metrics Summary].Metric ID\\\",\\\"mergedName\\\":\\\"Metric ID\\\",\\\"fromId\\\":\\\"unknown\\\"}]}\",\"size\":4,\"queryType\":7,\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Metric\",\"formatOptions\":{\"showIcon\":true}},\"subtitleContent\":{\"columnMatch\":\"Subtitle\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"showIcon\":true,\"palette\":\"purpleBlueGreen\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},\"secondaryContent\":{\"columnMatch\":\"Footer\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"showBorder\":false}}", + "name": "Tiles", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 10, + "content": "{\"chartId\":\"workbook85d2d5d7-0e4c-4c24-8d42-47bf8300bdc0\",\"version\":\"MetricsItem/2.0\",\"size\":0,\"chartType\":2,\"resourceIds\":[\"{StorageAccount}\"],\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"resourceType\":\"microsoft.storage/storageaccounts\",\"resourceParameter\":\"StorageAccount\",\"metrics\":[{\"namespace\":\"microsoft.storage/storageaccounts/blobservices\",\"metric\":\"microsoft.storage/storageaccounts/blobservices-Transaction-Transactions\",\"aggregation\":1,\"splitBy\":null,\"columnName\":\"Blob transactions\"},{\"namespace\":\"microsoft.storage/storageaccounts/fileservices\",\"metric\":\"microsoft.storage/storageaccounts/fileservices-Transaction-Transactions\",\"aggregation\":1,\"columnName\":\"File transactions\"},{\"namespace\":\"microsoft.storage/storageaccounts/queueservices\",\"metric\":\"microsoft.storage/storageaccounts/queueservices-Transaction-Transactions\",\"aggregation\":1,\"columnName\":\"Queue transactions\"},{\"namespace\":\"microsoft.storage/storageaccounts/tableservices\",\"metric\":\"microsoft.storage/storageaccounts/tableservices-Transaction-Transactions\",\"aggregation\":1,\"columnName\":\"Table transactions\"}],\"title\":\"Transactions by storage type\",\"gridSettings\":{\"rowLimit\":10000}}", + "customWidth": "50", + "showPin": true, + "name": "Transactions by storage type", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 10, + "content": "{\"chartId\":\"workbook85d2d5d7-0e4c-4c24-8d42-47bf8300bdc0\",\"version\":\"MetricsItem/2.0\",\"size\":0,\"chartType\":2,\"resourceIds\":[\"{StorageAccount}\"],\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"resourceType\":\"microsoft.storage/storageaccounts\",\"resourceParameter\":\"StorageAccount\",\"metrics\":[{\"namespace\":\"microsoft.storage/storageaccounts\",\"metric\":\"microsoft.storage/storageaccounts-Transaction-Transactions\",\"aggregation\":1,\"splitBy\":\"ApiName\",\"columnName\":\"\"}],\"title\":\"Transactions by API name\",\"gridSettings\":{\"rowLimit\":10000}}", + "customWidth": "50", + "showPin": true, + "name": "Transaction by api name", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 10, + "content": "{\"chartId\":\"workbook85d2d5d7-0e4c-4c24-8d42-47bf8300bdc0\",\"version\":\"MetricsItem/2.0\",\"size\":0,\"chartType\":2,\"resourceIds\":[\"{StorageAccount}\"],\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"resourceType\":\"microsoft.storage/storageaccounts\",\"resourceParameter\":\"StorageAccount\",\"metrics\":[{\"namespace\":\"microsoft.storage/storageaccounts/blobservices\",\"metric\":\"microsoft.storage/storageaccounts/blobservices-Transaction-Availability\",\"aggregation\":4,\"splitBy\":null,\"columnName\":\"Blob availability\"},{\"namespace\":\"microsoft.storage/storageaccounts/fileservices\",\"metric\":\"microsoft.storage/storageaccounts/fileservices-Transaction-Availability\",\"aggregation\":4,\"columnName\":\"File availability\"},{\"namespace\":\"microsoft.storage/storageaccounts/queueservices\",\"metric\":\"microsoft.storage/storageaccounts/queueservices-Transaction-Availability\",\"aggregation\":4,\"columnName\":\"Queue availability\"},{\"namespace\":\"microsoft.storage/storageaccounts/tableservices\",\"metric\":\"microsoft.storage/storageaccounts/tableservices-Transaction-Availability\",\"aggregation\":4,\"columnName\":\"Table availability\"}],\"title\":\"Availability\",\"gridSettings\":{\"rowLimit\":10000}}", + "customWidth": "50", + "showPin": true, + "name": "Availability", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 10, + "content": "{\"chartId\":\"workbook85d2d5d7-0e4c-4c24-8d42-47bf8300bdc0\",\"version\":\"MetricsItem/2.0\",\"size\":0,\"chartType\":2,\"resourceIds\":[\"{StorageAccount}\"],\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"resourceType\":\"microsoft.storage/storageaccounts\",\"resourceParameter\":\"StorageAccount\",\"metrics\":[{\"namespace\":\"microsoft.storage/storageaccounts/blobservices\",\"metric\":\"microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity\",\"aggregation\":4,\"splitBy\":null,\"columnName\":\"Blob capacity\"},{\"namespace\":\"microsoft.storage/storageaccounts/fileservices\",\"metric\":\"microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity\",\"aggregation\":4,\"columnName\":\"File capacity\"},{\"namespace\":\"microsoft.storage/storageaccounts/queueservices\",\"metric\":\"microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity\",\"aggregation\":4,\"columnName\":\"Queue capacity\"},{\"namespace\":\"microsoft.storage/storageaccounts/tableservices\",\"metric\":\"microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity\",\"aggregation\":4,\"columnName\":\"Table capacity\"}],\"title\":\"Used capacity\",\"gridSettings\":{\"rowLimit\":10000}}", + "customWidth": "50", + "showPin": true, + "name": "Capacity", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 10, + "content": "{\"chartId\":\"workbook85d2d5d7-0e4c-4c24-8d42-47bf8300bdc0\",\"version\":\"MetricsItem/2.0\",\"size\":0,\"chartType\":2,\"resourceIds\":[\"{StorageAccount}\"],\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"resourceType\":\"microsoft.storage/storageaccounts\",\"resourceParameter\":\"StorageAccount\",\"metrics\":[{\"namespace\":\"microsoft.storage/storageaccounts\",\"metric\":\"microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency\",\"aggregation\":4,\"splitBy\":null},{\"namespace\":\"microsoft.storage/storageaccounts\",\"metric\":\"microsoft.storage/storageaccounts-Transaction-SuccessServerLatency\",\"aggregation\":4}],\"title\":\"Success latency - End-to-end & Server\",\"gridSettings\":{\"rowLimit\":10000}}", + "customWidth": "50", + "showPin": true, + "name": "Success Latency" + }, + { + "type": 10, + "content": "{\"chartId\":\"workbook85d2d5d7-0e4c-4c24-8d42-47bf8300bdc0\",\"version\":\"MetricsItem/2.0\",\"size\":0,\"chartType\":2,\"resourceIds\":[\"{StorageAccount}\"],\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"resourceType\":\"microsoft.storage/storageaccounts\",\"resourceParameter\":\"StorageAccount\",\"metrics\":[{\"namespace\":\"microsoft.storage/storageaccounts\",\"metric\":\"microsoft.storage/storageaccounts-Transaction-Ingress\",\"aggregation\":1,\"splitBy\":null},{\"namespace\":\"microsoft.storage/storageaccounts\",\"metric\":\"microsoft.storage/storageaccounts-Transaction-Egress\",\"aggregation\":1}],\"title\":\"Ingress\",\"gridSettings\":{\"rowLimit\":10000}}", + "customWidth": "50", + "showPin": true, + "name": "Transactions" + } + ] + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "overview" + }, + "name": "overview tab" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Individual Storage/Failures", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "failures" + }, + "name": "failures group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Individual Storage/Performance", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "performance" + }, + "name": "performance group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Individual Storage/Availability", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "availability" + }, + "name": "availability group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Individual Storage/Capacity", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "capacity" + }, + "name": "capacity group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Individual Storage/Workbooks/Overview/settings.json b/Individual Storage/Workbooks/Overview/settings.json new file mode 100644 index 0000000..7867423 --- /dev/null +++ b/Individual Storage/Workbooks/Overview/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Storage Account Overview", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.storage/storageaccounts", "order": 100 }, { "type": "storage-insights", "resourceType": "microsoft.storage/storageaccounts", "order": 100 }] +} \ No newline at end of file diff --git a/Individual Storage/Workbooks/Performance/Performance.workbook b/Individual Storage/Workbooks/Performance/Performance.workbook new file mode 100644 index 0000000..53f39f3 --- /dev/null +++ b/Individual Storage/Workbooks/Performance/Performance.workbook @@ -0,0 +1,550 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "487a9f92-5350-4eec-8d68-15bdf2470550", + "version": "KqlParameterItem/1.0", + "name": "StorageAccount", + "type": 5, + "isRequired": true, + "value": "value::1", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.storage/storageaccounts" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "resource param" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "d04c2e2c-b67c-4ae1-9b80-a36e27310200", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + } + ], + "allowCustom": true + }, + "label": "Time Range" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.storage/storageaccounts" + }, + "name": "Performance params", + "styleSettings": { + "margin": "0 0 20px 0" + } + }, + { + "type": 10, + "content": { + "chartId": "workbook874420eb-4632-4961-9fb9-b29ef76d947b", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-SuccessServerLatency", + "aggregation": 4 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "Metric", + "formatter": 1 + }, + { + "columnMatch": "Aggregation", + "formatter": 1 + }, + { + "columnMatch": "Segment Field", + "formatter": 5 + }, + { + "columnMatch": "Segment", + "formatter": 1 + }, + { + "columnMatch": "Value", + "formatter": 1 + }, + { + "columnMatch": "Timeline", + "formatter": 9 + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource" + } + } + ], + "labelSettings": [] + }, + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "purpleBlueGreen", + "showIcon": true + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + "showBorder": false + }, + "filters": [] + }, + "name": "Latency Summary" + }, + { + "type": 10, + "content": { + "chartId": "workbook175d3b32-6968-45c4-a01a-2958cbb0a7d7", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-SuccessServerLatency", + "aggregation": 4 + } + ], + "title": "E2E vs. Server latency trend", + "filters": [] + }, + "showPin": true, + "name": "Performance E2E vs Server Latency" + }, + { + "type": 10, + "content": { + "chartId": "workbooka9383621-f16a-494c-95ae-f1a2355f6403", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": 0, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-SuccessE2ELatency", + "aggregation": 4, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 25 + }, + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-SuccessE2ELatency", + "aggregation": 4, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-SuccessE2ELatency", + "aggregation": 4, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-SuccessE2ELatency", + "aggregation": 4, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "Metric", + "formatter": 1 + }, + { + "columnMatch": "Aggregation", + "formatter": 1 + }, + { + "columnMatch": "Segment Field", + "formatter": 5 + }, + { + "columnMatch": "Segment", + "formatter": 1 + }, + { + "columnMatch": "Value", + "formatter": 1 + }, + { + "columnMatch": "Timeline", + "formatter": 9 + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource" + } + } + ], + "labelSettings": [] + }, + "gridFormatType": 1, + "filters": [] + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "customWidth": "50", + "name": "Success E2E Latency" + }, + { + "type": 10, + "content": { + "chartId": "workbooka9383621-f16a-494c-95ae-f1a2355f6403", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": 0, + "resourceIds": [ + "{StorageAccount}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-SuccessServerLatency", + "aggregation": 4, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 25 + }, + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-SuccessServerLatency", + "aggregation": 4, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-SuccessServerLatency", + "aggregation": 4, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-SuccessE2ELatency", + "aggregation": 4, + "splitBy": "ApiName", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "Metric", + "formatter": 1 + }, + { + "columnMatch": "Aggregation", + "formatter": 1 + }, + { + "columnMatch": "Segment Field", + "formatter": 5 + }, + { + "columnMatch": "Segment", + "formatter": 1 + }, + { + "columnMatch": "Value", + "formatter": 1 + }, + { + "columnMatch": "Timeline", + "formatter": 9 + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource" + } + } + ], + "labelSettings": [] + }, + "gridFormatType": 1, + "filters": [] + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "customWidth": "50", + "name": "Success Server Latency" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"5fb793f8-8e9d-4ba8-98b1-42243ea47044\",\"mergeType\":\"inner\",\"leftTable\":\"Success E2E Latency\",\"rightTable\":\"Success Server Latency\",\"leftColumn\":\"Segment\",\"rightColumn\":\"Segment\"}],\"projectRename\":[{\"originalName\":\"[Success E2E Latency].Segment\",\"mergedName\":\"API Name\"},{\"originalName\":\"[Success E2E Latency].Value\",\"mergedName\":\"Success E2E Latency (avg)\"},{\"originalName\":\"[Success E2E Latency].Timeline\",\"mergedName\":\"E2E Latency Trend\"},{\"originalName\":\"[Success Server Latency].Value\",\"mergedName\":\"Success Server Latency (avg)\"},{\"originalName\":\"[Success Server Latency].Timeline\",\"mergedName\":\"Server Latency Trend\"},{\"originalName\":\"[Success E2E Latency].Namespace\",\"mergedName\":\"Namespace\"},{\"originalName\":\"[Success E2E Latency].Metric ID\",\"mergedName\":\"Metric ID\",\"fromId\":\"unknown\"},{\"originalName\":\"[Success Server Latency].Metric ID\",\"mergedName\":\"Metric ID\",\"fromId\":\"unknown\"},{\"originalName\":\"[Success E2E Latency].Metric ID\",\"mergedName\":\"Metric ID\",\"fromId\":\"unknown\"},{\"originalName\":\"[Success Server Latency].Metric ID\",\"mergedName\":\"Metric ID\",\"fromId\":\"unknown\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Client Latency (derived)\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"condition\":\"Default\",\"newColumnContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"expression\",\"resultVal\":\"[\\\"Success E2E Latency (avg)\\\"] - [\\\"Success Server Latency (avg)\\\"]\"}}]},{\"originalName\":\"[Success E2E Latency].Subscription\"},{\"originalName\":\"[Success E2E Latency].Name\"},{\"originalName\":\"[Success E2E Latency].Aggregation\"},{\"originalName\":\"[Success E2E Latency].Metric\"},{\"originalName\":\"[Success E2E Latency].Segment Field\"},{\"originalName\":\"[Success E2E Latency].Segment\"},{\"originalName\":\"[Success E2E Latency].Value\"},{\"originalName\":\"[Success E2E Latency].Timeline\"},{\"originalName\":\"[Success Server Latency].Subscription\"},{\"originalName\":\"[Success Server Latency].Name\"},{\"originalName\":\"[Success Server Latency].Namespace\"},{\"originalName\":\"[Success Server Latency].Metric\"},{\"originalName\":\"[Success Server Latency].Aggregation\"},{\"originalName\":\"[Success Server Latency].Segment Field\"},{\"originalName\":\"[Success Server Latency].Segment\"},{\"originalName\":\"[Success Server Latency].Value\"},{\"originalName\":\"[Success Server Latency].Timeline\"}]}", + "size": 3, + "title": "Latency of successful calls by API name", + "queryType": 7, + "resourceType": "microsoft.storage/storageaccounts", + "gridSettings": { + "formatters": [ + { + "columnMatch": "API Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Success E2E Latency (avg)", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "E2E Latency Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Success Server Latency \\(avg\\)$|Client Latency \\(derived\\)$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Server Latency Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true + } + }, + { + "columnMatch": "Namespace", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric ID", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "$gen_group", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Namespace" + ], + "expandTopLevel": true, + "finalBy": "API Name" + }, + "labelSettings": [] + } + }, + "showPin": true, + "name": "Performance Success Latency Calls by Api Name", + "styleSettings": { + "margin": "20px 0 0 0" + } + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Individual Storage/Workbooks/Performance/settings.json b/Individual Storage/Workbooks/Performance/settings.json new file mode 100644 index 0000000..6aa3fc1 --- /dev/null +++ b/Individual Storage/Workbooks/Performance/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.storage/storageaccounts", "order": 300 }] +} \ No newline at end of file diff --git a/Individual Storage/Workbooks/categoryResources.json b/Individual Storage/Workbooks/categoryResources.json new file mode 100644 index 0000000..3594536 --- /dev/null +++ b/Individual Storage/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Insights", "description": "Provides insights for your storage accounts", "order": 100} +} \ No newline at end of file diff --git a/Insights/Alerts/README b/Insights/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Insights/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Insights/Queries/README b/Insights/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Insights/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Insights/Workbooks/ADXCluster/Insights.workbook b/Insights/Workbooks/ADXCluster/Insights.workbook new file mode 100644 index 0000000..4dfe123 --- /dev/null +++ b/Insights/Workbooks/ADXCluster/Insights.workbook @@ -0,0 +1,1466 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All subscriptions with ADX Cluster", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'Microsoft.Kusto/clusters'\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "f60ea0a0-3703-44ca-a59b-df0246423f41", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "ADX Cluster", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'Microsoft.Kusto/clusters'\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = name, selected = Rank <= 5", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "182d6324-854c-4cc0-802a-de4f3bee9f76", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5ab45df9-371b-4dba-8ee3-6ec9fbb33ff9", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "where type =~ 'Microsoft.Kusto/clusters'\r\n| summarize Selected = countif(id in ({Resources:value})), Total = count()\r\n| extend Selected = iff(Selected > 200, 200, Selected)\r\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "46dfcfa4-d5d4-47c2-9dfd-ca0fcb935dc7", + "version": "KqlParameterItem/1.0", + "name": "ResourceName", + "type": 1, + "description": "Used for 'No Subscriptions' workbook template", + "isRequired": true, + "value": "ADX Cluster", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'ADX Cluster'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "ADX Cluster" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "1c84117c-7449-4484-b693-00f41a578bd6", + "version": "KqlParameterItem/1.0", + "name": "ResourceImageUrl", + "type": 1, + "description": "Used for 'No Subscriptions' workbook template", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "ADX Cluster parameters", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Common/noSubscriptions", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isEqualTo", + "value": "" + }, + "name": "No Subscriptions group" + }, + { + "type": 1, + "content": { + "json": "{Message}\r\n_Azure Data Explorer Cluster_\r\n
\r\n
" + }, + "name": "resource summary", + "styleSettings": { + "margin": "15px 0 10px 10px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Cluster Health", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Export Performance", + "subTarget": "Export", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Ingestion Performance", + "subTarget": "Ingestion", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Query Performance", + "subTarget": "QueryPerf", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Streaming Ingest Performance", + "subTarget": "Stream", + "style": "link" + } + ] + }, + "name": "At Scale sections", + "styleSettings": { + "margin": "-15px 0px -15px 0px" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.kusto/clusters", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Cluster health-CPU", + "aggregation": 4 + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Cluster health-IngestionUtilization", + "aggregation": 4 + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Cluster health-InstanceCount", + "aggregation": 4 + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Cluster health-TotalNumberOfExtents", + "aggregation": 4 + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Cluster health-TotalNumberOfThrottledCommands", + "aggregation": 1, + "columnName": "Extents (Total)" + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Cluster health-CacheUtilization", + "aggregation": 4, + "columnName": "Throttled Commands (Total)" + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Cluster health-CPU", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Cluster health-CPU Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Cluster health-IngestionUtilization", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Cluster health-IngestionUtilization Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Cluster health-InstanceCount", + "formatter": 4, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Cluster health-InstanceCount Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Cluster health-TotalNumberOfExtents", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Cluster health-TotalNumberOfExtents Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Extents (Total)", + "formatter": 4, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Extents (Total) Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Throttled Commands (Total)", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "aggregation": "Count" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Throttled Commands (Total) Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Cluster health-CacheUtilization", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Cluster health-CacheUtilization Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Cluster health-TotalNumberOfThrottledCommands Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Cluster health-TotalNumberOfThrottledCommands", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "microsoft.kusto/clusters-Cluster health-CPU", + "label": "CPU (Average)" + }, + { + "columnId": "microsoft.kusto/clusters-Cluster health-CPU Timeline", + "label": "CPU Timeline" + }, + { + "columnId": "microsoft.kusto/clusters-Cluster health-IngestionUtilization", + "label": "Ingestion utilization (Average)" + }, + { + "columnId": "microsoft.kusto/clusters-Cluster health-IngestionUtilization Timeline", + "label": "Ingestion utilization Timeline" + }, + { + "columnId": "microsoft.kusto/clusters-Cluster health-InstanceCount", + "label": "Instance Count (Average)" + }, + { + "columnId": "microsoft.kusto/clusters-Cluster health-InstanceCount Timeline", + "label": "Instance Count (Average) Timeline" + }, + { + "columnId": "microsoft.kusto/clusters-Cluster health-TotalNumberOfExtents", + "label": "Total number of extents (Average)" + }, + { + "columnId": "microsoft.kusto/clusters-Cluster health-TotalNumberOfExtents Timeline", + "label": "Total number of extents Timeline" + } + ] + }, + "sortBy": [], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "showPin": true, + "name": "Overview" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.kusto/clusters", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Export health and performance-ContinuousExportNumOfRecordsExported", + "aggregation": 1, + "columnName": "Exported Record" + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Export health and performance-ContinuousExportMaxLatenessMinutes", + "aggregation": 3, + "columnName": "Lateness (Max)" + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Export health and performance-ContinuousExportPendingCount", + "aggregation": 3, + "columnName": "Pending Count" + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Export health and performance-ContinuousExportResult", + "aggregation": 7, + "columnName": "Result" + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Export health and performance-ExportUtilization", + "aggregation": 3 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Exported Record", + "formatter": 0, + "formatOptions": { + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Exported Record Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Lateness (Max)", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 25, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Lateness (Max) Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Pending Count", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Pending Count Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Result", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Result Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Export health and performance-ExportUtilization", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Export health and performance-ExportUtilization Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Export health and performance-ContinuousExportNumOfRecordsExported Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Export health and performance-ContinuousExportNumOfRecordsExported", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Export health and performance-ContinuousExportMaxLatenessMinutes Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Export health and performance-ContinuousExportMaxLatenessMinutes", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Export health and performance-ContinuousExportPendingCount Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Export health and performance-ContinuousExportPendingCount", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Export health and performance-ContinuousExportResult Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Export health and performance-ContinuousExportResult", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "microsoft.kusto/clusters-Export health and performance-ExportUtilization", + "label": "Export Utilization (Max)" + }, + { + "columnId": "microsoft.kusto/clusters-Export health and performance-ExportUtilization Timeline", + "label": "Export Utilization Timeline" + } + ] + }, + "sortBy": [], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Export" + }, + "showPin": true, + "name": "Export Performance" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.kusto/clusters", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Ingestion health and performance-EventsProcessedForEventHubs", + "aggregation": 1 + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Ingestion health and performance-IngestionLatencyInSeconds", + "aggregation": 4 + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Ingestion health and performance-IngestionResult", + "aggregation": 7 + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Ingestion health and performance-IngestionVolumeInMB", + "aggregation": 1 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Ingestion health and performance-EventsProcessedForEventHubs", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Ingestion health and performance-EventsProcessedForEventHubs Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Ingestion health and performance-IngestionLatencyInSeconds", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 24, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Ingestion health and performance-IngestionLatencyInSeconds Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Ingestion health and performance-IngestionResult", + "formatter": 4, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Ingestion health and performance-IngestionResult Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Ingestion health and performance-IngestionVolumeInMB", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Ingestion health and performance-IngestionVolumeInMB Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue" + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.kusto/clusters-Ingestion health and performance-EventsProcessedForEventHubs_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "microsoft.kusto/clusters-Ingestion health and performance-EventsProcessedForEventHubs", + "label": "Events processed (for Event/IoT Hubs) (Sum)" + }, + { + "columnId": "microsoft.kusto/clusters-Ingestion health and performance-EventsProcessedForEventHubs Timeline", + "label": "Events processed (for Event/IoT Hubs) (Sum) Timeline" + }, + { + "columnId": "microsoft.kusto/clusters-Ingestion health and performance-IngestionLatencyInSeconds", + "label": "Ingestion latency (in seconds) (Average)" + }, + { + "columnId": "microsoft.kusto/clusters-Ingestion health and performance-IngestionLatencyInSeconds Timeline", + "label": "Ingestion latency (in seconds) Timeline" + }, + { + "columnId": "microsoft.kusto/clusters-Ingestion health and performance-IngestionResult", + "label": "Ingestion result (Count)" + }, + { + "columnId": "microsoft.kusto/clusters-Ingestion health and performance-IngestionResult Timeline", + "label": "Ingestion result Timeline" + }, + { + "columnId": "microsoft.kusto/clusters-Ingestion health and performance-IngestionVolumeInMB", + "label": "Ingestion volume (in MB) (Sum)" + }, + { + "columnId": "microsoft.kusto/clusters-Ingestion health and performance-IngestionVolumeInMB Timeline", + "label": "Ingestion volume (in MB) Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.kusto/clusters-Ingestion health and performance-EventsProcessedForEventHubs_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Ingestion" + }, + "showPin": true, + "name": "Ingestion Performance" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.kusto/clusters", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Query performance-QueryDuration", + "aggregation": 4 + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Query performance-TotalNumberOfConcurrentQueries", + "aggregation": 1 + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Query performance-TotalNumberOfThrottledQueries", + "aggregation": 1 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Query performance-QueryDuration", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Query performance-QueryDuration Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Query performance-TotalNumberOfConcurrentQueries", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Query performance-TotalNumberOfConcurrentQueries Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Query performance-TotalNumberOfThrottledQueries", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Query performance-TotalNumberOfThrottledQueries Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": ".*\\/Errors$", + "formatter": 4, + "formatOptions": { + "palette": "red", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_number_microsoft.kusto/clusters-Query performance-QueryDuration_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "microsoft.kusto/clusters-Query performance-QueryDuration", + "label": "Query duration (Average)" + }, + { + "columnId": "microsoft.kusto/clusters-Query performance-QueryDuration Timeline", + "label": "Query duration Timeline" + }, + { + "columnId": "microsoft.kusto/clusters-Query performance-TotalNumberOfConcurrentQueries", + "label": "Total number of concurrent queries (Sum)" + }, + { + "columnId": "microsoft.kusto/clusters-Query performance-TotalNumberOfConcurrentQueries Timeline", + "label": "Total number of concurrent queries Timeline" + }, + { + "columnId": "microsoft.kusto/clusters-Query performance-TotalNumberOfThrottledQueries", + "label": "Total number of throttled queries (Sum)" + }, + { + "columnId": "microsoft.kusto/clusters-Query performance-TotalNumberOfThrottledQueries Timeline", + "label": "Total number of throttled queries Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_number_microsoft.kusto/clusters-Query performance-QueryDuration_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "QueryPerf" + }, + "showPin": true, + "name": "Query Performance" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.kusto/clusters", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Streaming Ingest-StreamingIngestDataRate", + "aggregation": 4, + "columnName": "Data Rate" + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Streaming Ingest-StreamingIngestDuration", + "aggregation": 4, + "columnName": "Duration" + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Streaming Ingest-SteamingIngestRequestRate", + "aggregation": 7, + "columnName": "Request Rate" + }, + { + "namespace": "microsoft.kusto/clusters", + "metric": "microsoft.kusto/clusters-Streaming Ingest-StreamingIngestResults", + "aggregation": 4, + "columnName": "Result" + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Data Rate", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "useGrouping": false + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Data Rate Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Duration", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Duration Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Request Rate", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Request Rate Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Result", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Result Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.kusto/clusters-Streaming Ingest-StreamingIngestDataRate", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Streaming Ingest-SteamingIngestRequestRate", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Streaming Ingest-StreamingIngestDuration", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.kusto/clusters-Streaming Ingest-StreamingIngestResults", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_number_Duration_5", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_number_Duration_5", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Stream" + }, + "showPin": true, + "name": "Streaming Ingest" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "ADX Summary" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Insights/Workbooks/ADXCluster/settings.json b/Insights/Workbooks/ADXCluster/settings.json new file mode 100644 index 0000000..c8fd38d --- /dev/null +++ b/Insights/Workbooks/ADXCluster/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Azure Data Explorer Overview", + "isPreview": true, + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorInsights", "order": 100 }, { "type": "ADX-insights", "resourceType": "Azure Monitor", "order": 100 }] +} \ No newline at end of file diff --git a/Insights/Workbooks/Event Grid Domains/Insights.workbook b/Insights/Workbooks/Event Grid Domains/Insights.workbook new file mode 100644 index 0000000..fe0be94 --- /dev/null +++ b/Insights/Workbooks/Event Grid Domains/Insights.workbook @@ -0,0 +1,919 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All subscriptions with Event Grid Domains", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'Microsoft.EventGrid/domains'\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "f60ea0a0-3703-44ca-a59b-df0246423f41", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "Event Grid Domains", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'Microsoft.EventGrid/domains'\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = name, selected = Rank <= 5", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "182d6324-854c-4cc0-802a-de4f3bee9f76", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5ab45df9-371b-4dba-8ee3-6ec9fbb33ff9", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "where type =~ 'Microsoft.EventGrid/domains'\r\n| summarize Selected = countif(id in ({Resources:value})), Total = count()\r\n| extend Selected = iff(Selected > 200, 200, Selected)\r\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "8a39b5e5-9751-4658-882d-7398dfafd8d3", + "version": "KqlParameterItem/1.0", + "name": "ResourceName", + "type": 1, + "description": "Used for 'No Subscriptions' workbook template", + "value": "Event Domain", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'Event Domain'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "Event Domain" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "c93bfcb9-3d2c-46ae-b3f2-45952b970c24", + "version": "KqlParameterItem/1.0", + "name": "ResourceImageUrl", + "type": 1, + "description": "Used for 'No Subscriptions' workbook template", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 0", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Common/noSubscriptions", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isEqualTo", + "value": "" + }, + "name": "No Subscriptions group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "{Message}\r\n_Event Grid Domains_\r\n
\r\n
" + }, + "name": "text - 5", + "styleSettings": { + "margin": "15px 0 10px 10px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Errors", + "subTarget": "Failures", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Latency", + "subTarget": "Latency", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Dead Letter", + "subTarget": "DeadLetter", + "style": "link" + } + ] + }, + "name": "links - 2", + "styleSettings": { + "margin": "-15px 0px -15px 0px" + } + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "Microsoft.EventGrid/domains", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.eventgrid/domains", + "metric": "microsoft.eventgrid/domains--PublishSuccessCount", + "aggregation": 1 + }, + { + "namespace": "microsoft.eventgrid/domains", + "metric": "microsoft.eventgrid/domains--PublishFailCount", + "aggregation": 1 + }, + { + "namespace": "microsoft.eventgrid/domains", + "metric": "microsoft.eventgrid/domains--MatchedEventCount", + "aggregation": 1 + }, + { + "namespace": "microsoft.eventgrid/domains", + "metric": "microsoft.eventgrid/domains--DeliveryAttemptFailCount", + "aggregation": 1 + }, + { + "namespace": "microsoft.eventgrid/domains", + "metric": "microsoft.eventgrid/domains--DroppedEventCount", + "aggregation": 1 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "linkTarget": "Resource" + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--PublishSuccessCount", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--PublishSuccessCount Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--PublishFailCount", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": null + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--PublishFailCount Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.eventgrid/domains--MatchedEventCount", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": null + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--MatchedEventCount Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.eventgrid/domains--DeliveryAttemptFailCount", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": null + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--DeliveryAttemptFailCount Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.eventgrid/domains--DroppedEventCount", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": null + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--DroppedEventCount Timeline", + "formatter": 5, + "formatOptions": {} + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "labelSettings": [ + { + "columnId": "microsoft.eventgrid/domains--PublishSuccessCount", + "label": "Published Events (Sum)" + }, + { + "columnId": "microsoft.eventgrid/domains--PublishSuccessCount Timeline", + "label": "Published Events (Sum) Timeline" + }, + { + "columnId": "microsoft.eventgrid/domains--PublishFailCount", + "label": "Publish Failed Events (Sum)" + }, + { + "columnId": "microsoft.eventgrid/domains--PublishFailCount Timeline", + "label": "Publish Failed Events (Sum) Timeline" + }, + { + "columnId": "microsoft.eventgrid/domains--MatchedEventCount", + "label": "Matched Events (Sum)" + }, + { + "columnId": "microsoft.eventgrid/domains--MatchedEventCount Timeline", + "label": "Matched Events (Sum) Timeline" + }, + { + "columnId": "microsoft.eventgrid/domains--DeliveryAttemptFailCount", + "label": "Delivery Failed Events (Sum)" + }, + { + "columnId": "microsoft.eventgrid/domains--DeliveryAttemptFailCount Timeline", + "label": "Delivery Failed Events (Sum) Timeline" + }, + { + "columnId": "microsoft.eventgrid/domains--DroppedEventCount", + "label": "Dropped Events (Sum)" + }, + { + "columnId": "microsoft.eventgrid/domains--DroppedEventCount Timeline", + "label": "Dropped Events (Sum) Timeline" + } + ] + }, + "sortBy": [], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "showPin": true, + "name": "Overview" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "Microsoft.EventGrid/domains", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.eventgrid/domains", + "metric": "microsoft.eventgrid/domains--DeliveryAttemptFailCount", + "aggregation": 1 + }, + { + "namespace": "microsoft.eventgrid/domains", + "metric": "microsoft.eventgrid/domains--PublishFailCount", + "aggregation": 1 + } + ], + "gridFormatType": 2, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.eventgrid/domains--DeliveryAttemptFailCount", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--DeliveryAttemptFailCount Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--PublishFailCount", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--PublishFailCount Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + } + }, + { + "columnMatch": "Microsoft.EventGrid/domains--PublishFailCount", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Microsoft.EventGrid/domains--DeliveryAttemptFailCount", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Microsoft.EventGrid/domains--DroppedEventCount", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Microsoft.EventGrid/domains--DeadLetteredCount", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--DroppedEventCount Timeline", + "formatter": 5, + "formatOptions": {} + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "Segment" + }, + { + "columnId": "microsoft.eventgrid/domains--DeliveryAttemptFailCount", + "label": "Delivery Failed Events (Sum)" + }, + { + "columnId": "microsoft.eventgrid/domains--DeliveryAttemptFailCount Timeline", + "label": "Delivery Failed Events (Sum) Timeline" + }, + { + "columnId": "microsoft.eventgrid/domains--PublishFailCount", + "label": "Publish Failed Events (Sum)" + }, + { + "columnId": "microsoft.eventgrid/domains--PublishFailCount Timeline", + "label": "Publish Failed Events (Sum) Timeline" + } + ] + }, + "sortBy": [], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Failures" + }, + "showPin": true, + "name": "Failures" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "Microsoft.EventGrid/domains", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.eventgrid/domains", + "metric": "microsoft.eventgrid/domains--PublishSuccessLatencyInMs", + "aggregation": 1 + }, + { + "namespace": "microsoft.eventgrid/domains", + "metric": "microsoft.eventgrid/domains--DestinationProcessingDurationInMs", + "aggregation": 4 + } + ], + "gridFormatType": 2, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.eventgrid/domains--PublishSuccessLatencyInMs", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--PublishSuccessLatencyInMs Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--DestinationProcessingDurationInMs", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--DestinationProcessingDurationInMs Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Microsoft.EventGrid/domains--PublishSuccessLatencyInMs", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Microsoft.EventGrid/domains--DestinationProcessingDurationInMs", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "labelSettings": [ + { + "columnId": "microsoft.eventgrid/domains--PublishSuccessLatencyInMs", + "label": "Publish Success Latency (Sum)" + }, + { + "columnId": "microsoft.eventgrid/domains--PublishSuccessLatencyInMs Timeline", + "label": "Publish Success Latency (Sum) Timeline" + }, + { + "columnId": "microsoft.eventgrid/domains--DestinationProcessingDurationInMs", + "label": "Destination Processing Duration (Average)" + }, + { + "columnId": "microsoft.eventgrid/domains--DestinationProcessingDurationInMs Timeline", + "label": "Destination Processing Duration (Average) Timeline" + } + ] + }, + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Latency" + }, + "showPin": true, + "name": "Latency" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "Microsoft.EventGrid/domains", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.eventgrid/domains", + "metric": "microsoft.eventgrid/domains--DeadLetteredCount", + "aggregation": 1 + } + ], + "gridFormatType": 2, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.eventgrid/domains--DeadLetteredCount", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventgrid/domains--DeadLetteredCount Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "labelSettings": [ + { + "columnId": "microsoft.eventgrid/domains--DeadLetteredCount", + "label": "Dead Lettered Events (Sum)" + }, + { + "columnId": "microsoft.eventgrid/domains--DeadLetteredCount Timeline", + "label": "Dead Lettered Events (Sum) Timeline" + } + ] + }, + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "DeadLetter" + }, + "showPin": true, + "name": "Dead Letter" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "Event Domain Resources" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Insights/Workbooks/Event Grid Domains/settings.json b/Insights/Workbooks/Event Grid Domains/settings.json new file mode 100644 index 0000000..5dc6b9b --- /dev/null +++ b/Insights/Workbooks/Event Grid Domains/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Event Grid Domains Overview", + "isPreview": true, + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorInsights", "order": 100 }, { "type": "eventgriddomain-insights", "resourceType": "Azure Monitor", "order": 100 }] +} \ No newline at end of file diff --git a/Insights/Workbooks/EventGridTopic/Insights.workbook b/Insights/Workbooks/EventGridTopic/Insights.workbook new file mode 100644 index 0000000..594eda6 --- /dev/null +++ b/Insights/Workbooks/EventGridTopic/Insights.workbook @@ -0,0 +1,602 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All Event Grid subscriptions", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.eventgrid/topics'\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::selected" + ], + "value": [ + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "138881c1-d041-4acd-acc9-e7a7af02d2ef", + "version": "KqlParameterItem/1.0", + "name": "GridTopics", + "label": "Event Grid Topics", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.eventgrid/topics'\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = id, selected = Rank <= 5", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.eventgrid/topics": true + }, + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "isRequired": true, + "value": { + "durationMs": 604800000 + }, + "type": 4, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "8858e75a-b30b-4164-ab97-f262c1388129", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "where type == 'microsoft.eventgrid/topics' \r\n| summarize Selected = countif(id in ({GridTopics:value})), Total = count()\r\n| extend Selected = iff(Selected > 200, 200, Selected)\r\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "9aab8378-c97c-4b28-b034-7538d6fdfffa", + "version": "KqlParameterItem/1.0", + "name": "ResourceName", + "type": 1, + "description": "Used for the 'No Subscriptions' Workbook template", + "value": "Event Grid Topic", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'Event Grid Topic'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "Event Grid Topic" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "9fac27da-f78b-466f-ab1f-d4b5a8be2d31", + "version": "KqlParameterItem/1.0", + "name": "ResourceImageUrl", + "type": 1, + "description": "Used for the 'No Subscriptions' workbook template", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "Event Grid Topic parameters", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Common/noSubscriptions", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isEqualTo", + "value": "" + }, + "name": "No Subscriptions group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "{Message}\r\n_Event Grid Topics_\r\n
\r\n
" + }, + "name": "Event Grid Topics", + "styleSettings": { + "margin": "15px 0 10px 10px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Errors", + "subTarget": "Errors", + "style": "link" + } + ] + }, + "name": "links-tabs", + "styleSettings": { + "margin": "-15px 0px -15px 0px" + } + }, + { + "type": 1, + "content": { + "json": "### Start editing the Overview section here" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "OverviewSectionEditStart" + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{GridTopics}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.eventgrid/topics", + "resourceParameter": "GridTopics", + "metrics": [ + { + "namespace": "microsoft.eventgrid/topics", + "metric": "microsoft.eventgrid/topics--PublishSuccessCount", + "aggregation": 1 + }, + { + "namespace": "microsoft.eventgrid/topics", + "metric": "microsoft.eventgrid/topics--PublishFailCount", + "aggregation": 1 + }, + { + "namespace": "microsoft.eventgrid/topics", + "metric": "microsoft.eventgrid/topics--UnmatchedEventCount", + "aggregation": 1 + } + ], + "filters": [ + { + "id": "1", + "key": "CollectionName", + "operator": 1, + "values": [ + "" + ], + "valueParam": null + } + ], + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.eventgrid/topics--PublishSuccessCount", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.eventgrid/topics--PublishSuccessCount Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "microsoft.eventgrid/topics--PublishFailCount", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.eventgrid/topics--PublishFailCount Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.eventgrid/topics--UnmatchedEventCount", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.eventgrid/topics--UnmatchedEventCount Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": {} + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "labelSettings": [ + { + "columnId": "microsoft.eventgrid/topics--PublishSuccessCount", + "label": "Published Events (Sum)" + }, + { + "columnId": "microsoft.eventgrid/topics--PublishSuccessCount Timeline", + "label": "Published Events (Sum) Timeline" + }, + { + "columnId": "microsoft.eventgrid/topics--PublishFailCount", + "label": "Publish Failed Events (Sum)" + }, + { + "columnId": "microsoft.eventgrid/topics--PublishFailCount Timeline", + "label": "Publish Failed Events (Sum) Timeline" + }, + { + "columnId": "microsoft.eventgrid/topics--UnmatchedEventCount", + "label": "Unmatched Events (Sum)" + }, + { + "columnId": "microsoft.eventgrid/topics--UnmatchedEventCount Timeline", + "label": "Unmatched Events (Sum) Timeline" + } + ] + }, + "sortBy": [], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "showPin": true, + "name": "Event Grid Topic metrics" + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{GridTopics}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.eventgrid/topics", + "resourceParameter": "GridTopics", + "metrics": [ + { + "namespace": "microsoft.eventgrid/topics", + "metric": "microsoft.eventgrid/topics--PublishFailCount", + "aggregation": 1 + } + ], + "filters": [ + { + "id": "1", + "key": "CollectionName", + "operator": 1, + "values": [ + "" + ], + "valueParam": null + } + ], + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.eventgrid/topics--PublishFailCount", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.eventgrid/topics--PublishFailCount Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue", + "aggregation": "Sum" + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.eventgrid/topics--PublishSuccessCount Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.eventgrid/topics--UnmatchedEventCount Timeline", + "formatter": 5, + "formatOptions": {} + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "labelSettings": [ + { + "columnId": "microsoft.eventgrid/topics--PublishFailCount", + "label": "Publish Failed Events (Sum)" + }, + { + "columnId": "microsoft.eventgrid/topics--PublishFailCount Timeline", + "label": "Publish Failed Events (Sum) Timeline" + } + ] + }, + "sortBy": [], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Errors" + }, + "showPin": true, + "name": "Event Grid Topic Errors" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "Event Grid Topics" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Insights/Workbooks/EventGridTopic/settings.json b/Insights/Workbooks/EventGridTopic/settings.json new file mode 100644 index 0000000..3d8b6d9 --- /dev/null +++ b/Insights/Workbooks/EventGridTopic/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Event Hub Overview", + "isPreview": true, + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorInsights", "order": 100 }, { "type": "eventgridtopics-insights", "resourceType": "Azure Monitor", "order": 100 }] +} \ No newline at end of file diff --git a/Insights/Workbooks/EventHub/Insights.workbook b/Insights/Workbooks/EventHub/Insights.workbook new file mode 100644 index 0000000..cfdc0a6 --- /dev/null +++ b/Insights/Workbooks/EventHub/Insights.workbook @@ -0,0 +1,1385 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All subscriptions with Event Hubs", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.eventhub/namespaces'\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "f60ea0a0-3703-44ca-a59b-df0246423f41", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "Event hubs namespaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.eventhub/namespaces'\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = name, selected = Rank <= 5", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "182d6324-854c-4cc0-802a-de4f3bee9f76", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + } + ], + "allowCustom": true + } + }, + { + "id": "5ab45df9-371b-4dba-8ee3-6ec9fbb33ff9", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "where type =~ 'microsoft.eventhub/namespaces'\r\n| summarize Selected = countif(id in ({Resources:value})), Total = count()\r\n| extend Selected = iff(Selected > 200, 200, Selected)\r\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "8a39b5e5-9751-4658-882d-7398dfafd8d3", + "version": "KqlParameterItem/1.0", + "name": "ResourceName", + "type": 1, + "description": "Used for 'No Subscriptions' workbook template", + "value": "Event Hub", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'Event Hub'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "Event Hub" + } + } + ] + }, + { + "id": "c93bfcb9-3d2c-46ae-b3f2-45952b970c24", + "version": "KqlParameterItem/1.0", + "name": "ResourceImageUrl", + "type": 1, + "description": "Used for 'No Subscriptions' workbook template", + "isHiddenWhenLocked": true + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Common/noSubscriptions", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isEqualTo", + "value": "" + }, + "name": "No Subscriptions group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "{Message}\r\n_Event hubs_\r\n
\r\n
" + }, + "name": "text - 5", + "styleSettings": { + "margin": "15px 0 10px 10px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Requests", + "subTarget": "Requests", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Messages", + "subTarget": "Messages", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Throughput", + "subTarget": "Throughput", + "style": "link", + "workbookContext": {}, + "alertRuleContext": {} + } + ] + }, + "name": "links - 2", + "styleSettings": { + "margin": "-15px 0px -15px 0px" + } + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.eventhub/namespaces", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--ActiveConnections", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--ConnectionsOpened", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--ConnectionsClosed", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--SuccessfulRequests", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--ThrottledRequests", + "aggregation": 1, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--ActiveConnections", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--ActiveConnections Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--ConnectionsOpened", + "formatter": 1, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--ConnectionsOpened Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--ConnectionsClosed", + "formatter": 1, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--ConnectionsClosed Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--SuccessfulRequests", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--SuccessfulRequests Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--ThrottledRequests", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--ThrottledRequests Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--IncomingMessages$|microsoft.eventhub/namespaces--OutgoingMessages$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--IncomingMessages Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--OutgoingMessages Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": ".*\\/Successful Requests$", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.eventhub/namespaces--ActiveConnections_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "microsoft.eventhub/namespaces--ActiveConnections", + "label": "ActiveConnections" + }, + { + "columnId": "microsoft.eventhub/namespaces--ActiveConnections Timeline", + "label": "ActiveConnections Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--ConnectionsOpened", + "label": "Connections Opened. (Average)" + }, + { + "columnId": "microsoft.eventhub/namespaces--ConnectionsOpened Timeline", + "label": "Connections Opened. Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--ConnectionsClosed", + "label": "Connections Closed. (Average)" + }, + { + "columnId": "microsoft.eventhub/namespaces--ConnectionsClosed Timeline", + "label": "Connections Closed. Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--SuccessfulRequests", + "label": "Successful Requests" + }, + { + "columnId": "microsoft.eventhub/namespaces--SuccessfulRequests Timeline", + "label": "Successful Requests Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--ThrottledRequests", + "label": "Throttled Requests." + }, + { + "columnId": "microsoft.eventhub/namespaces--ThrottledRequests Timeline", + "label": "Throttled Requests. Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.eventhub/namespaces--ActiveConnections_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "showPin": true, + "name": "Overview" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.eventhub/namespaces", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--IncomingRequests", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--SuccessfulRequests", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--ServerErrors", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--UserErrors", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--ThrottledRequests", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--QuotaExceededErrors", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "gridFormatType": 2, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--IncomingRequests", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--IncomingRequests Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--SuccessfulRequests", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--SuccessfulRequests Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--ServerErrors", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--ServerErrors Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--UserErrors", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--UserErrors Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--ThrottledRequests", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--ThrottledRequests Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--QuotaExceededErrors", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--QuotaExceededErrors Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": ".*\\/Incoming Requests$", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": ".*\\/Successful Requests$", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.eventhub/namespaces--IncomingRequests_4", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "Segment" + }, + { + "columnId": "microsoft.eventhub/namespaces--IncomingRequests", + "label": "Incoming Requests" + }, + { + "columnId": "microsoft.eventhub/namespaces--IncomingRequests Timeline", + "label": "Incoming Requests Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--SuccessfulRequests", + "label": "Successful Requests" + }, + { + "columnId": "microsoft.eventhub/namespaces--SuccessfulRequests Timeline", + "label": "Successful Requests Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--ServerErrors", + "label": "Server Errors." + }, + { + "columnId": "microsoft.eventhub/namespaces--ServerErrors Timeline", + "label": "Server Errors. Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--UserErrors", + "label": "User Errors." + }, + { + "columnId": "microsoft.eventhub/namespaces--UserErrors Timeline", + "label": "User Errors. Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--ThrottledRequests", + "label": "Throttled Requests." + }, + { + "columnId": "microsoft.eventhub/namespaces--ThrottledRequests Timeline", + "label": "Throttled Requests. Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--QuotaExceededErrors", + "label": "Quota Exceeded Errors." + }, + { + "columnId": "microsoft.eventhub/namespaces--QuotaExceededErrors Timeline", + "label": "Quota Exceeded Errors. Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.eventhub/namespaces--IncomingRequests_4", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Requests" + }, + "showPin": true, + "name": "Requests" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.eventhub/namespaces", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--IncomingMessages", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--OutgoingMessages", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--CapturedMessages", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--CaptureBacklog", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "gridFormatType": 2, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--IncomingMessages", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--IncomingMessages Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--OutgoingMessages", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--OutgoingMessages Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--CapturedMessages", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--CapturedMessages Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--CaptureBacklog", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--CaptureBacklog Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": ".*\\/Incoming Messages$", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": ".*\\/Outgoing Messages$", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.eventhub/namespaces--IncomingMessages_4", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "microsoft.eventhub/namespaces--IncomingMessages", + "label": "Incoming Messages" + }, + { + "columnId": "microsoft.eventhub/namespaces--IncomingMessages Timeline", + "label": "Incoming Messages Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--OutgoingMessages", + "label": "Outgoing Messages" + }, + { + "columnId": "microsoft.eventhub/namespaces--OutgoingMessages Timeline", + "label": "Outgoing Messages Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--CapturedMessages", + "label": "Captured Messages" + }, + { + "columnId": "microsoft.eventhub/namespaces--CapturedMessages Timeline", + "label": "Captured Messages Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--CaptureBacklog", + "label": "Capture Backlog" + }, + { + "columnId": "microsoft.eventhub/namespaces--CaptureBacklog Timeline", + "label": "Capture Backlog Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.eventhub/namespaces--IncomingMessages_4", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Messages" + }, + "showPin": true, + "name": "Messages" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.eventhub/namespaces", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--IncomingBytes", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--OutgoingBytes", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.eventhub/namespaces", + "metric": "microsoft.eventhub/namespaces--CapturedBytes", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "gridFormatType": 2, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--IncomingBytes", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 36, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--IncomingBytes Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--OutgoingBytes", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 36, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--OutgoingBytes Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--CapturedBytes", + "formatter": 1, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 36, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--CapturedBytes Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.eventhub/namespaces--IncomingBytes_4", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "microsoft.eventhub/namespaces--IncomingBytes", + "label": "Incoming Bytes." + }, + { + "columnId": "microsoft.eventhub/namespaces--IncomingBytes Timeline", + "label": "Incoming Bytes Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--OutgoingBytes", + "label": "Outgoing Bytes" + }, + { + "columnId": "microsoft.eventhub/namespaces--OutgoingBytes Timeline", + "label": "Outgoing Bytes Timeline" + }, + { + "columnId": "microsoft.eventhub/namespaces--CapturedBytes", + "label": "Captured Bytes" + }, + { + "columnId": "microsoft.eventhub/namespaces--CapturedBytes Timeline", + "label": "Captured Bytes Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.eventhub/namespaces--IncomingBytes_4", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Throughput" + }, + "showPin": true, + "name": "Throughput" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "Event Hub Resources" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Insights/Workbooks/EventHub/settings.json b/Insights/Workbooks/EventHub/settings.json new file mode 100644 index 0000000..4bbbe14 --- /dev/null +++ b/Insights/Workbooks/EventHub/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Event Hub Overview", + "isPreview": true, + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorInsights", "order": 100 }, { "type": "eventhub-insights", "resourceType": "Azure Monitor", "order": 100 }] +} \ No newline at end of file diff --git a/Insights/Workbooks/RedisCache/Insights.workbook b/Insights/Workbooks/RedisCache/Insights.workbook new file mode 100644 index 0000000..25e2290 --- /dev/null +++ b/Insights/Workbooks/RedisCache/Insights.workbook @@ -0,0 +1,1196 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All subscriptions with Azure Cache for Redis", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.cache/redis'\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "f60ea0a0-3703-44ca-a59b-df0246423f41", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "Azure Cache for Redis", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.cache/redis'\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = name, selected = Rank <= 5", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "182d6324-854c-4cc0-802a-de4f3bee9f76", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + } + ], + "allowCustom": true + } + }, + { + "id": "5ab45df9-371b-4dba-8ee3-6ec9fbb33ff9", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "where type =~ 'microsoft.cache/redis'\r\n| summarize Selected = countif(id in ({Resources:value})), Total = count()\r\n| extend Selected = iff(Selected > 200, 200, Selected)\r\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "46dfcfa4-d5d4-47c2-9dfd-ca0fcb935dc7", + "version": "KqlParameterItem/1.0", + "name": "ResourceName", + "type": 1, + "description": "Used for 'No Subscriptions' workbook template", + "value": "Azure Cache for Redis", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'Azure Cache for Redis'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "Azure Cache for Redis" + } + } + ] + }, + { + "id": "1c84117c-7449-4484-b693-00f41a578bd6", + "version": "KqlParameterItem/1.0", + "name": "ResourceImageUrl", + "type": 1, + "description": "Used for 'No Subscriptions' workbook template", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Common/noSubscriptions", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isEqualTo", + "value": "" + }, + "name": "No Subscriptions group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "{Message}\r\n_Azure Cache for Redis_\r\n
\r\n
" + }, + "name": "text - 5", + "styleSettings": { + "margin": "15px 0 10px 10px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Operations", + "subTarget": "Operations", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Usage", + "subTarget": "Usage", + "style": "link", + "workbookContext": {}, + "alertRuleContext": {} + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Failures", + "subTarget": "Failures", + "style": "link" + } + ] + }, + "name": "links - 2", + "styleSettings": { + "margin": "-15px 0px -15px 0px" + } + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemory", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemorypercentage", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--serverLoad", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--percentProcessorTime", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--connectedclients", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--errors", + "aggregation": 3, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "insights", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--usedmemorypercentage", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--usedmemorypercentage Timeline", + "formatter": 5, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--usedmemory", + "formatter": 1, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 36, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--usedmemory Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--serverLoad", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.cache/redis--serverLoad Timeline", + "formatter": 21, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--percentProcessorTime", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--percentProcessorTime Timeline", + "formatter": 5, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--connectedclients", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--connectedclients Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--cachemisses", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--cachemisses Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--errors", + "formatter": 4, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--errors Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "microsoft.cache/redis--usedmemory", + "label": "Used Memory" + }, + { + "columnId": "microsoft.cache/redis--usedmemory Timeline", + "label": "Used Memory Timeline" + }, + { + "columnId": "microsoft.cache/redis--usedmemorypercentage", + "label": "Used Memory Percentage" + }, + { + "columnId": "microsoft.cache/redis--usedmemorypercentage Timeline", + "label": "Used Memory Percentage Timeline" + }, + { + "columnId": "microsoft.cache/redis--serverLoad", + "label": "Server Load" + }, + { + "columnId": "microsoft.cache/redis--serverLoad Timeline", + "label": "Server Load Timeline" + }, + { + "columnId": "microsoft.cache/redis--percentProcessorTime", + "label": "CPU" + }, + { + "columnId": "microsoft.cache/redis--percentProcessorTime Timeline", + "label": "CPU Timeline" + }, + { + "columnId": "microsoft.cache/redis--connectedclients", + "label": "Connected Clients" + }, + { + "columnId": "microsoft.cache/redis--connectedclients Timeline", + "label": "Connected Clients Timeline" + }, + { + "columnId": "microsoft.cache/redis--cachemisses", + "label": "Cache Misses" + }, + { + "columnId": "microsoft.cache/redis--cachemisses Timeline", + "label": "Cache Misses Timeline" + }, + { + "columnId": "microsoft.cache/redis--errors", + "label": "Errors (Max)" + }, + { + "columnId": "microsoft.cache/redis--errors Timeline", + "label": "Errors Timeline" + } + ] + }, + "sortBy": [], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "showPin": true, + "name": "Overview" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--totalcommandsprocessed", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--operationsPerSecond", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--getcommands", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--setcommands", + "aggregation": 1, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "insights", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--totalcommandsprocessed", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--totalcommandsprocessed Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--operationsPerSecond", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.cache/redis--operationsPerSecond Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--getcommands", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--getcommands Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--setcommands", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--setcommands Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.cache/redis--totalcommandsprocessed_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "microsoft.cache/redis--totalcommandsprocessed", + "label": "Total Operations" + }, + { + "columnId": "microsoft.cache/redis--totalcommandsprocessed Timeline", + "label": "Total Operations Timeline" + }, + { + "columnId": "microsoft.cache/redis--operationsPerSecond", + "label": "Operations Per Second" + }, + { + "columnId": "microsoft.cache/redis--operationsPerSecond Timeline", + "label": "Operations Per Second Timeline" + }, + { + "columnId": "microsoft.cache/redis--getcommands", + "label": "Gets" + }, + { + "columnId": "microsoft.cache/redis--getcommands Timeline", + "label": "Gets Timeline" + }, + { + "columnId": "microsoft.cache/redis--setcommands", + "label": "Sets" + }, + { + "columnId": "microsoft.cache/redis--setcommands Timeline", + "label": "Sets Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.cache/redis--totalcommandsprocessed_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Operations" + }, + "showPin": true, + "name": "Operations" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheWrite", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses", + "aggregation": 1, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "insights", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--cacheRead", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 45, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--cacheRead Timeline", + "formatter": 21, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--cacheWrite", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 45, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--cacheWrite Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--cachehits", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--cachehits Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--cachemisses", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--cachemisses Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.cache/redis--cacheRead_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "microsoft.cache/redis--cacheRead", + "label": "Cache Read" + }, + { + "columnId": "microsoft.cache/redis--cacheRead Timeline", + "label": "Cache Read Timeline" + }, + { + "columnId": "microsoft.cache/redis--cacheWrite", + "label": "Cache Write" + }, + { + "columnId": "microsoft.cache/redis--cacheWrite Timeline", + "label": "Cache Write Timeline" + }, + { + "columnId": "microsoft.cache/redis--cachehits", + "label": "Cache Hits" + }, + { + "columnId": "microsoft.cache/redis--cachehits Timeline", + "label": "Cache Hits Timeline" + }, + { + "columnId": "microsoft.cache/redis--cachemisses", + "label": "Cache Misses" + }, + { + "columnId": "microsoft.cache/redis--cachemisses Timeline", + "label": "Cache Misses Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.cache/redis--cacheRead_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Usage" + }, + "showPin": true, + "name": "Usage" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--errors", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--errors", + "aggregation": 1, + "splitBy": "ErrorType", + "splitBySortOrder": -1, + "splitByLimit": 7 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "insights", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.cache/redis--errors", + "formatter": 4, + "formatOptions": { + "palette": "red", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.cache/redis--errors Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": ".*\\/Errors$", + "formatter": 4, + "formatOptions": { + "palette": "red", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "microsoft.cache/redis--errors", + "label": "Total Errors" + }, + { + "columnId": "microsoft.cache/redis--errors Timeline", + "label": "Errors Timeline" + } + ] + }, + "sortBy": [], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Failures" + }, + "showPin": true, + "name": "Failures" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "Azure Cache for Redis Resources" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Insights/Workbooks/RedisCache/settings.json b/Insights/Workbooks/RedisCache/settings.json new file mode 100644 index 0000000..9862337 --- /dev/null +++ b/Insights/Workbooks/RedisCache/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Azure Cache for Redis Overview", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorInsights", "order": 100 }, { "type": "rediscache-insights", "resourceType": "Azure Monitor", "order": 100 }] +} \ No newline at end of file diff --git a/Insights/Workbooks/ServiceBus/Insights.workbook b/Insights/Workbooks/ServiceBus/Insights.workbook new file mode 100644 index 0000000..75e829c --- /dev/null +++ b/Insights/Workbooks/ServiceBus/Insights.workbook @@ -0,0 +1,1290 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All subscriptions with Service Bus Namespaces", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.servicebus/namespaces'\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "f60ea0a0-3703-44ca-a59b-df0246423f41", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "Service Bus namespaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.servicebus/namespaces'\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = name, selected = Rank <= 5", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "value": [ + "value::all" + ] + }, + { + "id": "182d6324-854c-4cc0-802a-de4f3bee9f76", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + } + ], + "allowCustom": true + } + }, + { + "id": "5ab45df9-371b-4dba-8ee3-6ec9fbb33ff9", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "where type =~ 'microsoft.servicebus/namespaces'\r\n| summarize Selected = countif(id in ({Resources:value})), Total = count()\r\n| extend Selected = iff(Selected > 200, 200, Selected)\r\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "14902b80-a8e2-4e85-a6c4-ed9dd6d879dd", + "version": "KqlParameterItem/1.0", + "name": "ResourceName", + "type": 1, + "description": "Used in 'No Subscriptions' workbook template", + "value": "Service Bus", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'Service Bus'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "Service Bus" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "7282c5ea-7b4e-4ba2-9b52-5857bdd27e49", + "version": "KqlParameterItem/1.0", + "name": "ResourceImageUrl", + "type": 1, + "description": "Used in 'No Subscriptions' workbook template", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Common/noSubscriptions", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isEqualTo", + "value": "" + }, + "name": "No Subscriptions group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "{Message}\r\n_Service Bus Namespaces_\r\n
\r\n
" + }, + "name": "text - 5", + "styleSettings": { + "margin": "15px 0 10px 10px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Requests", + "subTarget": "Requests", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Messages", + "subTarget": "Messages", + "style": "link" + } + ] + }, + "name": "links - 2", + "styleSettings": { + "margin": "-15px 0px -15px 0px" + } + }, + { + "type": 10, + "content": { + "chartId": "workbookca52111a-459a-4141-82a2-23d274cdae17", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.servicebus/namespaces", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--ActiveConnections", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--ConnectionsOpened", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--ConnectionsClosed", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--SuccessfulRequests", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--ThrottledRequests", + "aggregation": 1, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ActiveConnections", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ActiveConnections Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ConnectionsOpened", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ConnectionsOpened Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ConnectionsClosed", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ConnectionsClosed Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--SuccessfulRequests", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--SuccessfulRequests Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ThrottledRequests", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ThrottledRequests Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.servicebus/namespaces--ActiveConnections_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "microsoft.servicebus/namespaces--ActiveConnections", + "label": "ActiveConnections" + }, + { + "columnId": "microsoft.servicebus/namespaces--ActiveConnections Timeline", + "label": "ActiveConnections Timeline" + }, + { + "columnId": "microsoft.servicebus/namespaces--ConnectionsOpened", + "label": "Connections Opened." + }, + { + "columnId": "microsoft.servicebus/namespaces--ConnectionsOpened Timeline", + "label": "Connections Opened. Timeline" + }, + { + "columnId": "microsoft.servicebus/namespaces--ConnectionsClosed", + "label": "Connections Closed." + }, + { + "columnId": "microsoft.servicebus/namespaces--ConnectionsClosed Timeline", + "label": "Connections Closed. Timeline" + }, + { + "columnId": "microsoft.servicebus/namespaces--SuccessfulRequests", + "label": "Successful Requests" + }, + { + "columnId": "microsoft.servicebus/namespaces--SuccessfulRequests Timeline", + "label": "Successful Requests Timeline" + }, + { + "columnId": "microsoft.servicebus/namespaces--ThrottledRequests", + "label": "Throttled Requests." + }, + { + "columnId": "microsoft.servicebus/namespaces--ThrottledRequests Timeline", + "label": "Throttled Requests. Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.servicebus/namespaces--ActiveConnections_3", + "sortOrder": 2 + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.servicebus/namespaces", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--IncomingRequests", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--SuccessfulRequests", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--ServerErrors", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--UserErrors", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--ThrottledRequests", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--ActiveConnections", + "aggregation": 1, + "splitBy": null + } + ], + "gridFormatType": 2, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--IncomingRequests", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--IncomingRequests Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--SuccessfulRequests", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--SuccessfulRequests Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ServerErrors", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ServerErrors Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--UserErrors", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--UserErrors Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ThrottledRequests", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ThrottledRequests Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ActiveConnections", + "formatter": 5, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ActiveConnections Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.servicebus/namespaces--IncomingRequests_4", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "Segment" + }, + { + "columnId": "microsoft.servicebus/namespaces--IncomingRequests", + "label": "Incoming Requests" + }, + { + "columnId": "microsoft.servicebus/namespaces--IncomingRequests Timeline", + "label": "Incoming Requests Timeline" + }, + { + "columnId": "microsoft.servicebus/namespaces--SuccessfulRequests", + "label": "Successful Requests" + }, + { + "columnId": "microsoft.servicebus/namespaces--SuccessfulRequests Timeline", + "label": "Successful Requests Timeline" + }, + { + "columnId": "microsoft.servicebus/namespaces--ServerErrors", + "label": "Server Errors." + }, + { + "columnId": "microsoft.servicebus/namespaces--ServerErrors Timeline", + "label": "Server Errors. Timeline" + }, + { + "columnId": "microsoft.servicebus/namespaces--UserErrors", + "label": "User Errors." + }, + { + "columnId": "microsoft.servicebus/namespaces--UserErrors Timeline", + "label": "User Errors. Timeline" + }, + { + "columnId": "microsoft.servicebus/namespaces--ThrottledRequests", + "label": "Throttled Requests." + }, + { + "columnId": "microsoft.servicebus/namespaces--ThrottledRequests Timeline", + "label": "Throttled Requests. Timeline" + }, + { + "columnId": "microsoft.servicebus/namespaces--ActiveConnections", + "label": "ActiveConnections (Average)" + }, + { + "columnId": "microsoft.servicebus/namespaces--ActiveConnections Timeline", + "label": "ActiveConnections (Average) Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.servicebus/namespaces--IncomingRequests_4", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Requests" + }, + "showPin": true, + "name": "Requests" + }, + { + "type": 10, + "content": { + "chartId": "workbook19356bdc-cfd5-47c7-8e70-05bbd3f39558", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.servicebus/namespaces", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--IncomingMessages", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--OutgoingMessages", + "aggregation": 1, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--Messages", + "aggregation": 4, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--ScheduledMessages", + "aggregation": 4, + "splitBy": "EntityName", + "splitBySortOrder": -1, + "splitByLimit": 5, + "columnName": "Scheduled messages in a Queue/Topic" + }, + { + "namespace": "microsoft.servicebus/namespaces", + "metric": "microsoft.servicebus/namespaces--ActiveConnections", + "aggregation": 1, + "splitBy": null + } + ], + "gridFormatType": 2, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--IncomingMessages", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--IncomingMessages Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--OutgoingMessages", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--OutgoingMessages Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--Messages", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--Messages Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Scheduled messages in a Queue/Topic", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Scheduled messages in a Queue/Topic Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ActiveConnections", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ActiveConnections Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ScheduledMessages", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.servicebus/namespaces--ScheduledMessages Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--IncomingMessages", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--IncomingMessages Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--OutgoingMessages", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--OutgoingMessages Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--CapturedMessages", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--CapturedMessages Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--CaptureBacklog", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.eventhub/namespaces--CaptureBacklog Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": ".*\\/Incoming Messages$", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": ".*\\/Outgoing Messages$", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.servicebus/namespaces--IncomingMessages_4", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "Segment" + }, + { + "columnId": "microsoft.servicebus/namespaces--IncomingMessages", + "label": "Incoming Messages" + }, + { + "columnId": "microsoft.servicebus/namespaces--IncomingMessages Timeline", + "label": "Incoming Messages Timeline" + }, + { + "columnId": "microsoft.servicebus/namespaces--OutgoingMessages", + "label": "Outgoing Messages" + }, + { + "columnId": "microsoft.servicebus/namespaces--OutgoingMessages Timeline", + "label": "Outgoing Messages Timeline" + }, + { + "columnId": "microsoft.servicebus/namespaces--Messages", + "label": "Messages in a Queue/Topic." + }, + { + "columnId": "microsoft.servicebus/namespaces--Messages Timeline", + "label": "Count of messages in a Queue/Topic. Timeline" + }, + { + "columnId": "microsoft.servicebus/namespaces--ActiveConnections", + "label": "ActiveConnections (Sum)" + }, + { + "columnId": "microsoft.servicebus/namespaces--ActiveConnections Timeline", + "label": "ActiveConnections (Sum) Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.servicebus/namespaces--IncomingMessages_4", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Messages" + }, + "showPin": true, + "name": "Messages" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "Service Bus Resources" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Insights/Workbooks/ServiceBus/settings.json b/Insights/Workbooks/ServiceBus/settings.json new file mode 100644 index 0000000..79e3538 --- /dev/null +++ b/Insights/Workbooks/ServiceBus/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Service Bus Overview", + "isPreview": true, + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorInsights", "order": 100 }, { "type": "servicebus-insights", "resourceType": "Azure Monitor", "order": 100 }] +} \ No newline at end of file diff --git a/Insights/Workbooks/categoryResources.json b/Insights/Workbooks/categoryResources.json new file mode 100644 index 0000000..7fc7880 --- /dev/null +++ b/Insights/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Insights", "description": "Provides insights for your Azure Resources", "order": 2000} +} \ No newline at end of file diff --git a/Intune Audit/Alerts/README b/Intune Audit/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Intune Audit/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Intune Audit/Queries/README b/Intune Audit/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Intune Audit/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Intune Audit/Workbooks/Audit/IntuneAuditActivity.workbook b/Intune Audit/Workbooks/Audit/IntuneAuditActivity.workbook new file mode 100644 index 0000000..122824e --- /dev/null +++ b/Intune Audit/Workbooks/Audit/IntuneAuditActivity.workbook @@ -0,0 +1,353 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Intune Audit Activity " + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Parameters" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "2f5ebb32-5fb9-4b48-a175-2f8d34f1264b", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 259200000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "timeContextFromParameter": null + } + ], + "style": "pills", + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Audit Events Trend" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "IntuneAuditLogs\r\n| summarize count() by bin(TimeGenerated, {TimeRange:grain})", + "showQuery": false, + "size": 1, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "barchart" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Activity Types" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Top users with audited actions" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "IntuneAuditLogs\r\n| summarize OperationCount=count() by OperationName \r\n| sort by OperationCount desc", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "OperationCount", + "formatter": 3, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "IntuneAuditLogs\r\n| extend myJson=todynamic(Properties)\r\n| summarize OperationCount=count() by Identity \r\n| sort by OperationCount desc", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "OperationCount", + "formatter": 3, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "# Remote actions" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Remote actions by action type" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Remote actions top users" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "IntuneAuditLogs\r\n| where OperationName contains \"ManagedDevice\" \r\n| summarize OperationCount=count() by OperationName\r\n| sort by OperationCount desc ", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "OperationCount", + "formatter": 3, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "IntuneAuditLogs\r\n| where OperationName contains \"ManagedDevice\" \r\n| summarize OperationCount=count() by Identity\r\n| sort by OperationCount desc ", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:46:59.079Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "OperationCount", + "formatter": 3, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Intune Audit/Workbooks/Audit/settings.json b/Intune Audit/Workbooks/Audit/settings.json new file mode 100644 index 0000000..a548f36 --- /dev/null +++ b/Intune Audit/Workbooks/Audit/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Intune Audit Activity", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.intune/tenant", "order": 100 }] +} \ No newline at end of file diff --git a/Intune Audit/Workbooks/categoryResources.json b/Intune Audit/Workbooks/categoryResources.json new file mode 100644 index 0000000..1e0ff91 --- /dev/null +++ b/Intune Audit/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Audit", "description": "Provides insights on audited usage of Intune", "order": 100} +} \ No newline at end of file diff --git a/Intune Compliance/Alerts/README b/Intune Compliance/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Intune Compliance/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Intune Compliance/Queries/README b/Intune Compliance/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Intune Compliance/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Intune Compliance/Workbooks/Compliance/IntuneCompliance.workbook b/Intune Compliance/Workbooks/Compliance/IntuneCompliance.workbook new file mode 100644 index 0000000..c09199f --- /dev/null +++ b/Intune Compliance/Workbooks/Compliance/IntuneCompliance.workbook @@ -0,0 +1,258 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Intune Compliance Activity" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Parameters" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e619c617-b735-4537-bcea-725a2d69d447", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 259200000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "timeContextFromParameter": null + } + ], + "style": "pills", + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Devices not in compliance Trend" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ComplianceLogs=\r\nIntuneOperationalLogs \r\n| where OperationName == \"Compliance\" \r\n| project TimeGenerated, Properties;\r\nComplianceLogs\r\n| sort by TimeGenerated desc\r\n| join (\r\nComplianceLogs\r\n| extend myJson = todynamic(Properties)\r\n| project-away Properties\r\n| extend IntuneDeviceId=tostring(myJson[\"IntuneDeviceId\"]) \r\n| project TimeGenerated, IntuneDeviceId\r\n| summarize TimeGenerated=max(TimeGenerated) by IntuneDeviceId \r\n) on TimeGenerated\r\n| project-away TimeGenerated1, IntuneDeviceId \r\n| summarize EventCount=count() by bin(TimeGenerated, {TimeRange:grain})", + "showQuery": false, + "size": 2, + "aggregation": 0, + "showAnnotations": true, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "barchart" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Compliance Failures by Failure Reason" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Compliance Failures by Operating System" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ComplianceLogs=\r\nIntuneOperationalLogs \r\n| where OperationName == \"Compliance\" \r\n| project TimeGenerated, Properties;\r\nComplianceLogs\r\n| sort by TimeGenerated desc\r\n| join (\r\nComplianceLogs\r\n| extend myJson = todynamic(Properties)\r\n| project-away Properties\r\n| extend IntuneDeviceId=tostring(myJson[\"IntuneDeviceId\"]) \r\n| project TimeGenerated, IntuneDeviceId\r\n| summarize TimeGenerated=max(TimeGenerated) by IntuneDeviceId \r\n) on TimeGenerated\r\n| project-away TimeGenerated1, IntuneDeviceId \r\n| extend myJson=todynamic(Properties)\r\n| project-away Properties\r\n| extend Description=tostring(myJson[\"Description\"])\r\n| extend Description=tostring(extract(\"(.*?)_IID_.*\", 1, tostring(Description)))\r\n| extend Reason = tostring(extract(\"(.*?)\\\\.(.*)\", 2, tostring(Description)))\r\n| summarize FailureCount=count() by Reason \r\n| sort by FailureCount desc", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "FailureCount", + "formatter": 3, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ComplianceLogs=\r\nIntuneOperationalLogs \r\n| where OperationName == \"Compliance\" \r\n| project TimeGenerated, Properties;\r\nComplianceLogs\r\n| sort by TimeGenerated desc\r\n| join (\r\nComplianceLogs\r\n| extend myJson = todynamic(Properties)\r\n| project-away Properties\r\n| extend IntuneDeviceId=tostring(myJson[\"IntuneDeviceId\"]) \r\n| project TimeGenerated, IntuneDeviceId\r\n| summarize TimeGenerated=max(TimeGenerated) by IntuneDeviceId \r\n) on TimeGenerated\r\n| project-away TimeGenerated1, IntuneDeviceId \r\n| extend myJson=todynamic(Properties)\r\n| project-away Properties\r\n| extend DeviceOperatingSystem=tostring(myJson[\"DeviceOperatingSystem\"]) \r\n| summarize FailureCount=count() by DeviceOperatingSystem\r\n| sort by FailureCount desc", + "showQuery": false, + "size": 2, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:47:02.400Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "FailureCount", + "formatter": 3, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Intune Compliance/Workbooks/Compliance/settings.json b/Intune Compliance/Workbooks/Compliance/settings.json new file mode 100644 index 0000000..3befe19 --- /dev/null +++ b/Intune Compliance/Workbooks/Compliance/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Intune Compliance Activity", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.intune/tenant", "order": 100 }] +} \ No newline at end of file diff --git a/Intune Compliance/Workbooks/categoryResources.json b/Intune Compliance/Workbooks/categoryResources.json new file mode 100644 index 0000000..0c61f44 --- /dev/null +++ b/Intune Compliance/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Compliance", "description": "Provides insights on device compliance in Intune", "order": 300} +} \ No newline at end of file diff --git a/Intune Enrollment/Alerts/README b/Intune Enrollment/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Intune Enrollment/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Intune Enrollment/Queries/README b/Intune Enrollment/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Intune Enrollment/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Intune Enrollment/Workbooks/Enrollment/IntuneEnrollment.workbook b/Intune Enrollment/Workbooks/Enrollment/IntuneEnrollment.workbook new file mode 100644 index 0000000..607829b --- /dev/null +++ b/Intune Enrollment/Workbooks/Enrollment/IntuneEnrollment.workbook @@ -0,0 +1,384 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Intune Enrollment Activity" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Parameters" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "a818bb60-9a8a-4c44-80ae-b846beec63b6", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 259200000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "timeContextFromParameter": null + } + ], + "style": "pills", + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Enrollment Events Trend" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "IntuneOperationalLogs\r\n| where OperationName==\"Enrollment\"\r\n| summarize OperationCount=count() by bin(TimeGenerated, {TimeRange:grain})", + "showQuery": false, + "size": 1, + "aggregation": 1, + "showAnnotations": true, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Enrollment Statistics" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Enrollment Success by Enrollment Type" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "IntuneOperationalLogs\r\n| where OperationName == \"Enrollment\"\r\n| summarize count() by Result\r\n", + "showQuery": false, + "size": 2, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "IntuneOperationalLogs\r\n| where OperationName == \"Enrollment\" \r\n| where Result == \"Success\" \r\n| extend myJson=todynamic(Properties)\r\n| extend EnrollmentType = tostring(myJson [\"EnrollmentType\"])\r\n| summarize OperationCount=count() by EnrollmentType \r\n| sort by OperationCount desc", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "OperationCount", + "formatter": 3, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "# Enrollment Failures" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Enrollment Failure reasons" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Enrollment Failures by Platform" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "IntuneOperationalLogs\r\n| where OperationName == \"Enrollment\" \r\n| where Result == \"Fail\"\r\n| extend myJson=todynamic(Properties)\r\n| extend FailureReason = tostring(myJson [\"FailureReason\"])\r\n| summarize OperationCount=count() by FailureReason\r\n| sort by OperationCount desc", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "OperationCount", + "formatter": 3, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "IntuneOperationalLogs\r\n| where OperationName == \"Enrollment\" \r\n| where Result == \"Fail\"\r\n| extend myJson=todynamic(Properties)\r\n| extend Platform = tostring(myJson [\"Os\"])\r\n| summarize OperationCount=count() by Platform \r\n| sort by OperationCount desc", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "OperationCount", + "formatter": 3, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Enrollment Failures by Enrollment Type" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "IntuneOperationalLogs\r\n| where OperationName == \"Enrollment\" \r\n| where Result == \"Fail\" \r\n| extend myJson=todynamic(Properties)\r\n| extend EnrollmentType = tostring(myJson [\"EnrollmentType\"])\r\n| summarize OperationCount=count() by EnrollmentType \r\n| sort by OperationCount desc", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-03-04T13:47:02.390Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "OperationCount", + "formatter": 3, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": null + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Intune Enrollment/Workbooks/Enrollment/settings.json b/Intune Enrollment/Workbooks/Enrollment/settings.json new file mode 100644 index 0000000..81ff050 --- /dev/null +++ b/Intune Enrollment/Workbooks/Enrollment/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Intune Enrollment Activity", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.intune/tenant", "order": 100 }] +} \ No newline at end of file diff --git a/Intune Enrollment/Workbooks/categoryResources.json b/Intune Enrollment/Workbooks/categoryResources.json new file mode 100644 index 0000000..66172b8 --- /dev/null +++ b/Intune Enrollment/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Enrollment", "description": "Provides insights on Enrollments in Intune", "order": 200} +} \ No newline at end of file diff --git a/Intune Reports/Alerts/README b/Intune Reports/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Intune Reports/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Intune Reports/Queries/README b/Intune Reports/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Intune Reports/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Intune Reports/Workbooks/Device Compliance Trends/DeviceComplianceTrends.workbook b/Intune Reports/Workbooks/Device Compliance Trends/DeviceComplianceTrends.workbook new file mode 100644 index 0000000..53ea8cc --- /dev/null +++ b/Intune Reports/Workbooks/Device Compliance Trends/DeviceComplianceTrends.workbook @@ -0,0 +1,91 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "### Device compliance\r\n" + }, + "name": "Device Compliance Title" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "17a3f56c-2924-4ba7-a211-4cdf9ef3219c", + "version": "KqlParameterItem/1.0", + "name": "ComplianceState", + "label": "Compliance status", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": " or ", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "ComplianceState ne '9A09757A-6676-43A7-A0F1-F749A406142C'" + }, + "jsonData": "[\r\n { \"label\": \"Compliant\", \"value\": \"ComplianceState eq 'Compliant'\" },\r\n { \"label\": \"In grace period\", \"value\": \"ComplianceState eq 'InGracePeriod'\" },\r\n { \"label\": \"Managed by ConfigMgr\", \"value\": \"ComplianceState eq 'ConfigManager'\" },\r\n { \"label\": \"Not compliant\", \"value\": \"ComplianceState eq 'Noncompliant'\" },\r\n { \"label\": \"Not evaluated\", \"value\": \"ComplianceState eq 'Unknown'\" }\r\n]\r\n" + }, + { + "id": "93093429-1870-4771-bdab-54b91308bcee", + "version": "KqlParameterItem/1.0", + "name": "OS", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": " or ", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "DeviceType ne '9A09757A-6676-43A7-A0F1-F749A406142C'" + }, + "jsonData": "[\r\n { \"label\": \"Android (device administrator)\", \"value\": \"DeviceType eq 'Android'\" },\r\n { \"label\": \"Android (fully managed/dedicated)\", \"value\": \"DeviceType eq 'AndroidEnterprise'\" },\r\n { \"label\": \"Android (work profile)\", \"value\": \"DeviceType eq 'AndroidForWork'\" },\r\n { \"label\": \"iOS\", \"value\": \"DeviceType eq 'IPhone' or DeviceType eq 'IPad' or DeviceType eq 'IPod'\" },\r\n { \"label\": \"macOS\", \"value\": \"DeviceType eq 'MacMDM'\" },\r\n { \"label\": \"Windows\", \"value\": \"DeviceType eq 'Desktop' or DeviceType eq 'Windows' or DeviceType eq 'WinEmbedded' or DeviceType eq 'SurfaceHub'\" },\r\n { \"label\": \"Windows Holographic\", \"value\": \"DeviceType eq 'HoloLens'\" },\r\n { \"label\": \"Windows Mobile\", \"value\": \"DeviceType eq 'WindowsPhone'\" },\r\n { \"label\": \"Other\", \"value\": \"DeviceType eq 'WinMO6' or DeviceType eq 'Nokia' or DeviceType eq 'Mac' or DeviceType eq 'Blackberry' or DeviceType eq 'Palm' or DeviceType eq 'Unknown'\" }\r\n]" + }, + { + "id": "cfcf5e20-05eb-4e7b-985a-25ac582e76d7", + "version": "KqlParameterItem/1.0", + "name": "GraphVersion", + "type": 1, + "isRequired": true, + "value": "test_intune_onedf", + "isHiddenWhenLocked": true + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "Device Compliance Parameters" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"IntuneQuery/1.0\",\"timeContext\":null,\"queryVersion\":\"{GraphVersion}\",\"body\":\"{\\n \\\"name\\\": \\\"deviceComplianceTrend\\\",\\n\\t\\\"filter\\\": \\\"({ComplianceState}) and ({OS})\\\",\\n\\t\\\"select\\\": [\\\"Date\\\", \\\"ComplianceState\\\", \\\"Count\\\"],\\n\\t\\\"top\\\": 10000\\n}\"}", + "size": 0, + "aggregation": 5, + "title": "Device compliance (60 day trend)", + "queryType": 11, + "visualization": "areachart" + }, + "name": "Device compliance (60 day trend)" + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Intune Reports/Workbooks/Device Compliance Trends/settings.json b/Intune Reports/Workbooks/Device Compliance Trends/settings.json new file mode 100644 index 0000000..be69a04 --- /dev/null +++ b/Intune Reports/Workbooks/Device Compliance Trends/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Device Compliance Trends", + "author": "Microsoft", + "isPreview": true, + "galleries": [{ "type": "workbook", "resourceType": "microsoft.intune/reports", "order": 100 }] +} \ No newline at end of file diff --git a/Intune Reports/Workbooks/Preview Device Compliance Trends/DeviceComplianceTrends.workbook b/Intune Reports/Workbooks/Preview Device Compliance Trends/DeviceComplianceTrends.workbook new file mode 100644 index 0000000..eb6ff7f --- /dev/null +++ b/Intune Reports/Workbooks/Preview Device Compliance Trends/DeviceComplianceTrends.workbook @@ -0,0 +1,128 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "### Device compliance\r\n" + }, + "name": "Device Compliance Title" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "17a3f56c-2924-4ba7-a211-4cdf9ef3219c", + "version": "KqlParameterItem/1.0", + "name": "ComplianceState", + "label": "Compliance status", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": " or ", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "ComplianceState ne '9A09757A-6676-43A7-A0F1-F749A406142C'" + }, + "jsonData": "[\r\n { \"label\": \"Compliant\", \"value\": \"ComplianceState eq 'Compliant'\" },\r\n { \"label\": \"In grace period\", \"value\": \"ComplianceState eq 'InGracePeriod'\" },\r\n { \"label\": \"Managed by ConfigMgr\", \"value\": \"ComplianceState eq 'ConfigManager'\" },\r\n { \"label\": \"Not compliant\", \"value\": \"ComplianceState eq 'Noncompliant'\" },\r\n { \"label\": \"Not evaluated\", \"value\": \"ComplianceState eq 'Unknown'\" }\r\n]\r\n" + }, + { + "id": "93093429-1870-4771-bdab-54b91308bcee", + "version": "KqlParameterItem/1.0", + "name": "OS", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": " or ", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "DeviceType ne '9A09757A-6676-43A7-A0F1-F749A406142C'" + }, + "jsonData": "[\r\n { \"label\": \"Android (device administrator)\", \"value\": \"DeviceType eq 'Android'\" },\r\n { \"label\": \"Android (fully managed/dedicated)\", \"value\": \"DeviceType eq 'AndroidEnterprise'\" },\r\n { \"label\": \"Android (work profile)\", \"value\": \"DeviceType eq 'AndroidForWork'\" },\r\n { \"label\": \"iOS\", \"value\": \"DeviceType eq 'IPhone' or DeviceType eq 'IPad' or DeviceType eq 'IPod'\" },\r\n { \"label\": \"macOS\", \"value\": \"DeviceType eq 'MacMDM'\" },\r\n { \"label\": \"Windows\", \"value\": \"DeviceType eq 'Desktop' or DeviceType eq 'Windows' or DeviceType eq 'WinEmbedded' or DeviceType eq 'SurfaceHub'\" },\r\n { \"label\": \"Windows Holographic\", \"value\": \"DeviceType eq 'HoloLens'\" },\r\n { \"label\": \"Windows Mobile\", \"value\": \"DeviceType eq 'WindowsPhone'\" },\r\n { \"label\": \"Other\", \"value\": \"DeviceType eq 'WinMO6' or DeviceType eq 'Nokia' or DeviceType eq 'Mac' or DeviceType eq 'Blackberry' or DeviceType eq 'Palm' or DeviceType eq 'Unknown'\" }\r\n]" + }, + { + "id": "925f6154-d457-4b6f-8330-31379d9c52be", + "version": "KqlParameterItem/1.0", + "name": "Schema", + "type": 1, + "value": "", + "isHiddenWhenLocked": true + }, + { + "id": "d2c6b7a4-e789-4953-8ba1-caa278b2fd07", + "version": "KqlParameterItem/1.0", + "name": "Environment", + "type": 1, + "value": "", + "isHiddenWhenLocked": true + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "Device Compliance Parameters" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"IntuneQuery/1.0\",\"timeContext\":null,\"schema\":\"{Schema}\",\"environment\":\"{Environment}\",\"body\":\"{\\n \\\"name\\\": \\\"deviceComplianceTrend\\\",\\n\\t\\\"filter\\\": \\\"({ComplianceState}) and ({OS})\\\",\\n\\t\\\"select\\\": [\\\"Date\\\", \\\"ComplianceState\\\", \\\"Count\\\"],\\n\\t\\\"top\\\": 10000\\n}\"}", + "size": 0, + "aggregation": 5, + "title": "Device compliance (60 day trend)", + "queryType": 11, + "visualization": "areachart", + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "Not compliant", + "label": "", + "color": "redBright" + }, + { + "seriesName": "Not evaluated", + "label": "", + "color": "gray" + }, + { + "seriesName": "Compliant", + "label": "", + "color": "green" + }, + { + "seriesName": "Managed by ConfigMgr", + "label": "", + "color": "blue" + }, + { + "seriesName": "In grace period", + "label": "", + "color": "orange" + } + ] + } + }, + "customWidth": "100", + "name": "Device compliance (60 day trend)", + "styleSettings": { + "maxWidth": "1143px" + } + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Intune Reports/Workbooks/Preview Device Compliance Trends/settings.json b/Intune Reports/Workbooks/Preview Device Compliance Trends/settings.json new file mode 100644 index 0000000..be69a04 --- /dev/null +++ b/Intune Reports/Workbooks/Preview Device Compliance Trends/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Device Compliance Trends", + "author": "Microsoft", + "isPreview": true, + "galleries": [{ "type": "workbook", "resourceType": "microsoft.intune/reports", "order": 100 }] +} \ No newline at end of file diff --git a/Intune Reports/Workbooks/categoryResources.json b/Intune Reports/Workbooks/categoryResources.json new file mode 100644 index 0000000..6de5ecf --- /dev/null +++ b/Intune Reports/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Intune Reports", "description": "Provides insights across various metrics in Intune", "order": 100} +} \ No newline at end of file diff --git a/KeyVault/Alerts/README b/KeyVault/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/KeyVault/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/KeyVault/Queries/README b/KeyVault/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/KeyVault/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/KeyVault/Workbooks/Azure Monitor Onboarding/Azure Monitor Onboarding.workbook b/KeyVault/Workbooks/Azure Monitor Onboarding/Azure Monitor Onboarding.workbook new file mode 100644 index 0000000..20c457f --- /dev/null +++ b/KeyVault/Workbooks/Azure Monitor Onboarding/Azure Monitor Onboarding.workbook @@ -0,0 +1,274 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "d5d7c033-d737-495b-a84c-bdd7e4e78a08", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.keyvault/vaults'\r\n| summarize by subscriptionId\r\n| union (Resources\r\n| where type =~ 'microsoft.keyvault/vaults'\r\n| summarize Count = count() by subscriptionId\r\n| top 1 by Count desc)\r\n| summarize Count = count() by subscriptionId\r\n| project value = subscriptionId, label = subscriptionId, selected = Count > 1", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "3be310b0-14a6-416f-ae3c-0a98fda5c729", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroups", + "label": "Resource groups", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type in~('microsoft.keyvault/vaults')\r\n| summarize Count = count() by resourceGroup\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = resourceGroup, label = resourceGroup, selected = Rank == 1", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "827a53dc-62fe-49ee-88a6-f9f751ed5ab3", + "version": "KqlParameterItem/1.0", + "name": "Vaults", + "label": "Key vaults", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "\"", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.keyvault/vaults' and resourceGroup in~({ResourceGroups}) \r\n| project name, id\r\n| union (Resources\r\n| where type =~ 'microsoft.keyvault/vaults' and resourceGroup in~({ResourceGroups}) \r\n| order by name asc\r\n| take 5\r\n| project id, name)\r\n| summarize Count = count() by id, name\r\n| order by name asc\r\n| project value = id, label = id, selected = Count > 1", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "" + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "value": [ + "value::all" + ] + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "KeyVault-Parameters", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "862be1c5-1cd0-42cb-be09-436a38a9d161", + "version": "KqlParameterItem/1.0", + "name": "ResourceScope", + "label": "Resource scope", + "type": 7, + "isRequired": true, + "query": "Resources\r\n| take 1\r\n| project x = dynamic([\"microsoft.keyvault/vaults\", \"microsoft.resources/resourcegroups\", \"microsoft.resources/subscriptions\"])\r\n| mvexpand x to typeof(string)\r\n| extend jkey = 1\r\n| join kind = inner (Resources \r\n| where id in~ ({Vaults})\r\n| summarize Subs = dcount(subscriptionId), resourceGroups = dcount(resourceGroup), resourceCount = count()\r\n| extend jkey = 1) on jkey\r\n| project x, label = 'x', selected = case(x in ('microsoft.keyvault/vaults') and resourceCount <= 3, true, x == 'microsoft.resources/resourcegroups' and resourceGroups <= 3 and resourceCount > 3, true, x == 'microsoft.resources/subscriptions' and resourceGroups > 3 and resourceCount > 3, true, false)\r\n", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "parameters - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "77ba53ba-5914-4226-b790-314de0c13cb4", + "version": "KqlParameterItem/1.0", + "name": "Numerator", + "type": 1, + "isRequired": true, + "query": "let MissingTable = datatable(ResourceId: string) [];\r\nlet onboardedResources = union isfuzzy=true MissingTable, (AzureDiagnostics\r\n| extend ResourceId = tolower(column_ifexists('ResourceId', ''))\r\n| where ResourceId in~({Vaults})\r\n| summarize by ResourceId);\r\nlet data = range i from 1 to 1 step 1\r\n| project resource = todynamic(tolower(strcat('[', '{Vaults}', ']')))\r\n| mvexpand resource to typeof(string) limit 10000\r\n| join kind = fullouter (onboardedResources) on $left.resource == $right.ResourceId;\r\ndata\r\n| summarize Resources = countif(isnotempty(ResourceId))\r\n| extend Rank = 1, Title = 'Enabled'\r\n| union (data\r\n| summarize Resources = countif(isempty(ResourceId))\r\n| extend Rank = 2, Title = 'Disabled', Footer = 'Change')\r\n| order by Rank asc\r\n| extend Subtitle = '⎯⎯⎯'\r\n| where Title == 'Enabled'\r\n| project Numerator = strcat('# ', column_ifexists('Resources',0))", + "crossComponentResources": [ + "{Vaults}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 2592000000 + }, + "queryType": 0, + "resourceType": "{ResourceScope}" + }, + { + "id": "b65ed168-b4d2-452d-ba0e-04c6528b9827", + "version": "KqlParameterItem/1.0", + "name": "Denominator", + "type": 1, + "isRequired": true, + "query": "where type =~ 'microsoft.keyvault/vaults' and resourceGroup in~({ResourceGroups}) \r\n| summarize Selected = countif(id in ({Vaults:value})), Total = count()\r\n| project Message = strcat(' / ', Total)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 4" + }, + { + "type": 1, + "content": { + "json": "{Numerator}{Denominator}\r\n_Key Vaults Fully Onboarded to Key Vault Insights_" + }, + "conditionalVisibilities": [ + { + "parameterName": "Numerator", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "Denominator", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "Numerator", + "comparison": "isNotEqualTo" + }, + "name": "text - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let MissingTable = datatable(ResourceId: string) [];\r\nlet onboardedResources = union isfuzzy=true MissingTable, (AzureDiagnostics\r\n| extend ResourceId = tolower(column_ifexists('ResourceId', ''))\r\n| where ResourceId in~({Vaults})\r\n| summarize by ResourceId);\r\nlet data = range i from 1 to 1 step 1\r\n| project resource = todynamic(tolower(strcat('[', '{Vaults}', ']')))\r\n| mvexpand resource to typeof(string) limit 10000\r\n| join kind = fullouter (onboardedResources) on $left.resource == $right.ResourceId;\r\ndata\r\n| where isnotempty(resource) and isnotnull(resource)\r\n| project Status = iff(isnotempty(ResourceId), 'Collecting', 'Not collecting'), Resource = resource, Action = iff(ResourceId != '', 'View settings', 'Enable')\r\n", + "size": 0, + "title": "Key vaults with diagnostic logs collection", + "noDataMessage": "No Key Vaults found in the selected subscriptions", + "timeContext": { + "durationMs": 2592000000 + }, + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Vaults}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Status", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Collecting", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "warning", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Resource", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + { + "columnMatch": "Action", + "formatter": 1, + "formatOptions": { + "linkColumn": "Resource", + "linkTarget": "Resource", + "subTarget": "diagnostics", + "showIcon": true + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 4" + }, + { + "type": 1, + "content": { + "json": "For additional assistance on how to configure full monitoring coverage, visit the guide on how to [enable Azure Key Vault logging](https://docs.microsoft.com/azure/key-vault/key-vault-logging)." + }, + "name": "text - 5" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/KeyVault/Workbooks/Azure Monitor Onboarding/settings.json b/KeyVault/Workbooks/Azure Monitor Onboarding/settings.json new file mode 100644 index 0000000..61f28ac --- /dev/null +++ b/KeyVault/Workbooks/Azure Monitor Onboarding/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Diagnostics Logs Onboarding", + "author": "Microsoft", + "galleries": [{ "type": "keyvaults-insights", "resourceType": "Azure Monitor", "order": 500 }] +} \ No newline at end of file diff --git a/KeyVault/Workbooks/AzureMonitor/AzureMonitor.workbook b/KeyVault/Workbooks/AzureMonitor/AzureMonitor.workbook new file mode 100644 index 0000000..3662cb3 --- /dev/null +++ b/KeyVault/Workbooks/AzureMonitor/AzureMonitor.workbook @@ -0,0 +1,1711 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "d5d7c033-d737-495b-a84c-bdd7e4e78a08", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.keyvault/vaults'\r\n| summarize by subscriptionId\r\n| union (Resources\r\n| where type =~ 'microsoft.keyvault/vaults'\r\n| summarize Count = count() by subscriptionId\r\n| top 1 by Count desc)\r\n| summarize Count = count() by subscriptionId\r\n| project value = subscriptionId, label = subscriptionId, selected = Count > 1", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "3be310b0-14a6-416f-ae3c-0a98fda5c729", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroups", + "label": "Resource groups", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type in~('microsoft.keyvault/vaults')\r\n| summarize Count = count() by resourceGroup\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = resourceGroup, label = resourceGroup, selected = Rank == 1", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "", + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "827a53dc-62fe-49ee-88a6-f9f751ed5ab3", + "version": "KqlParameterItem/1.0", + "name": "Vaults", + "label": "Key vaults", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "\"", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.keyvault/vaults' and resourceGroup in~({ResourceGroups}) \r\n| project name, id\r\n| union (Resources\r\n| where type =~ 'microsoft.keyvault/vaults' and resourceGroup in~({ResourceGroups}) \r\n| order by name asc\r\n| take 5\r\n| project id, name)\r\n| summarize Count = count() by id, name\r\n| order by name asc\r\n| project value = id, label = id, selected = Count > 1", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "", + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "65f81355-b707-45be-b7e1-f8450b537da4", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "ed145907-5677-426b-8737-66ac01714250", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "where type =~ 'microsoft.keyvault/vaults' and resourceGroup in~({ResourceGroups}) \r\n| summarize Selected = countif(id in ({Vaults:value})), Total = count()\r\n| extend Selected = iff(Selected > 200, 200, Selected)\r\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "148a4084-ce64-44cc-9fdc-6b3ab6c00830", + "version": "KqlParameterItem/1.0", + "name": "ResourceName", + "type": 1, + "description": "Used in 'No Subscription' workbook template", + "value": "Key vault", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'Key vault'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "Key vault" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "d8328492-f765-4a9e-b3cb-3d0d653f403c", + "version": "KqlParameterItem/1.0", + "name": "ResourceImageUrl", + "type": 1, + "description": "Used in 'No Subscription' workbook template", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "KeyVault-Parameters", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Common/noSubscriptions", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "Subscriptions", + "comparison": "isEqualTo", + "value": "" + }, + "name": "No subscriptions" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "862be1c5-1cd0-42cb-be09-436a38a9d161", + "version": "KqlParameterItem/1.0", + "name": "ResourceScope", + "label": "Resource scope", + "type": 7, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| take 1\r\n| project x = dynamic([\"microsoft.keyvault/vaults\", \"microsoft.resources/resourcegroups\", \"microsoft.resources/subscriptions\"])\r\n| mvexpand x to typeof(string)\r\n| extend jkey = 1\r\n| join kind = inner (Resources \r\n| where id in~ ({Vaults})\r\n| summarize Subs = dcount(subscriptionId), resourceGroups = dcount(resourceGroup), resourceCount = count()\r\n| extend jkey = 1) on jkey\r\n| project x, label = 'x', selected = case(x in ('microsoft.keyvault/vaults') and resourceCount <= 3, true, x == 'microsoft.resources/resourcegroups' and resourceGroups <= 3 and resourceCount > 3, true, x == 'microsoft.resources/subscriptions' and resourceGroups > 3 and resourceCount > 3, true, false)\r\n", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "parameters - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Vaults}" + ], + "parameters": [ + { + "id": "0b1cb939-7da4-4819-a4a5-6ebbccb66c4b", + "version": "KqlParameterItem/1.0", + "name": "Enabled", + "type": 1, + "isRequired": true, + "query": "let MissingTable = datatable(ResourceId: string) [];\r\nlet onboardedResources = union isfuzzy=true MissingTable, (AzureDiagnostics\r\n| extend ResourceId = tolower(column_ifexists('ResourceId', ''))\r\n| where ResourceId in~({Vaults})\r\n| summarize by ResourceId);\r\nlet data = range i from 1 to 1 step 1\r\n| project resource = todynamic(tolower(strcat('[', '{Vaults}', ']')))\r\n| mvexpand resource to typeof(string) limit 10000\r\n| join kind = fullouter (onboardedResources) on $left.resource == $right.ResourceId;\r\ndata\r\n| summarize Resources = countif(isnotempty(ResourceId))\r\n| extend Rank = 1, Title = 'Enabled'\r\n| union (data\r\n| summarize Resources = countif(isempty(ResourceId))\r\n| extend Rank = 2, Title = 'Disabled', Footer = 'Change')\r\n| order by Rank asc\r\n| extend Subtitle = '⎯⎯⎯'\r\n| where Title == 'Enabled'\r\n| project Resources", + "crossComponentResources": [ + "{Vaults}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "{ResourceScope}" + }, + { + "id": "6fb54859-db7f-49f5-a041-b595bf05992f", + "version": "KqlParameterItem/1.0", + "name": "Disabled", + "type": 1, + "isRequired": true, + "query": "let MissingTable = datatable(ResourceId: string) [];\r\nlet onboardedResources = union isfuzzy=true MissingTable, (AzureDiagnostics\r\n| extend ResourceId = tolower(column_ifexists('ResourceId', ''))\r\n| where ResourceId in~({Vaults})\r\n| summarize by ResourceId);\r\nlet data = range i from 1 to 1 step 1\r\n| project resource = todynamic(tolower(strcat('[', '{Vaults}', ']')))\r\n| mvexpand resource to typeof(string) limit 10000\r\n| join kind = fullouter (onboardedResources) on $left.resource == $right.ResourceId;\r\ndata\r\n| summarize Resources = countif(isnotempty(ResourceId))\r\n| extend Rank = 1, Title = 'Enabled'\r\n| union (data\r\n| summarize Resources = countif(isempty(ResourceId))\r\n| extend Rank = 2, Title = 'Disabled', Footer = 'Change')\r\n| order by Rank asc\r\n| extend Subtitle = '⎯⎯⎯'\r\n| where Title == 'Disabled'\r\n| project Resources", + "crossComponentResources": [ + "{Vaults}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "{ResourceScope}" + }, + { + "id": "a68a0bd1-aad1-425e-bf8a-1b3dfa58a504", + "version": "KqlParameterItem/1.0", + "name": "Numerator", + "type": 1, + "isRequired": true, + "query": "let MissingTable = datatable(ResourceId: string) [];\r\nlet onboardedResources = union isfuzzy=true MissingTable, (AzureDiagnostics\r\n| extend ResourceId = tolower(column_ifexists('ResourceId', ''))\r\n| where ResourceId in~({Vaults})\r\n| summarize by ResourceId);\r\nlet data = range i from 1 to 1 step 1\r\n| project resource = todynamic(tolower(strcat('[', '{Vaults}', ']')))\r\n| mvexpand resource to typeof(string) limit 10000\r\n| join kind = fullouter (onboardedResources) on $left.resource == $right.ResourceId;\r\ndata\r\n| summarize Resources = countif(isnotempty(ResourceId))\r\n| extend Rank = 1, Title = 'Enabled'\r\n| union (data\r\n| summarize Resources = countif(isempty(ResourceId))\r\n| extend Rank = 2, Title = 'Disabled', Footer = 'Change')\r\n| order by Rank asc\r\n| extend Subtitle = '⎯⎯⎯'\r\n| where Title == 'Enabled'\r\n| project Numerator = strcat('# ', column_ifexists('Resources',0))", + "crossComponentResources": [ + "{Vaults}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 2592000000 + }, + "queryType": 0, + "resourceType": "{ResourceScope}" + }, + { + "id": "adf367da-976a-41d2-9ca5-99b5bdf14b52", + "version": "KqlParameterItem/1.0", + "name": "Denominator", + "type": 1, + "isRequired": true, + "query": "where type =~ 'microsoft.keyvault/vaults' and resourceGroup in~({ResourceGroups}) \r\n| where id in ({Vaults})\r\n| summarize Selected = countif(id in ({Vaults:value})), Total = count()\r\n| project Message = strcat(' / ', Total)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "parameters - 15" + }, + { + "type": 1, + "content": { + "json": "{Message}\r\n_Key vaults_" + }, + "name": "text - 5", + "styleSettings": { + "margin": "15px 0 10px 10px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Failures", + "subTarget": "Failures", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Operations & Latency", + "subTarget": "Diagnose", + "style": "link" + } + ] + }, + "name": "links - 3", + "styleSettings": { + "margin": "15px 0 -70px 0px" + } + }, + { + "type": 1, + "content": { + "json": "## Overview section" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "Overview section" + }, + { + "type": 10, + "content": { + "chartId": "workbook6f5ece70-86e7-4a7e-9a20-72fe3c12eeb4", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{Vaults}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.keyvault/vaults", + "resourceParameter": "Vaults", + "metrics": [ + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiResult", + "aggregation": 1, + "splitBy": "ActivityName", + "splitBySortOrder": -1, + "splitByLimit": 10, + "columnName": "Api hits" + }, + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiResult", + "aggregation": 1, + "splitBy": "ActivityName", + "splitBySortOrder": -1, + "splitByLimit": 5, + "columnName": "Api hit failures", + "filters": [ + { + "key": "StatusCode", + "operator": 1, + "values": [ + "200", + "201", + "202", + "206" + ] + } + ] + }, + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiLatency", + "aggregation": 4, + "splitBy": "ActivityName", + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--SaturationShoebox", + "aggregation": 4, + "splitBy": "ActivityName", + "splitBySortOrder": 2, + "splitByLimit": 5, + "columnName": "Saturation" + } + ], + "gridFormatType": 2, + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "insights", + "showIcon": true, + "workbookContext": { + "componentIdSource": "cell", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/KeyVault/Overview", + "typeSource": "workbook", + "gallerySource": "workbook", + "locationSource": "default" + } + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Api hits", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Api hits Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + } + }, + { + "columnMatch": "Api hit failures", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Api hit failures Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.keyvault/vaults--ServiceApiLatency", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "gray", + "aggregation": "Max" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "microsoft.keyvault/vaults--ServiceApiLatency Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Saturation", + "formatter": 18, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed", + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": ">", + "thresholdValue": "75", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "is Empty", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ], + "aggregation": "Average" + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "0%" + } + }, + { + "columnMatch": "Saturation Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": ".*\\/Total Service Api Hits$", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.keyvault/vaults--ServiceApiResult Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.keyvault/vaults--ServiceApiResult", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "More Details", + "formatter": 7, + "formatOptions": { + "linkTarget": "WorkbookTemplate", + "workbookContext": null + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription", + "Name" + ], + "expandTopLevel": true, + "finalBy": "Segment" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Api hit failures_6", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Name" + }, + { + "columnId": "Segment" + }, + { + "columnId": "Api hits", + "label": "Requests" + }, + { + "columnId": "Api hits Timeline", + "label": "Requests timeline" + }, + { + "columnId": "Api hit failures", + "label": "Request failures" + }, + { + "columnId": "microsoft.keyvault/vaults--ServiceApiLatency", + "label": "Average latency (worst rolled up)" + }, + { + "columnId": "microsoft.keyvault/vaults--ServiceApiLatency Timeline", + "label": "Overall Service Api Latency (Average) Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Api hit failures_6", + "sortOrder": 2 + } + ], + "exportedParameters": [ + { + "fieldName": "Name", + "parameterName": "Vault", + "parameterType": 5, + "defaultValue": "" + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "showPin": true, + "name": "Key vault overview metrics" + }, + { + "type": 1, + "content": { + "json": "## Failures Section" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "text - 16" + }, + { + "type": 10, + "content": { + "chartId": "workbookaf596582-a211-4fb6-b8f4-2f6521cc554f", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{Vaults}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.keyvault/vaults", + "resourceParameter": "Vaults", + "metrics": [ + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiHit", + "aggregation": 1 + }, + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiResult", + "aggregation": 1, + "columnName": "Successes", + "filters": [ + { + "key": "StatusCodeClass", + "operator": 0, + "values": [ + "2xx" + ] + } + ] + }, + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiResult", + "aggregation": 1, + "columnName": "Authentication", + "filters": [ + { + "key": "StatusCode", + "operator": 0, + "values": [ + "401" + ] + }, + { + "key": "StatusCode", + "operator": 0, + "values": [ + "403" + ] + } + ] + }, + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiResult", + "aggregation": 1, + "columnName": "Throttling", + "filters": [ + { + "key": "StatusCode", + "operator": 0, + "values": [ + "429" + ] + } + ] + }, + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiResult", + "aggregation": 1, + "columnName": "Failures", + "filters": [ + { + "key": "StatusCodeClass", + "operator": 1, + "values": [ + "2xx" + ] + }, + { + "key": "StatusCode", + "operator": 1, + "values": [ + "401", + "403", + "429" + ] + } + ] + } + ], + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "insights", + "showIcon": true, + "workbookContext": { + "componentIdSource": "cell", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/KeyVault/Overview", + "typeSource": "workbook", + "gallerySource": "workbook", + "locationSource": "default" + } + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.keyvault/vaults--ServiceApiHit", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.keyvault/vaults--ServiceApiHit Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + } + }, + { + "columnMatch": "Successes", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Successes Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Authentication", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "gray", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Authentication Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Throttling", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "redBright", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Throttling Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Failures", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "redDark", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Failures Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Authentication Error", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "gray", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 2 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "response", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 2 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.keyvault/vaults--ServiceApiResult", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + } + ], + "rowLimit": 10000, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.keyvault/vaults--ServiceApiHit_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Name" + }, + { + "columnId": "microsoft.keyvault/vaults--ServiceApiHit", + "label": "Total Service Api Hits (Sum)" + }, + { + "columnId": "microsoft.keyvault/vaults--ServiceApiHit Timeline", + "label": "Total Service Api Hits Timeline" + }, + { + "columnId": "Authentication", + "label": "Authentication Errors" + }, + { + "columnId": "Failures", + "label": "Other Failures" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.keyvault/vaults--ServiceApiHit_3", + "sortOrder": 2 + } + ], + "exportedParameters": [ + { + "fieldName": "Name", + "parameterName": "Vault", + "parameterType": 5 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Failures" + }, + "showPin": true, + "name": "metric - 18" + }, + { + "type": 1, + "content": { + "json": "## Logs section" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "Logs section" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "" + }, + "name": "text - 7", + "styleSettings": { + "margin": "10px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let rawData = AzureDiagnostics \r\n// Ignore Authentication operations with a 401. This is normal when using Key Vault SDK, first an unauthenticated request is done then the response is used for authentication.\r\n| where Category==\"AuditEvent\" and not (OperationName == \"Authentication\" and httpStatusCode_d == 401)\r\n// Create ResultStatus with all the 'success' results bucked as 'Success'\r\n// Certain operations like StorageAccountAutoSyncKey have no ResultSignature, for now set to 'Success' as well\r\n| extend ResultStatus = case ( ResultSignature == \"\", \"Success\",\r\n ResultSignature == \"OK\", \"Success\",\r\n ResultSignature == \"Accepted\", \"Success\",\r\n ResultSignature); \r\nrawData \r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ResultStatus\r\n| join kind = inner (rawData\r\n | summarize Count = count() by ResultStatus\r\n ) on ResultStatus\r\n| union (rawData\r\n| summarize Count = count()\r\n| extend jkey = 1\r\n| join kind=inner (rawData\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1 \r\n ) on jkey\r\n | extend ResultStatus = 'All'\r\n)\r\n| project ResultStatus, Count, Trend\r\n| order by Count desc;", + "size": 3, + "title": "Operations by Result Status", + "noDataMessage": "Either there are no operations selected or there is no Key Vault log data for this resource. To begin collecting Key Vault data, select the \"Begin Enabling\" link.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "ResultStatus", + "exportParameterName": "ResultStatus", + "exportDefaultValue": "All", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Vaults}" + ], + "visualization": "tiles", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ParentId", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + { + "columnMatch": "Kind", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "ParentId", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": true + } + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "ResultStatus", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "All", + "text": "{0}{1}" + }, + { + "operator": "regex", + "thresholdValue": "Success", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "redBright", + "text": "{0}{1}" + } + ] + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "conditionalVisibility": { + "parameterName": "Enabled", + "comparison": "isNotEqualTo" + }, + "showPin": true, + "name": "Operations and Status codes - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = AzureDiagnostics \r\n| where TimeGenerated {TimeRange}\r\n// Ignore Authentication operations with a 401. This is normal when using Key Vault SDK, first an unauthenticated request is done then the response is used for authentication.\r\n| where Category==\"AuditEvent\" and not (OperationName == \"Authentication\" and httpStatusCode_d == 401)\r\n// Create ResultStatus with all the 'success' results bucked as 'Success'\r\n// Certain operations like StorageAccountAutoSyncKey have no ResultSignature, for now set to 'Success' as well\r\n| extend ResultStatus = case ( ResultSignature == \"\", \"Success\",\r\n ResultSignature == \"OK\", \"Success\",\r\n ResultSignature == \"Accepted\", \"Success\",\r\n ResultSignature)\r\n| where ResultStatus == '{ResultStatus}' or '{ResultStatus}' == 'All';\r\n// Data aggregated to the Resource\r\nlet resourceData = data\r\n| summarize OperationCount = count(), SuccessCount = countif(ResultStatus == \"Success\"), FailureCount = countif(ResultStatus != \"Success\"), PDurationMs = percentile(DurationMs, 99) by Resource, ResourceId\r\n| join kind=inner (data \r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Resource\r\n | project-away TimeGenerated) on Resource\r\n| order by OperationCount desc\r\n| project Name = strcat('☁️ ', Resource), Id = Resource, Type = Resource, ParentId = '', OperationCount, Trend, SuccessCount, FailureCount, PDurationMs, ResourceId;\r\ndata\r\n// Data aggregated to the Resource, OperationName\r\n| summarize OperationCount = count(), SuccessCount = countif(ResultStatus == \"Success\"), FailureCount = countif(ResultStatus != \"Success\"), PDurationMs = percentile(DurationMs, 99) by Resource, OperationName\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Resource, OperationName\r\n | project-away TimeGenerated) on Resource, OperationName\r\n| order by OperationCount desc, Resource asc\r\n| project Name = strcat('⚡ ', OperationName), Id = strcat(Resource, '/', OperationName), ParentId = Resource, OperationCount, Trend, SuccessCount, FailureCount, PDurationMs\r\n| union (resourceData)\r\n| project Name, Id, ParentId, ['Operation count'] = OperationCount, ['Operation count trend'] = Trend, ['Success count'] = SuccessCount, ['Failure count'] = FailureCount, ['p99 Duration'] = PDurationMs, ResourceId", + "size": 0, + "title": "Operations and Status codes", + "noDataMessage": "Either there are no operations selected or there is no Key Vault log data for this resource. To begin collecting Key Vault data, select the \"Begin Enabling\" link. ", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportedParameters": [ + { + "fieldName": "", + "parameterName": "GridRow", + "defaultValue": "{ \"Id\":\"*\" }" + }, + { + "fieldName": "ResourceId", + "parameterName": "Vault", + "parameterType": 5 + } + ], + "showExportToExcel": true, + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Vaults}" + ], + "visualization": "table", + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkColumn": "ResourceId", + "linkTarget": "Resource", + "subTarget": "insights", + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "ResourceId", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/KeyVault/Overview", + "typeSource": "workbook", + "gallerySource": "workbook", + "locationSource": "default" + } + } + }, + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "ParentId", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Operation count", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Operation count trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue" + } + }, + { + "columnMatch": "Success count", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Failure count", + "formatter": 18, + "formatOptions": { + "min": 0, + "palette": "red", + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": ">", + "thresholdValue": "0", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Blank", + "text": "{0}{1}" + } + ] + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "p99 Duration", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": ">=", + "thresholdValue": "5000", + "representation": "4", + "text": "{0}{1}" + }, + { + "operator": ">=", + "thresholdValue": "1000", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "is Empty", + "representation": "more", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Exceeding Threshold Latency", + "formatter": 18, + "formatOptions": { + "min": 0, + "palette": "red", + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": ">", + "thresholdValue": "0", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Kind", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue" + } + } + ], + "filter": true, + "hierarchySettings": { + "idColumn": "Id", + "parentColumn": "ParentId", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": true + }, + "labelSettings": [ + { + "columnId": "Id" + }, + { + "columnId": "ParentId" + }, + { + "columnId": "Operation count", + "label": "Operation Count" + }, + { + "columnId": "Operation count trend", + "label": "Operation Count Trend" + }, + { + "columnId": "Success count", + "label": "Success Count" + }, + { + "columnId": "Failure count", + "label": "Failure Count" + }, + { + "columnId": "ResourceId" + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Title", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Resources", + "formatter": 12, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "rightContent": { + "columnMatch": "Title", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Disabled", + "representation": "2", + "text": "" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "" + } + ] + } + }, + "secondaryContent": { + "columnMatch": "Footer", + "formatter": 1, + "formatOptions": { + "linkTarget": "Url", + "showIcon": true + } + }, + "showBorder": false + } + }, + "conditionalVisibility": { + "parameterName": "Enabled", + "comparison": "isNotEqualTo" + }, + "showPin": true, + "name": "Operations and Status codes" + }, + { + "type": 1, + "content": { + "json": "#### No logs are currently available for the selected Key Vaults resources. Click below to enable logs for monitoring." + }, + "conditionalVisibility": { + "parameterName": "Enabled", + "comparison": "isEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Enabled", + "comparison": "isEqualTo" + }, + { + "parameterName": "Disabled", + "comparison": "isNotEqualTo" + } + ], + "name": "text - 17" + }, + { + "type": 1, + "content": { + "json": "#### You may currently have too many subscriptions and/or key vaults selected at this time. In order to view your data, you may need to reduce the number of subscriptions of vaults selected.\r\n\r\n_If you wish to view these vaults simultaneously, you may need to reconfigure your diagnotic logs settings._" + }, + "conditionalVisibility": { + "parameterName": "Enabled", + "comparison": "isEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Enabled", + "comparison": "isEqualTo" + }, + { + "parameterName": "Disabled", + "comparison": "isEqualTo" + } + ], + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "_ Note that not all of your Key Vault data may be displayed below, to enable additional coverage, select the \"Enable Logs for Monitoring\"_" + }, + "conditionalVisibility": { + "parameterName": "Disabled", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Disabled", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "Enabled", + "comparison": "isNotEqualTo" + } + ], + "name": "text - 15" + }, + { + "type": 1, + "content": { + "json": "_For additional assistance on how to configure diagnostic logs monitoring coverage, visit the guide on how to [enable Azure Key Vault logging](https://docs.microsoft.com/azure/key-vault/key-vault-logging)._" + }, + "customWidth": "72", + "conditionalVisibility": { + "parameterName": "Disabled", + "comparison": "isNotEqualTo" + }, + "name": "text - 14" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "linkTarget": "WorkbookTemplate", + "linkLabel": "Enable", + "style": "primary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/KeyVault/Azure Monitor Onboarding", + "typeSource": "static", + "type": "keyvaults-insights", + "gallerySource": "static", + "gallery": "Azure Monitor" + } + } + ] + }, + "customWidth": "20", + "conditionalVisibility": { + "parameterName": "Disabled", + "comparison": "isNotEqualTo" + }, + "name": "Start collecting link", + "styleSettings": { + "margin": "0px -50px 0px 0px" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Diagnose" + }, + "name": "Logs Tab" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Subscriptions", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "Key Vault Resources" + } + ], + "styleSettings": { + "spacingStyle": "none" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/KeyVault/Workbooks/AzureMonitor/settings.json b/KeyVault/Workbooks/AzureMonitor/settings.json new file mode 100644 index 0000000..7d86a5d --- /dev/null +++ b/KeyVault/Workbooks/AzureMonitor/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Key Vault Overview", + "author": "Microsoft", + "galleries": [{ "type": "keyvaults-insights", "resourceType": "Azure Monitor", "order": 100 }, { "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorInsights", "order": 100 }] +} diff --git a/KeyVault/Workbooks/Overview/Overview.workbook b/KeyVault/Workbooks/Overview/Overview.workbook new file mode 100644 index 0000000..8a3dfa3 --- /dev/null +++ b/KeyVault/Workbooks/Overview/Overview.workbook @@ -0,0 +1,1244 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Vault}" + ], + "parameters": [ + { + "id": "65f81355-b707-45be-b7e1-f8450b537da4", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ] + }, + "resourceType": "microsoft.insights/components", + "value": { + "durationMs": 86400000 + } + }, + { + "id": "5148ddec-5184-4fc2-aa3a-78797fd2c97c", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "query": "Resources\r\n| where type =~ 'microsoft.keyvault/vaults'\r\n| summarize by subscriptionId\r\n| union (Resources\r\n| where type =~ 'microsoft.keyvault/vaults'\r\n| summarize Count = count() by subscriptionId\r\n| top 1 by Count desc)\r\n| summarize Count = count() by subscriptionId\r\n| project value = subscriptionId, label = subscriptionId, selected = Count > 1", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "667d8ad3-370d-4f4d-932f-ea741a47246f", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroups", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type in~('microsoft.keyvault/vaults')\r\n| summarize Count = count() by resourceGroup\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = resourceGroup, label = resourceGroup, selected = Rank == 1", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "982a035d-bf1f-4a2d-8d33-ccb1c11a3b24", + "version": "KqlParameterItem/1.0", + "name": "Vault", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "KeyVault-Parameters" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Vault}" + ], + "parameters": [ + { + "id": "0dbdeddb-f647-49a0-a29b-afdcebf9c446", + "version": "KqlParameterItem/1.0", + "name": "Operations", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "AzureDiagnostics\r\n| where Category == \"AuditEvent\" and not (OperationName == \"Authentication\" and httpStatusCode_d == 401)\r\n| distinct OperationName\r\n| sort by OperationName asc", + "crossComponentResources": [ + "{Vault}" + ], + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.keyvault/vaults" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.keyvault/vaults" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "parameters - 5" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "primary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/KeyVault/Overview", + "typeSource": "workbook", + "gallerySource": "workbook", + "locationSource": "default" + } + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Failures", + "subTarget": "Failures", + "style": "secondary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/KeyVault/Failures", + "typeSource": "workbook", + "gallerySource": "workbook", + "locationSource": "default" + } + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Operations", + "subTarget": "Operations", + "style": "secondary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/KeyVault/Operations", + "typeSource": "workbook", + "gallerySource": "workbook", + "locationSource": "default" + } + } + ] + }, + "name": "links - 11" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 10, + "content": { + "chartId": "workbook9c926351-6286-435e-92a1-1e6b36461b26", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{Vault}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.keyvault/vaults", + "resourceParameter": "Vault", + "metrics": [ + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--Availability", + "aggregation": 4, + "columnName": "Availability" + }, + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiResult", + "aggregation": 1, + "columnName": "Requests" + }, + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiLatency", + "aggregation": 4, + "columnName": "Latency" + } + ], + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "showBorder": false + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.keyvault/vaults--Availability", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": null + } + }, + { + "columnMatch": "microsoft.keyvault/vaults--Availability Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.keyvault/vaults--ServiceApiHit", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": null + } + }, + { + "columnMatch": "microsoft.keyvault/vaults--ServiceApiHit Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.keyvault/vaults--ServiceApiLatency", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 23, + "options": null + } + }, + { + "columnMatch": "microsoft.keyvault/vaults--ServiceApiLatency Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1 + }, + { + "columnMatch": "Aggregation", + "formatter": 5 + }, + { + "columnMatch": "Value", + "formatter": 1 + }, + { + "columnMatch": "Timeline", + "formatter": 9 + } + ], + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "Metrics Summary" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"0b27cf5f-c95e-4c63-8d31-18fe7e409896\",\"mergeType\":\"table\",\"leftTable\":\"Metrics Summary\"}],\"projectRename\":[{\"originalName\":\"[Metrics Summary].Subscription\",\"mergedName\":\"Subscription\",\"fromId\":\"0b27cf5f-c95e-4c63-8d31-18fe7e409896\"},{\"originalName\":\"[Metrics Summary].Name\",\"mergedName\":\"Name\",\"fromId\":\"0b27cf5f-c95e-4c63-8d31-18fe7e409896\"},{\"originalName\":\"[Metrics Summary].Namespace\",\"mergedName\":\"Namespace\",\"fromId\":\"0b27cf5f-c95e-4c63-8d31-18fe7e409896\"},{\"originalName\":\"[Metrics Summary].Metric\",\"mergedName\":\"Metric\",\"fromId\":\"0b27cf5f-c95e-4c63-8d31-18fe7e409896\"},{\"originalName\":\"[Metrics Summary].Metric ID\",\"mergedName\":\"Metric ID\",\"fromId\":\"0b27cf5f-c95e-4c63-8d31-18fe7e409896\"},{\"originalName\":\"[Metrics Summary].Aggregation\",\"mergedName\":\"Aggregation\",\"fromId\":\"0b27cf5f-c95e-4c63-8d31-18fe7e409896\"},{\"originalName\":\"[Metrics Summary].Segment Field\",\"mergedName\":\"Segment Field\",\"fromId\":\"0b27cf5f-c95e-4c63-8d31-18fe7e409896\"},{\"originalName\":\"[Metrics Summary].Segment\",\"mergedName\":\"Segment\",\"fromId\":\"0b27cf5f-c95e-4c63-8d31-18fe7e409896\"},{\"originalName\":\"[Metrics Summary].Value\",\"mergedName\":\"Value\",\"fromId\":\"0b27cf5f-c95e-4c63-8d31-18fe7e409896\"},{\"originalName\":\"[Metrics Summary].Timeline\",\"mergedName\":\"Timeline\",\"fromId\":\"0b27cf5f-c95e-4c63-8d31-18fe7e409896\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Footer\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"condition\":\"if (Metric == 'Availability'), result = 'Average | Percentage'\",\"criteriaContext\":{\"leftOperand\":\"Metric\",\"operator\":\"==\",\"rightValType\":\"static\",\"rightVal\":\"Availability\",\"resultValType\":\"static\",\"resultVal\":\"Average | Percentage\"}},{\"condition\":\"if (Metric == 'Requests'), result = 'Count'\",\"criteriaContext\":{\"leftOperand\":\"Metric\",\"operator\":\"==\",\"rightValType\":\"static\",\"rightVal\":\"Requests\",\"resultValType\":\"static\",\"resultVal\":\"Count\"}},{\"condition\":\"if (Metric == 'Latency'), result = 'Average | Milliseconds'\",\"criteriaContext\":{\"leftOperand\":\"Metric\",\"operator\":\"==\",\"rightValType\":\"static\",\"rightVal\":\"Latency\",\"resultValType\":\"static\",\"resultVal\":\"Average | Milliseconds\"}},{\"condition\":\"Click edit to specify a result for the default condition.\",\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\"}}]}]}", + "size": 4, + "queryType": 7, + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "secondaryContent": { + "columnMatch": "Footer", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": false + } + }, + "name": "query - 7" + }, + { + "type": 10, + "content": { + "chartId": "workbookd90f8427-8926-481b-a174-a5263e1ec913", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{Vault}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.keyvault/vaults", + "resourceParameter": "Vault", + "metrics": [ + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiHit", + "aggregation": 7, + "splitBy": null + } + ], + "title": "Transactions Over Time", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + }, + "showExportToExcel": true + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 7" + }, + { + "type": 10, + "content": { + "chartId": "workbook2eeb5c46-ad23-4153-93a9-7e76d0596a6d", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{Vault}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.keyvault/vaults", + "resourceParameter": "Vault", + "metrics": [ + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiLatency", + "aggregation": 4, + "splitBy": null + } + ], + "title": "Overall Latency", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + }, + "showExportToExcel": true + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 9" + }, + { + "type": 10, + "content": { + "chartId": "workbookb5377ccd-c143-46c3-a4f6-50fef37c75f0", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{Vault}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.keyvault/vaults", + "resourceParameter": "Vault", + "metrics": [ + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--Availability", + "aggregation": 4, + "splitBy": null + } + ], + "title": "Availability", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + }, + "showExportToExcel": true + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 8" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfc3d12-957f-4ac2-a3df-3f4be025c145", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{Vault}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.keyvault/vaults", + "resourceParameter": "Vault", + "metrics": [ + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiHit", + "aggregation": 7, + "splitBy": null + } + ], + "title": "Request Types over Time", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + }, + "showExportToExcel": true + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 10" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "group - 8" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 10, + "content": { + "chartId": "workbook53325e8e-3775-4a59-864c-d973f168b5b1", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{Vault}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.keyvault/vaults", + "resourceParameter": "Vault", + "metrics": [ + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiResult", + "aggregation": 7, + "splitBy": null + } + ], + "title": "Successes (2xx)", + "showOpenInMe": true, + "filters": [ + { + "id": "1", + "key": "StatusCodeClass", + "operator": 0, + "values": [ + "2xx" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 2" + }, + { + "type": 10, + "content": { + "chartId": "workbook1f3a16f5-02e2-4bd7-a171-25a6b60dba93", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{Vault}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.keyvault/vaults", + "resourceParameter": "Vault", + "metrics": [ + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiResult", + "aggregation": 7, + "splitBy": null + } + ], + "title": "Authentication Errors (401/403)", + "showOpenInMe": true, + "filters": [ + { + "key": "StatusCode", + "operator": 0, + "values": [ + "401" + ] + }, + { + "key": "StatusCode", + "operator": 0, + "values": [ + "403" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + }, + "showExportToExcel": true + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 3" + }, + { + "type": 10, + "content": { + "chartId": "workbook1f3a16f5-02e2-4bd7-a171-25a6b60dba93", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{Vault}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.keyvault/vaults", + "resourceParameter": "Vault", + "metrics": [ + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiResult", + "aggregation": 7, + "splitBy": null + } + ], + "title": "Throttling (429)", + "showOpenInMe": true, + "filters": [ + { + "key": "StatusCode", + "operator": 0, + "values": [ + "429" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + }, + "showExportToExcel": true + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 4" + }, + { + "type": 10, + "content": { + "chartId": "workbook1f3a16f5-02e2-4bd7-a171-25a6b60dba93", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{Vault}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.keyvault/vaults", + "resourceParameter": "Vault", + "metrics": [ + { + "namespace": "microsoft.keyvault/vaults", + "metric": "microsoft.keyvault/vaults--ServiceApiResult", + "aggregation": 7, + "splitBy": null + } + ], + "title": "Other Failures", + "showOpenInMe": true, + "filters": [ + { + "id": "1", + "key": "StatusCodeClass", + "operator": 1, + "values": [ + "2xx" + ] + }, + { + "id": "1", + "key": "StatusCode", + "operator": 1, + "values": [ + "200", + "401", + "403", + "429" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + }, + "showExportToExcel": true + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 5" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Failures" + }, + "name": "group - 12" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "⚠️ Either there are no operations selected or there is no Key Vault log data for this resource.\r\n\r\nFor additional assistance on how to configure additional monitoring coverage through diagnostic logs, visit the guide on how to [enable Azure Key Vault logging](https://docs.microsoft.com/azure/key-vault/key-vault-logging)." + }, + "conditionalVisibility": { + "parameterName": "Operations", + "comparison": "isEqualTo", + "value": "" + }, + "name": "No data message" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "{Vault}", + "linkTarget": "Resource", + "linkLabel": "Enable Logs for Monitoring", + "subTarget": "diagnostics", + "style": "primary" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Operations", + "comparison": "isEqualTo" + }, + "name": "links - 13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let rawData = AzureDiagnostics \n// Ignore Authentication operations with a 401. This is normal when using Key Vault SDK, first an unauthenticated request is done then the response is used for authentication.\n| where Category==\"AuditEvent\" and not (OperationName == \"Authentication\" and httpStatusCode_d == 401)\n| where OperationName in ({Operations}) or '*' in ({Operations})\n// Create ResultStatus with all the 'success' results bucked as 'Success'\n// Certain operations like StorageAccountAutoSyncKey have no ResultSignature, for now set to 'Success' as well\n| extend ResultStatus = case ( ResultSignature == \"\", \"Success\",\n ResultSignature == \"OK\", \"Success\",\n ResultSignature == \"Accepted\", \"Success\",\n ResultSignature); \nrawData \n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ResultStatus\n| join kind = inner (rawData\n | summarize Count = count() by ResultStatus\n ) on ResultStatus\n| union (rawData\n| summarize Count = count()\n| extend jkey = 1\n| join kind=inner (rawData\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\n | extend jkey = 1 \n ) on jkey\n | extend ResultStatus = 'All'\n)\n| project ResultStatus, Count, Trend\n| order by Count desc;", + "size": 3, + "showAnalytics": true, + "title": "Operations by Result Status", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "ResultStatus", + "exportParameterName": "ResultStatus", + "exportDefaultValue": "All", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.keyvault/vaults", + "crossComponentResources": [ + "{Vault}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "ResultStatus", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "All", + "text": "{0}{1}" + }, + { + "operator": "regex", + "thresholdValue": "Success", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "redBright", + "text": "{0}{1}" + } + ] + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1, + "maximumSignificantDigits": 2 + } + } + }, + "rightContent": { + "columnMatch": "Level", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Error", + "representation": "3", + "text": "" + }, + { + "operator": "==", + "thresholdValue": "Warning", + "representation": "2", + "text": "" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "1", + "text": "" + } + ] + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "conditionalVisibility": { + "parameterName": "Operations", + "comparison": "isNotEqualTo" + }, + "showPin": true, + "name": "KeyVault-Status" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = AzureDiagnostics \r\n| where TimeGenerated {TimeRange}\r\n// Ignore Authentication operations with a 401. This is normal when using Key Vault SDK, first an unauthenticated request is done then the response is used for authentication.\r\n| where Category==\"AuditEvent\" and not (OperationName == \"Authentication\" and httpStatusCode_d == 401)\r\n| where OperationName in ({Operations}) or '*' in ({Operations})\r\n// Create ResultStatus with all the 'success' results bucked as 'Success'\r\n// Certain operations like StorageAccountAutoSyncKey have no ResultSignature, for now set to 'Success' as well\r\n| extend ResultStatus = case ( ResultSignature == \"\", \"Success\",\r\n ResultSignature == \"OK\", \"Success\",\r\n ResultSignature == \"Accepted\", \"Success\",\r\n ResultSignature)\r\n| where ResultStatus == '{ResultStatus}' or '{ResultStatus}' == 'All';\r\ndata\r\n// Data aggregated to the OperationName\r\n| summarize OperationCount = count(), SuccessCount = countif(ResultStatus == \"Success\"), FailureCount = countif(ResultStatus != \"Success\"), PDurationMs = percentile(DurationMs, 99) by Resource, OperationName\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by OperationName\r\n | project-away TimeGenerated) on OperationName\r\n| order by OperationCount desc\r\n| project Name = strcat('⚡ ', OperationName), Id = strcat(Resource, '/', OperationName), ['Operation count'] = OperationCount, ['Operation count trend'] = Trend, ['Success count'] = SuccessCount, ['Failure count'] = FailureCount, ['p99 Duration'] = PDurationMs", + "size": 1, + "showAnalytics": true, + "exportFieldName": "", + "exportParameterName": "GridRow", + "exportDefaultValue": "{ \"Id\":\"*\" }", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.keyvault/vaults", + "crossComponentResources": [ + "{Vault}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Id", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Operation count", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Operation count trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue" + } + }, + { + "columnMatch": "Success count", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Failure count", + "formatter": 18, + "formatOptions": { + "min": 0, + "palette": "orange", + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "<=", + "thresholdValue": "0", + "representation": "Blank", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "3", + "text": "{0}{1}" + } + ] + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "p99 Duration", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": ">=", + "thresholdValue": "5000", + "representation": "4", + "text": "{0}{1}" + }, + { + "operator": ">=", + "thresholdValue": "1000", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "is Empty", + "representation": "more", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "ParentId", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "ResourceId", + "formatter": 5, + "formatOptions": { + "linkTarget": "Resource" + } + } + ], + "rowLimit": 1000, + "filter": true, + "labelSettings": [ + { + "columnId": "Id" + }, + { + "columnId": "Operation count", + "label": "Operation Count" + }, + { + "columnId": "Operation count trend", + "label": "Operation Count Trend" + }, + { + "columnId": "Success count", + "label": "Success Count" + }, + { + "columnId": "Failure count", + "label": "Failure Count" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "Operations", + "comparison": "isNotEqualTo" + }, + "showPin": true, + "name": "KeyVault-SummaryTable" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let gridRowSelected = dynamic({GridRow});\r\nlet resourceName = split(gridRowSelected.Id, \"/\")[0];\r\nlet operationName = split(gridRowSelected.Id, \"/\")[1];\r\nAzureDiagnostics \r\n| where TimeGenerated {TimeRange}\r\n// Ignore Authentication operations with a 401. This is normal when using Key Vault SDK, first an unauthenticated request is done then the response is used for authentication.\r\n| where Category==\"AuditEvent\" and not (OperationName == \"Authentication\" and httpStatusCode_d == 401)\r\n| where OperationName in ({Operations}) or '*' in ({Operations})\r\n| where resourceName == \"*\" or Resource == resourceName\r\n| where operationName == \"\" or OperationName == operationName\r\n// Create ResultStatus with all the 'success' results bucked as 'Success'\r\n// Certain operations like StorageAccountAutoSyncKey have no ResultSignature, for now set to 'Success' as well\r\n| extend ResultStatus = case ( ResultSignature == \"\", \"Success\",\r\n ResultSignature == \"OK\", \"Success\",\r\n ResultSignature == \"Accepted\", \"Success\",\r\n ResultSignature)\r\n| where ResultStatus == '{ResultStatus}' or '{ResultStatus}' == 'All'\r\n| extend p = pack_all()\r\n| mv-apply p on \r\n( \r\n extend key = tostring(bag_keys(p)[0])\r\n | where isnotempty(p[key]) and isnotnull(p[key])\r\n | where key !in (\"SourceSystem\",\"Type\")\r\n | summarize make_bag(p)\r\n)\r\n| project Time=TimeGenerated, Operation=OperationName, Result=ResultSignature, Duration = DurationMs, [\"Details\"]=bag_p\r\n| sort by Time desc", + "size": 0, + "showAnalytics": true, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.keyvault/vaults", + "crossComponentResources": [ + "{Vault}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Result", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "OK", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Accepted", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Duration", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": ">", + "thresholdValue": "1000", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": ">", + "thresholdValue": "5000", + "representation": "4", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Details", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "🔍 View Details", + "linkIsContextBlade": true + } + }, + { + "columnMatch": "Packed", + "formatter": 5, + "formatOptions": {} + } + ], + "filter": true + } + }, + "conditionalVisibility": { + "parameterName": "Operations", + "comparison": "isNotEqualTo" + }, + "showPin": true, + "name": "KeyVault-EventsTable" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Operations" + }, + "name": "group - 9" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/KeyVault/Workbooks/Overview/settings.json b/KeyVault/Workbooks/Overview/settings.json new file mode 100644 index 0000000..703a7a1 --- /dev/null +++ b/KeyVault/Workbooks/Overview/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Key Vault Overview", + "author": "Microsoft", + "galleries": [{ "type": "keyvaults-insights", "resourceType": "microsoft.keyvault/vaults", "order": 100 }] +} diff --git a/KeyVault/Workbooks/categoryResources.json b/KeyVault/Workbooks/categoryResources.json new file mode 100644 index 0000000..139f7dc --- /dev/null +++ b/KeyVault/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Azure Key Vault Insights", "description": "Provides insights for your Azure Key Vaults", "order": 100} +} \ No newline at end of file diff --git a/Network Insights/Alerts/README b/Network Insights/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Network Insights/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Network Insights/Queries/README b/Network Insights/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Network Insights/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Network Insights/Workbooks/ApplicationGatewayWorkbooks/Network Insights ApplicationGateways Detailed/NetworkInsights-ApplicationGatewayMetrics.workbook b/Network Insights/Workbooks/ApplicationGatewayWorkbooks/Network Insights ApplicationGateways Detailed/NetworkInsights-ApplicationGatewayMetrics.workbook new file mode 100644 index 0000000..4f7f110 --- /dev/null +++ b/Network Insights/Workbooks/ApplicationGatewayWorkbooks/Network Insights ApplicationGateways Detailed/NetworkInsights-ApplicationGatewayMetrics.workbook @@ -0,0 +1,3135 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{ApplicationGateway}" + ], + "parameters": [ + { + "id": "51f9f779-6b41-40ef-a8f0-aac280110a08", + "version": "KqlParameterItem/1.0", + "name": "ApplicationGateway", + "label": "Application gateway", + "type": 5, + "isRequired": true, + "value": null, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.network/applicationgateways": true, + "Microsoft.Network/applicationGateways": true + }, + "additionalResourceOptions": [] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "ff3fae89-1243-4701-afe2-97ac8648120e", + "version": "KqlParameterItem/1.0", + "name": "SKU", + "type": 1, + "query": "resources\r\n| where type =~ \"microsoft.network/applicationgateways\" and id =~ '{ApplicationGateway}'\r\n| extend tier = parse_json(properties).sku.tier\r\n| project SKU = iff(tier contains \"v2\", \"v2\", \"v1\")", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "4fad9342-29f1-445d-a22d-063a6eb69637", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components", + "value": { + "durationMs": 604800000 + } + }, + { + "id": "9d2e04fb-eb7e-402c-867e-564bd62a7c78", + "version": "KqlParameterItem/1.0", + "name": "isDiagnosticLogsEnabled", + "type": 1, + "query": "let hasNonEmptyTable = (T:string) \r\n{ \r\n toscalar( union isfuzzy=true ( table(T) | count as Count ), (print Count=0) | summarize sum(Count) ) > 0\r\n};\r\nlet TableName = 'AzureDiagnostics';\r\nprint isDiagnosticLogsEnabled=iif(hasNonEmptyTable(TableName), \"y\", \"n\")", + "crossComponentResources": [ + "{ApplicationGateway}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.network/applicationgateways" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "ApplicationGatewaysParam" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"AzureHealthQuery/1.0\",\"queryType\":\"Detailed\"}", + "size": 4, + "queryType": 4, + "resourceType": "microsoft.network/applicationgateways", + "crossComponentResources": [ + "{ApplicationGateway}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Availability state", + "formatter": 11, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Detailed status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Reason chronicity", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Reason type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Title", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Resource group", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ] + } + }, + "name": "query - 67" + }, + { + "type": 10, + "content": { + "chartId": "workbook3a9ecfeb-92d9-453f-8775-4fb95816eea2", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--UnhealthyHostCount", + "aggregation": 4 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--FailedRequests", + "aggregation": 1 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--CapacityUnits", + "aggregation": 4 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--ComputeUnits", + "aggregation": 4 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--Throughput", + "aggregation": 4 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--CurrentConnections", + "aggregation": 1 + } + ], + "title": "Key metrics", + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "showBorder": false + }, + "mapSettings": { + "locInfo": "AzureResource", + "sizeSettings": "Value", + "sizeAggregation": "Sum", + "legendMetric": "Value", + "legendAggregation": "Sum", + "itemColorSettings": { + "type": "heatmap", + "colorAggregation": "Sum", + "nodeColorField": "Value", + "heatmapPalette": "greenRed" + }, + "locInfoColumn": "Name" + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "Subscription", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "Value", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource" + } + }, + { + "columnMatch": "Metric", + "formatter": 1 + }, + { + "columnMatch": "Aggregation", + "formatter": 5 + }, + { + "columnMatch": "Value", + "formatter": 1 + }, + { + "columnMatch": "Timeline", + "formatter": 9 + } + ], + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + }, + "name": "Key metrics" + }, + { + "type": 10, + "content": { + "chartId": "workbook716592f8-5cde-444d-acb1-ce90e48e0b10", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--UnhealthyHostCount", + "aggregation": 4 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--FailedRequests", + "aggregation": 1 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--Throughput", + "aggregation": 4 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--CurrentConnections", + "aggregation": 1 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--CpuUtilization", + "aggregation": 4 + } + ], + "title": "Key metrics", + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "showBorder": false + }, + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v1" + }, + "name": "Key metrics" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "Help", + "linkTarget": "parameter", + "linkLabel": "Performance", + "subTarget": "1", + "style": "link" + }, + { + "cellValue": "Help", + "linkTarget": "parameter", + "linkLabel": "Latency", + "subTarget": "2", + "style": "link" + }, + { + "cellValue": "Help", + "linkTarget": "parameter", + "linkLabel": "Traffic", + "subTarget": "3", + "style": "link" + }, + { + "cellValue": "Help", + "linkTarget": "parameter", + "linkLabel": "Backend", + "subTarget": "4", + "style": "link" + }, + { + "cellValue": "Help", + "linkTarget": "parameter", + "linkLabel": "Billing", + "subTarget": "5", + "style": "link" + } + ] + }, + "name": "links - 72", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 1, + "content": { + "json": "
\r\n\r\n\tv1 SKU of Application Gateway does not support latency metrics." + }, + "conditionalVisibilities": [ + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v1" + }, + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + } + ], + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v1" + }, + "name": "text - 65" + }, + { + "type": 1, + "content": { + "json": "#### Application gateway total time vs Backend last byte response time\r\n\r\n*Application gateway total time* is the interval from the time when Application Gateway receives the first byte of the HTTP request to the time when the last response byte has been sent to the client. This equals the *Backend last byte response time* + the processing time taken by Application Gateway + *Client rtt* (only when the window size of the client TCP request is small relative to the response). Compare the 2 metrics to determine whether the issue is with the Application Gateway or the backend.\r\nIf the *Application gateway total time* has a spike but the Backend last byte response time is stable, then it can either be a sign of performance bottleneck at the Application Gateway or a bottleneck in the network between the client and Application Gateway (only when the window size of the client TCP request is small relative to the response). " + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "text - 1 - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook98d25674-6f30-4208-9e34-918de0b31f5c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--ApplicationGatewayTotalTime", + "aggregation": 4, + "splitBy": null, + "columnName": "" + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--BackendLastByteResponseTime", + "aggregation": 4 + } + ], + "gridFormatType": 1, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Name", + "formatter": 13 + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource" + } + }, + { + "columnMatch": "microsoft.network/applicationgateways--ApplicationGatewayTotalTime Timeline", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--ApplicationGatewayTotalTime", + "formatter": 1, + "numberFormat": { + "unit": 23, + "options": null + } + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendLastByteResponseTime Timeline", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendLastByteResponseTime", + "formatter": 1, + "numberFormat": { + "unit": 23, + "options": null + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.network/applicationgateways--ApplicationGatewayTotalTime", + "label": "Application Gateway Total Time (Average)" + }, + { + "columnId": "microsoft.network/applicationgateways--ApplicationGatewayTotalTime Timeline", + "label": "Application Gateway Total Time Timeline" + }, + { + "columnId": "microsoft.network/applicationgateways--BackendLastByteResponseTime", + "label": "Backend Last Byte Response Time (Average)" + }, + { + "columnId": "microsoft.network/applicationgateways--BackendLastByteResponseTime Timeline", + "label": "Backend Last Byte Response Time Timeline" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "metric - 0" + }, + { + "type": 1, + "content": { + "json": "#### Backend connect time vs Backend first byte response time vs Backend last byte response time\r\n\r\n**Backend connect time** is the time spent establishing a connection with the backend application. This includes the network latency as well as the time taken by the backend server’s TCP stack to establish new connections. In case of TLS, it also includes the time spent on handshake.\r\n\r\n**Backend first byte response time** is the time interval between start of establishing a connection to backend server and receiving the first byte of the response header.This approximates the sum of *Backend connect time*, time taken by the request to reach the backend from Application Gateway, time taken by backend application to respond (the time the server took to generate content, potentially fetch database queries), and the time taken by first byte of the response to reach the Application Gateway from the backend.\r\n\r\n**Backend last byte response time** is the time interval between start of establishing a connection to backend server and receiving the last byte of the response body. This approximates the sum of *Backend first byte response time* and data transfer time (this number may vary greatly depending on the size of objects requested and the latency of the server network).\r\n\r\nIf there’s a spike in Backend first byte response time trend but the Backend connect time trend is stable, then it can be inferred that the Application gateway to backend latency and the time taken to establish the connection is stable, and the spike is caused due to an increase in the response time of backend application. On the other hand, if the spike in Backend first byte response time is associated with a corresponding spike in Backend connect time, then it can be deduced that either the network between Application Gateway and backend server or the backend server TCP stack has saturated.If you notice a spike in Backend last byte response time but the Backend first byte response time is stable, then it can be deduced that the spike is because of a larger file being requested.\r\n\r\n" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "text - 1 - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook41f05d96-2803-4be8-97d7-7bfcc22d0761", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--BackendFirstByteResponseTime", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--BackendLastByteResponseTime", + "aggregation": 4 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--BackendConnectTime", + "aggregation": 4 + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "metric - 4" + }, + { + "type": 1, + "content": { + "json": "### CPU Utilization\r\nDisplays the utilization of the CPUs allocated to the Application Gateway. Under normal conditions, CPU usage should not regularly exceed 90%, as this may cause latency in the websites hosted behind the Application Gateway and disrupt the client experience. You can indirectly control or improve CPU utilization by modifying the configuration of the Application Gateway by increasing the instance count or by moving to a larger SKU size, or doing both." + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v1" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "text - 17 - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook92487899-602c-440d-a537-13c6349351f4", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--CpuUtilization", + "aggregation": 4, + "splitBy": null + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v1" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "metric - 72" + }, + { + "type": 1, + "content": { + "json": "### Capacity Units\r\nThe capacity units consumed by your Application Gateway is determined by 3 dimensions: *compute unit*, *current connections*, and *throughput*. Each capacity unit is composed of at most: 1 *compute unit*, or 2500 *current connections*, or 2.22-Mbps *throughput*. Check the value of the 3 metrics below to infer variation in which of the three dimensions led to the changes in *Capacity Units*" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "100", + "name": "text - 17 - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--CapacityUnits", + "aggregation": 4, + "splitBy": null + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "100", + "name": "metric - 18 - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Compute Units\r\n*Compute unit* is a measure of processor capacity consumed. Factors affecting compute unit are TLS connections/sec, URL Rewrite computations, and WAF rule processing." + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "100", + "name": "text - 17 - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--ComputeUnits", + "aggregation": 4, + "splitBy": null + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "100", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Current connections\r\n*Current connections* is a measure of established TCP connections to the application gateway." + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "text - 17 - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--CurrentConnections", + "aggregation": 1, + "splitBy": null + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "metric - 18 - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Throughput\r\n*Throughput* is average Megabits/sec processed by the Application Gateway." + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "text - 17" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--Throughput", + "aggregation": 4, + "splitBy": null + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "metric - 18" + }, + { + "type": 1, + "content": { + "json": "#### Sent bytes" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "text - 17 - Copy" + }, + { + "type": 1, + "content": { + "json": "#### Received bytes" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "text - 17 - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--BytesSent", + "aggregation": 1, + "splitBy": null + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "metric - 18 - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--BytesReceived", + "aggregation": 1, + "splitBy": null + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "metric - 18 - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Total requests\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "50", + "name": "text - 1 - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Failed requests\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "50", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--TotalRequests", + "aggregation": 1, + "splitBy": null + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "50", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--FailedRequests", + "aggregation": 1, + "splitBy": null + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "50", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Response status 2xx\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Response status 3xx\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Response status 4xx\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Response status 5xx\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--ResponseStatus", + "aggregation": 1, + "splitBy": null + } + ], + "filters": [ + { + "id": "2", + "key": "HttpStatusGroup", + "operator": 0, + "values": [ + "2xx" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--ResponseStatus", + "aggregation": 1, + "splitBy": null + } + ], + "filters": [ + { + "id": "2", + "key": "HttpStatusGroup", + "operator": 0, + "values": [ + "3xx" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--ResponseStatus", + "aggregation": 1, + "splitBy": null + } + ], + "filters": [ + { + "id": "2", + "key": "HttpStatusGroup", + "operator": 0, + "values": [ + "4xx" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--ResponseStatus", + "aggregation": 1, + "splitBy": null + } + ], + "filters": [ + { + "id": "2", + "key": "HttpStatusGroup", + "operator": 0, + "values": [ + "5xx" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Non-TLS requests\r\n" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### TLS version 1.0\r\n" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### TLS Version 1.1\r\n" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### TLS Version 1.2\r\n" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--TlsProtocol", + "aggregation": 1, + "splitBy": null + } + ], + "filters": [ + { + "id": "4", + "key": "TlsProtocol", + "operator": 0, + "values": [ + "nontls" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--TlsProtocol", + "aggregation": 1, + "splitBy": null + } + ], + "filters": [ + { + "id": "2", + "key": "TlsProtocol", + "operator": 0, + "values": [ + "tlsv1" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--TlsProtocol", + "aggregation": 1, + "splitBy": null + } + ], + "filters": [ + { + "id": "2", + "key": "TlsProtocol", + "operator": 0, + "values": [ + "tlsv1.1" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--TlsProtocol", + "aggregation": 1, + "splitBy": null + } + ], + "filters": [ + { + "id": "2", + "key": "TlsProtocol", + "operator": 0, + "values": [ + "tlsv1.2" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "25", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Client errors vs Server errors\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "text - 1 - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and OperationName == \"ApplicationGatewayAccess\" and httpStatus_d > 399\r\n| summarize AggregatedValue = count() by Resource", + "size": 1, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.network/applicationgateways", + "crossComponentResources": [ + "{ApplicationGateway}" + ], + "visualization": "piechart", + "chartSettings": {} + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "y" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "query - 5" + }, + { + "type": 1, + "content": { + "json": "
\r\n\r\n\tThis view is supprted only if you have configured sending the Access logs to Log Analytics for this Application Gateway." + }, + "conditionalVisibilities": [ + { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "n" + }, + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + } + ], + "conditionalVisibility": { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "n" + }, + "name": "text - 66" + }, + { + "type": 1, + "content": { + "json": "### Errors by user agent\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "text - 1 - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "
\r\n\r\n\tThis view is supprted only if you have configured sending the Access logs to Log Analytics for this Application Gateway." + }, + "conditionalVisibilities": [ + { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "n" + }, + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + } + ], + "conditionalVisibility": { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "n" + }, + "name": "text - 66 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and OperationName == \"ApplicationGatewayAccess\" and httpStatus_d > 399\r\n| summarize AggregatedValue = count() by userAgent_s\r\n| sort by AggregatedValue desc", + "size": 1, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.network/applicationgateways", + "crossComponentResources": [ + "{ApplicationGateway}" + ] + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "y" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "query - 8" + }, + { + "type": 1, + "content": { + "json": "### Top User-agents\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "
\r\n\r\n\tThis view is supprted only if you have configured sending the Access logs to Log Analytics for this Application Gateway." + }, + "conditionalVisibilities": [ + { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "n" + }, + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + } + ], + "conditionalVisibility": { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "n" + }, + "name": "text - 66 - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" and OperationName == \"ApplicationGatewayAccess\" \r\n| summarize AggregatedValue = count() by userAgent_s\r\n| sort by AggregatedValue desc", + "size": 1, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.network/applicationgateways", + "crossComponentResources": [ + "{ApplicationGateway}" + ] + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "y" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "query - 8 - Copy" + }, + { + "type": 1, + "content": { + "json": "### Top URIs\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "
\r\n\r\n\tThis view is supprted only if you have configured sending the Access logs to Log Analytics for this Application Gateway." + }, + "conditionalVisibilities": [ + { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "n" + }, + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + } + ], + "conditionalVisibility": { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "n" + }, + "name": "text - 66 - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "\t\tAzureDiagnostics\r\n\t\t| where ResourceType == \"APPLICATIONGATEWAYS\" and OperationName == \"ApplicationGatewayAccess\"\r\n| summarize AggregatedValue = count() by requestUri_s", + "size": 1, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.network/applicationgateways", + "crossComponentResources": [ + "{ApplicationGateway}" + ] + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "y" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "query - 11" + }, + { + "type": 1, + "content": { + "json": "### Server Failures by URI\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "
\r\n\r\n\tThis view is supprted only if you have configured sending the Access logs to Log Analytics for this Application Gateway." + }, + "conditionalVisibilities": [ + { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "n" + }, + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + } + ], + "conditionalVisibility": { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "n" + }, + "name": "text - 66 - Copy - Copy - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "\t\tAzureDiagnostics\r\n\t\t| where ResourceType == \"APPLICATIONGATEWAYS\" and OperationName == \"ApplicationGatewayAccess\" and httpStatus_d > 499\r\n| summarize AggregatedValue = count() by requestUri_s", + "size": 1, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.network/applicationgateways", + "crossComponentResources": [ + "{ApplicationGateway}" + ] + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "isDiagnosticLogsEnabled", + "comparison": "isEqualTo", + "value": "y" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "query - 9" + }, + { + "type": 1, + "content": { + "json": "### Healthy host count\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "50", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Unhealthy host count\r\n" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "50", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--HealthyHostCount", + "aggregation": 4, + "splitBy": null + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "50", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--UnhealthyHostCount", + "aggregation": 4, + "splitBy": null + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "50", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Backend response status 2xx\r\n" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "25", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Backend response status 3xx\r\n" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "25", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Backend response status 4xx\r\n" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "25", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Backend response status 5xx\r\n" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "25", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--BackendResponseStatus", + "aggregation": 1, + "splitBy": null, + "filters": [ + { + "key": "HttpStatusGroup", + "operator": 0, + "values": [] + }, + { + "key": "BackendServer", + "operator": 0, + "values": [] + } + ] + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus", + "formatter": 1, + "numberFormat": { + "unit": 0, + "options": null + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus", + "label": "Backend Response Status (Sum)" + }, + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "label": "Backend Response Status Timeline" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "25", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--BackendResponseStatus", + "aggregation": 1, + "splitBy": null, + "filters": [ + { + "key": "HttpStatusGroup", + "operator": 0, + "values": [] + } + ] + } + ], + "filters": [ + { + "id": "2", + "key": "HttpStatusGroup", + "operator": 0, + "values": [ + "3xx" + ] + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus", + "formatter": 1, + "numberFormat": { + "unit": 0, + "options": null + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus", + "label": "Backend Response Status (Sum)" + }, + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "label": "Backend Response Status Timeline" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "25", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--BackendResponseStatus", + "aggregation": 1, + "splitBy": null, + "filters": [ + { + "key": "HttpStatusGroup", + "operator": 0, + "values": [] + } + ] + } + ], + "filters": [ + { + "id": "2", + "key": "HttpStatusGroup", + "operator": 0, + "values": [ + "4xx" + ] + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus", + "formatter": 1, + "numberFormat": { + "unit": 0, + "options": null + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus", + "label": "Backend Response Status (Sum)" + }, + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "label": "Backend Response Status Timeline" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "25", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--BackendResponseStatus", + "aggregation": 1, + "splitBy": null, + "filters": [ + { + "key": "HttpStatusGroup", + "operator": 0, + "values": [] + } + ] + } + ], + "filters": [ + { + "id": "2", + "key": "HttpStatusGroup", + "operator": 0, + "values": [ + "5xx" + ] + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus", + "formatter": 1, + "numberFormat": { + "unit": 0, + "options": null + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus", + "label": "Backend Response Status (Sum)" + }, + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "label": "Backend Response Status Timeline" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "25", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Estimated Billed Capacity units\r\nWith the v2 SKU, the pricing model is driven by consumption. Capacity units measure consumption-based cost that is charged in addition to the fixed cost. Estimated Billed Capacity units indicates the number of capacity units using which the billing is estimated. This is calculated as the greater value between *Current capacity units* (capacity units required to load balance the traffic) and *Fixed billable capacity units* (minimum capacity units kept provisioned).\r\n" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "customWidth": "100", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--EstimatedBilledCapacityUnits", + "aggregation": 4, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus", + "formatter": 1, + "numberFormat": { + "unit": 0, + "options": null + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus", + "label": "Backend Response Status (Sum)" + }, + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "label": "Backend Response Status Timeline" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "customWidth": "100", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Current capacity units\r\nCount of capacity units consumed to load balance the traffic. There are three determinants to capacity unit - *compute units*, *current connections* and *throughput*. Each capacity unit is composed of at most: 1 *compute unit*, or 2500 *current connections*, or 2.22-Mbps *throughput*.\r\n" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "customWidth": "100", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--CapacityUnits", + "aggregation": 4, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus", + "formatter": 1, + "numberFormat": { + "unit": 0, + "options": null + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus", + "label": "Backend Response Status (Sum)" + }, + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "label": "Backend Response Status Timeline" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "customWidth": "100", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "### Fixed Billable Capacity Units\r\nThe minimum number of capacity units kept provisioned as per the *Minimum scale units* setting (one instance translates to 10 capacity units) in the Application Gateway configuration.\r\n" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "customWidth": "100", + "name": "text - 1 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 10, + "content": { + "chartId": "workbook0ddd8479-2964-47ef-9986-933092a15168", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--FixedBillableCapacityUnits", + "aggregation": 4, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/applicationgateways--BackendResponseStatus", + "formatter": 1, + "numberFormat": { + "unit": 0, + "options": null + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus", + "label": "Backend Response Status (Sum)" + }, + { + "columnId": "microsoft.network/applicationgateways--BackendResponseStatus Timeline", + "label": "Backend Response Status Timeline" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "customWidth": "100", + "name": "metric - 18 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" + }, + { + "type": 1, + "content": { + "json": "
\r\n\r\n\tv1 SKU of Application Gateway does not support billing metrics." + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v1" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "name": "text - 77" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Network Insights/Workbooks/ApplicationGatewayWorkbooks/Network Insights ApplicationGateways Detailed/settings.json b/Network Insights/Workbooks/ApplicationGatewayWorkbooks/Network Insights ApplicationGateways Detailed/settings.json new file mode 100644 index 0000000..d13e2a3 --- /dev/null +++ b/Network Insights/Workbooks/ApplicationGatewayWorkbooks/Network Insights ApplicationGateways Detailed/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"NetworkInsights-ApplicationGatewayMetrics", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.network/applicationGateways", "order": 100 }] +} diff --git a/Network Insights/Workbooks/ApplicationGatewayWorkbooks/Network Insights ApplicationGateways Minified/NetworkInsights-ApplicationGatewayMetrics-Minified.workbook b/Network Insights/Workbooks/ApplicationGatewayWorkbooks/Network Insights ApplicationGateways Minified/NetworkInsights-ApplicationGatewayMetrics-Minified.workbook new file mode 100644 index 0000000..e28342d --- /dev/null +++ b/Network Insights/Workbooks/ApplicationGatewayWorkbooks/Network Insights ApplicationGateways Minified/NetworkInsights-ApplicationGatewayMetrics-Minified.workbook @@ -0,0 +1,363 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "51f9f779-6b41-40ef-a8f0-aac280110a08", + "version": "KqlParameterItem/1.0", + "name": "ApplicationGateway", + "label": "Application gateway", + "type": 5, + "isRequired": true, + "value": null, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.network/applicationgateways": true, + "Microsoft.Network/applicationGateways": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "4fad9342-29f1-445d-a22d-063a6eb69637", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "label": "Time range", + "value": { + "durationMs": 2592000000 + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "966b697a-b017-4bf3-b584-1b345f2bc5ec", + "version": "KqlParameterItem/1.0", + "name": "SKU", + "type": 1, + "query": "resources\r\n| where type =~ \"microsoft.network/applicationgateways\" and id =~ '{ApplicationGateway}'\r\n| extend tier = parse_json(properties).sku.tier\r\n| project SKU = iff(tier contains \"v2\", \"v2\", \"v1\")", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "ApplicationGatewaysParam" + }, + { + "type": 10, + "content": { + "chartId": "workbook720bb0b2-3c50-4aa1-93fe-cc3717ccabec", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--CapacityUnits", + "aggregation": 4, + "splitBy": null + } + ], + "title": "Current capacity units", + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + }, + "name": "Current capacity units" + }, + { + "type": 10, + "content": { + "chartId": "workbook720bb0b2-3c50-4aa1-93fe-cc3717ccabec", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--CpuUtilization", + "aggregation": 4, + "splitBy": null + } + ], + "title": "CPU Utilization", + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v1" + } + }, + { + "type": 10, + "content": { + "chartId": "workbook720bb0b2-3c50-4aa1-93fe-cc3717ccabec", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--ApplicationGatewayTotalTime", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--BackendLastByteResponseTime", + "aggregation": 4 + } + ], + "title": "Latency", + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v2" + }, + "name": "Latency" + }, + { + "type": 10, + "content": { + "chartId": "workbook720bb0b2-3c50-4aa1-93fe-cc3717ccabec", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--CurrentConnections", + "aggregation": 1, + "splitBy": null + } + ], + "title": "Current connections", + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "v1" + }, + "name": "Current connections" + }, + { + "type": 10, + "content": { + "chartId": "workbook720bb0b2-3c50-4aa1-93fe-cc3717ccabec", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--Throughput", + "aggregation": 4, + "splitBy": null + } + ], + "title": "Throughput", + "gridSettings": { + "rowLimit": 10000 + } + }, + "name": "Throughput" + }, + { + "type": 10, + "content": { + "chartId": "workbook720bb0b2-3c50-4aa1-93fe-cc3717ccabec", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--UnhealthyHostCount", + "aggregation": 4, + "splitBy": null + } + ], + "title": "Unhealthy host count", + "gridSettings": { + "rowLimit": 10000 + } + }, + "name": "Unhealthy host count" + }, + { + "type": 10, + "content": { + "chartId": "workbook720bb0b2-3c50-4aa1-93fe-cc3717ccabec", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--FailedRequests", + "aggregation": 1, + "splitBy": null + } + ], + "title": "Failed requests", + "gridSettings": { + "rowLimit": 10000 + } + }, + "name": "Failed requests" + } + ], + "styleSettings": { + "paddingStyle": "none", + "spacingStyle": "none" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Network Insights/Workbooks/ApplicationGatewayWorkbooks/Network Insights ApplicationGateways Minified/settings.json b/Network Insights/Workbooks/ApplicationGatewayWorkbooks/Network Insights ApplicationGateways Minified/settings.json new file mode 100644 index 0000000..d13e2a3 --- /dev/null +++ b/Network Insights/Workbooks/ApplicationGatewayWorkbooks/Network Insights ApplicationGateways Minified/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"NetworkInsights-ApplicationGatewayMetrics", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.network/applicationGateways", "order": 100 }] +} diff --git a/Network Insights/Workbooks/ApplicationGatewayWorkbooks/categoryResources.json b/Network Insights/Workbooks/ApplicationGatewayWorkbooks/categoryResources.json new file mode 100644 index 0000000..07bd5b5 --- /dev/null +++ b/Network Insights/Workbooks/ApplicationGatewayWorkbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Network Insights Application Gateway", "description": "", "order": 100} +} diff --git a/Network Insights/Workbooks/LoadBalancerWorkbooks/NetworkInsights-LoadBalancerMetrics-Minified/NetworkInsights-LoadBalancerMetrics-Minified.workbook b/Network Insights/Workbooks/LoadBalancerWorkbooks/NetworkInsights-LoadBalancerMetrics-Minified/NetworkInsights-LoadBalancerMetrics-Minified.workbook new file mode 100644 index 0000000..b0c446b --- /dev/null +++ b/Network Insights/Workbooks/LoadBalancerWorkbooks/NetworkInsights-LoadBalancerMetrics-Minified/NetworkInsights-LoadBalancerMetrics-Minified.workbook @@ -0,0 +1,980 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "3c1f3d6b-5d96-46d0-9d70-7fcdc731ebe8", + "version": "KqlParameterItem/1.0", + "name": "LoadBalancer", + "label": "Load Balancer", + "type": 5, + "isRequired": true, + "value": null, + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "Microsoft.Network/LoadBalancers": true, + "microsoft.network/loadbalancers": true + }, + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "e65b0fe6-9d77-42c6-a6b4-ddf22750ca80", + "version": "KqlParameterItem/1.0", + "name": "BackenVMs", + "label": " Backend VMs", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "resources\r\n| where type =~ \"microsoft.network/loadbalancers\" and id =~ '{LoadBalancer}'\r\n| mv-expand BackendAddressPool = parse_json(properties).backendAddressPools\r\n| mv-expand BackendIPConfigs = BackendAddressPool.properties.backendIPConfigurations\r\n| project BackendId = tostring(BackendIPConfigs.id)\r\n| where BackendId contains \"microsoft.network/networkInterfaces\"\r\n| project NICId = substring(BackendId, 0, indexof(BackendId, \"/ipConfigurations/\"))\r\n| join kind=inner\r\n(\r\n resources\r\n | where type == \"microsoft.network/networkinterfaces\"\r\n | project NICId = id, BackendVM = properties.virtualMachine.id\r\n) on NICId\r\n| where isnotempty(BackendVM)\r\n| project tolower(BackendVM), selected = true", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true, + "Microsoft.Compute/virtualMachines": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "79e53b45-40af-4385-8905-c475b81522dc", + "version": "KqlParameterItem/1.0", + "name": "BackendVMSS", + "label": "Backend VMSS", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "resources\r\n| where type =~ 'microsoft.network/loadbalancers' and id =~ '{LoadBalancer}'\r\n| mv-expand BackendAddressPool = parse_json(properties).backendAddressPools\r\n| mv-expand BackendIPConfigs = BackendAddressPool.properties.backendIPConfigurations\r\n| project BackendId = tostring(BackendIPConfigs.id)\r\n| where BackendId contains \"Microsoft.Compute/virtualMachineScaleSets\"\r\n| project BackendVMSS = tolower(substring(BackendId, 0, indexof(BackendId, \"/virtualMachines/\"))), selected = true", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachinescalesets": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "61ebd413-6b66-4915-96d4-450fa3753756", + "version": "KqlParameterItem/1.0", + "name": "SKU", + "type": 1, + "query": "resources\r\n| where type =~ \"microsoft.network/loadbalancers\" and id =~ '{LoadBalancer}'\r\n| project tostring(parse_json(sku).name)", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "a04850ff-a83a-4fc4-a2e0-2d579d960daa", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + }, + "label": "Time Range", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "Filter" + }, + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--VipAvailability", + "aggregation": 4 + }, + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--DipAvailability", + "aggregation": 4 + }, + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--SnatConnectionCount", + "aggregation": 1 + }, + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--SYNCount", + "aggregation": 1 + } + ], + "title": "Load Balancer Key Metrics", + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "linkColumn": "Name", + "linkTarget": "Metrics", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": false + }, + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isNotEqualTo", + "value": "Basic" + }, + "name": "LB Key metrics" + }, + { + "type": 1, + "content": { + "json": "
Load Balancer Key Metrics
\r\n\r\n\tBasic Load balancers don’t support metrics." + }, + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "Basic" + }, + "name": "LB Key metrics" + }, + { + "type": 10, + "content": { + "chartId": "workbookd134607b-032e-45b7-998c-abcb0ad832ab", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--DipAvailability", + "aggregation": 4, + "splitBy": "BackendIPAddress" + } + ], + "title": "Health Probe Status by Backend IP Address", + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isNotEqualTo", + "value": "Basic" + }, + "name": "LB - Backend health probe by Backend IP" + }, + { + "type": 1, + "content": { + "json": "
Health Probe Status by Backend IP Address
\r\n\r\n\tBasic Load balancers don’t support metrics.\r\n\r\n" + }, + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "Basic" + }, + "name": "Health Probe Status by Backend IP Address - Basic LB" + }, + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 3, + "metricScope": 0, + "resourceIds": [ + "{BackenVMs}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "BackenVMs", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network In Total", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network Out Total", + "aggregation": 1 + } + ], + "title": "Backend Pool Metric - VM (Network In Out)", + "gridFormatType": 2, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "showBorder": false, + "sortCriteriaField": "Name", + "sortOrderField": 2 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "linkColumn": "microsoft.compute/virtualmachines--Inbound Flows", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": null + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Average" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows", + "label": "Inbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "label": "Inbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "label": "Inbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "label": "Inbound Flows Maximum Creation Rate (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows", + "label": "Outbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "label": "Outbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "label": "Outbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "label": "Outbound Flows Maximum Creation Rate (Average) Timeline" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "BackenVMs", + "comparison": "isNotEqualTo" + }, + "name": "LB backend VM - Network in/out" + }, + { + "type": 1, + "content": { + "json": "
Backend Pool Metric - VM (Network In Out)
\r\n\r\n\tNo Virtual machine resources are configured in backend pool." + }, + "conditionalVisibility": { + "parameterName": "BackenVMs", + "comparison": "isEqualTo", + "value": "" + }, + "name": "Backend Pool metric VM - LB" + }, + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 3, + "metricScope": 0, + "resourceIds": [ + "{BackendVMSS}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachinescalesets", + "resourceParameter": "BackendVMSS", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Network In Total", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Network Out Total", + "aggregation": 1 + } + ], + "title": "Backend Pool Metric - VMSS (Network In Out)", + "gridFormatType": 2, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "showBorder": false, + "sortCriteriaField": "Name", + "sortOrderField": 2 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "linkColumn": "microsoft.compute/virtualmachines--Inbound Flows", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": null + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Average" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows", + "label": "Inbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "label": "Inbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "label": "Inbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "label": "Inbound Flows Maximum Creation Rate (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows", + "label": "Outbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "label": "Outbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "label": "Outbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "label": "Outbound Flows Maximum Creation Rate (Average) Timeline" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "BackendVMSS", + "comparison": "isNotEqualTo" + }, + "name": "LB backend VMSS - Network in/out" + }, + { + "type": 1, + "content": { + "json": "
Backend Pool Metric - VMSS (Network In Out)
\t\r\n\r\n\tNo Virtual machine scale set resources are configured in backend pool." + }, + "conditionalVisibility": { + "parameterName": "BackendVMSS", + "comparison": "isEqualTo", + "value": "" + }, + "name": "Backend Pool metric VMSS - LB" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Network Insights/Workbooks/LoadBalancerWorkbooks/NetworkInsights-LoadBalancerMetrics-Minified/settings.json b/Network Insights/Workbooks/LoadBalancerWorkbooks/NetworkInsights-LoadBalancerMetrics-Minified/settings.json new file mode 100644 index 0000000..105a8c6 --- /dev/null +++ b/Network Insights/Workbooks/LoadBalancerWorkbooks/NetworkInsights-LoadBalancerMetrics-Minified/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Network Insights LoadBalancers Minified", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.network/loadbalancers", "order": 100 }] +} diff --git a/Network Insights/Workbooks/LoadBalancerWorkbooks/NetworkInsights-LoadBalancerMetrics/NetworkInsights-LoadBalancerMetrics.workbook b/Network Insights/Workbooks/LoadBalancerWorkbooks/NetworkInsights-LoadBalancerMetrics/NetworkInsights-LoadBalancerMetrics.workbook new file mode 100644 index 0000000..479dd35 --- /dev/null +++ b/Network Insights/Workbooks/LoadBalancerWorkbooks/NetworkInsights-LoadBalancerMetrics/NetworkInsights-LoadBalancerMetrics.workbook @@ -0,0 +1,5538 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "3c1f3d6b-5d96-46d0-9d70-7fcdc731ebe8", + "version": "KqlParameterItem/1.0", + "name": "LoadBalancer", + "label": "Load Balancer", + "type": 5, + "isRequired": true, + "value": null, + "typeSettings": { + "resourceTypeFilter": { + "Microsoft.Network/LoadBalancers": true, + "microsoft.network/loadbalancers": true + }, + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "e65b0fe6-9d77-42c6-a6b4-ddf22750ca80", + "version": "KqlParameterItem/1.0", + "name": "BackenVMs", + "label": " Backend VMs", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "resources\r\n| where type =~ \"microsoft.network/loadbalancers\" and id =~ '{LoadBalancer}'\r\n| mv-expand BackendAddressPool = parse_json(properties).backendAddressPools\r\n| mv-expand BackendIPConfigs = BackendAddressPool.properties.backendIPConfigurations\r\n| project BackendId = tostring(BackendIPConfigs.id)\r\n| where BackendId contains \"microsoft.network/networkInterfaces\"\r\n| project NICId = substring(BackendId, 0, indexof(BackendId, \"/ipConfigurations/\"))\r\n| join kind=inner\r\n(\r\n resources\r\n | where type == \"microsoft.network/networkinterfaces\"\r\n | project NICId = id, BackendVM = properties.virtualMachine.id\r\n) on NICId\r\n| where isnotempty(BackendVM)\r\n| project tolower(BackendVM), selected = true", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true, + "Microsoft.Compute/virtualMachines": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "79e53b45-40af-4385-8905-c475b81522dc", + "version": "KqlParameterItem/1.0", + "name": "BackendVMSS", + "label": "Backend VMSS", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "resources\r\n| where type =~ 'microsoft.network/loadbalancers' and id =~ '{LoadBalancer}'\r\n| mv-expand BackendAddressPool = parse_json(properties).backendAddressPools\r\n| mv-expand BackendIPConfigs = BackendAddressPool.properties.backendIPConfigurations\r\n| project BackendId = tostring(BackendIPConfigs.id)\r\n| where BackendId contains \"Microsoft.Compute/virtualMachineScaleSets\"\r\n| project BackendVMSS = tolower(substring(BackendId, 0, indexof(BackendId, \"/virtualMachines/\"))), selected = true", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachinescalesets": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "00edc28a-e143-444b-b815-338a9cb136c5", + "version": "KqlParameterItem/1.0", + "name": "FrontendPublicIPs", + "label": "Frontend Public IPs", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "resources\r\n| where type =~ 'microsoft.network/loadbalancers' and id =~ '{LoadBalancer}'\r\n| mv-expand FrontendIPConfigs = parse_json(properties).frontendIPConfigurations\r\n| where isnotempty(FrontendIPConfigs.properties.publicIPAddress.id)\r\n| project PublicIPAddress = tolower(tostring(FrontendIPConfigs.properties.publicIPAddress.id)), selected = true", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.network/publicipaddresses": true + }, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "" + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "61ebd413-6b66-4915-96d4-450fa3753756", + "version": "KqlParameterItem/1.0", + "name": "SKU", + "type": 1, + "query": "resources\r\n| where type =~ \"microsoft.network/loadbalancers\" and id =~ '{LoadBalancer}'\r\n| project tostring(parse_json(sku).name)", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "9ab85a4a-637e-46ef-8a35-0773de1dca59", + "version": "KqlParameterItem/1.0", + "name": "FrontendPublicIPsConstraint", + "type": 1, + "value": "where false", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (FrontendPublicIPs is not empty ), result = 'where id in~ ({FrontendPublicIPs})'", + "criteriaContext": { + "leftOperand": "FrontendPublicIPs", + "operator": "isNotNull", + "rightValType": "param", + "resultValType": "static", + "resultVal": "where id in~ ({FrontendPublicIPs})" + } + }, + { + "condition": "else result = 'where false'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "where false" + } + } + ], + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "5139d636-d079-425e-8da8-43b092a9045d", + "version": "KqlParameterItem/1.0", + "name": "CM", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "resources\r\n| where type =~ \"microsoft.network/publicipaddresses\"\r\n| {FrontendPublicIPsConstraint}\r\n| project IPAddress = tostring(parse_json(properties).ipAddress), dummy = 1\r\n| join kind=inner\r\n(\r\nresources\r\n| where type =~ \"microsoft.network/networkwatchers/connectionmonitors\"\r\n| project CMId = id, CMProperties = properties, dummy = 1\r\n) on dummy\r\n| where CMProperties has IPAddress\r\n| project tolower(CMId), selected = true", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "a04850ff-a83a-4fc4-a2e0-2d579d960daa", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + }, + "label": "Time Range", + "resourceType": "microsoft.insights/components" + }, + { + "id": "e91a52f2-8f31-4f0c-a4c9-89dd3b6275dd", + "version": "KqlParameterItem/1.0", + "name": "TCP", + "type": 1, + "description": "To filter metrics", + "value": "TCP", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'TCP'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "TCP" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "02afd742-4fdf-4eb0-8a70-8615644f5531", + "version": "KqlParameterItem/1.0", + "name": "UDP", + "type": 1, + "description": "To filter metrics", + "value": "UDP", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'UDP'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "UDP" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "Filter" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"AzureHealthQuery/1.0\",\"queryType\":\"Detailed\"}", + "size": 4, + "title": "Load Balancer Status", + "queryType": 4, + "resourceType": "microsoft.network/loadbalancers", + "crossComponentResources": [ + "{LoadBalancer}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Detailed status", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Reason chronicity", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Reason type", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Title", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Resource group", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "sortBy": [ + { + "itemKey": "Availability state", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "Availability state", + "sortOrder": 2 + } + ], + "tileSettings": { + "showBorder": false + }, + "graphSettings": { + "type": 2, + "topContent": { + "columnMatch": "Availability state", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "centerContent": { + "columnMatch": "Count", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "nodeIdField": "Availability state", + "nodeSize": null, + "staticNodeSize": 100, + "colorSettings": { + "nodeColorField": "Availability state", + "type": 3, + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Available", + "representation": "green" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "redBright" + } + ] + }, + "hivesMargin": 5 + }, + "mapSettings": { + "locInfo": "AzureResource", + "locInfoColumn": "Name", + "latitude": "Name", + "sizeAggregation": "Sum", + "legendMetric": "Availability state", + "legendAggregation": "Sum", + "itemColorSettings": { + "nodeColorField": "Availability state", + "colorAggregation": "Average", + "type": "thresholds", + "thresholdsGrid": [ + { + "operator": "contains", + "thresholdValue": "Available", + "representation": "green" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "redBright" + } + ] + }, + "numberFormatSettings": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true + } + } + } + }, + "customWidth": "70", + "name": "LBHealth" + }, + { + "type": 1, + "content": { + "json": "### Useful documents\r\n* [Overview of the Azure Load Balancer](https://docs.microsoft.com/azure/load-balancer/load-balancer-overview)\r\n* [Frequently asked questions](https://docs.microsoft.com/azure/load-balancer/load-balancer-faqs)\r\n* [Guidance on Standard Load Balancer metrics](https://docs.microsoft.com/azure/load-balancer/load-balancer-standard-diagnostics)\r\n* [Troubleshoot your Azure Load Balancer](https://docs.microsoft.com/azure/load-balancer/load-balancer-troubleshoot)" + }, + "customWidth": "30", + "name": "Useful Documents" + }, + { + "type": 1, + "content": { + "json": "
Standard Load Balancer required
\r\n\r\nBasic Load Balancers don’t support metrics. Follow [our guide](https://docs.microsoft.com/azure/load-balancer/upgrade-basic-standard) to switch to Standard for this and other production level features today!" + }, + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "Basic" + }, + "customWidth": "50", + "name": "Basic LB not supported" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "Help", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "2", + "style": "link" + }, + { + "cellValue": "Help", + "linkTarget": "parameter", + "linkLabel": "Frontend & Backend Availability", + "subTarget": "5", + "style": "link" + }, + { + "cellValue": "Help", + "linkTarget": "parameter", + "linkLabel": "Data Throughput", + "subTarget": "6", + "style": "link" + }, + { + "cellValue": "Help", + "linkTarget": "parameter", + "linkLabel": "Flow Distribution", + "subTarget": "3", + "style": "link" + }, + { + "cellValue": "Help", + "linkTarget": "parameter", + "linkLabel": "Connection Monitors", + "subTarget": "4", + "style": "link" + }, + { + "cellValue": "Help", + "linkTarget": "parameter", + "linkLabel": "Metric Definitions", + "subTarget": "1", + "style": "link" + } + ] + }, + "name": "Tab selector", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 10, + "content": { + "chartId": "workbook42998b77-ad4c-4176-b2c5-ac00b8fe6811", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{CM}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/networkwatchers/connectionmonitors", + "resourceParameter": "CM", + "metrics": [ + { + "namespace": "microsoft.network/networkwatchers/connectionmonitors", + "metric": "microsoft.network/networkwatchers/connectionmonitors--RoundTripTimeMs", + "aggregation": 4, + "splitBy": "DestinationAddress", + "columnName": "Round-Trip Time (ms)" + } + ], + "title": "Round-Trip Time (ms), Average - Destination Address Split", + "gridFormatType": 2, + "mapSettings": { + "locInfo": "AzureResource", + "sizeSettings": "Value", + "sizeAggregation": "Sum", + "legendMetric": "Value", + "legendAggregation": "Sum", + "itemColorSettings": { + "type": "heatmap", + "colorAggregation": "Sum", + "nodeColorField": "Value", + "heatmapPalette": "greenRed" + }, + "locInfoColumn": "Name" + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": {} + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Segment Field", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.network/networkwatchers/connectionmonitors--RoundTripTimeMs", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 23, + "options": null + } + }, + { + "columnMatch": ".*\\/Round-Trip Time (ms) (Preview)$", + "formatter": 1, + "formatOptions": {} + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "Segment", + "label": "FrontEnd IP" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "-1" + }, + "customWidth": "65", + "name": "Chart of latencies" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type =~ \"microsoft.network/publicipaddresses\"\r\n| {FrontendPublicIPsConstraint}\r\n| project id, IPAddress = tostring(parse_json(properties).ipAddress)", + "size": 0, + "title": "Frontend Public IP Addresses", + "noDataMessage": "No Frontend Public IP Addresses are configured", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "value::all" + ] + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "-1" + }, + "name": "Frontend Public IP Addresses" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\",\"mergeType\":\"inner\",\"leftTable\":\"Chart of latencies\",\"rightTable\":\"Frontend Public IP Addresses\",\"leftColumn\":\"Segment\",\"rightColumn\":\"IPAddress\"}],\"projectRename\":[{\"originalName\":\"[Chart of latencies].Subscription\",\"mergedName\":\"Subscription\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"},{\"originalName\":\"[Chart of latencies].Name\",\"mergedName\":\"Name\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"},{\"originalName\":\"[Chart of latencies].Segment\",\"mergedName\":\"FrontEnd IP\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"},{\"originalName\":\"[Chart of latencies].Round-Trip Time (ms)\",\"mergedName\":\"Round-Trip Time (ms)\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"},{\"originalName\":\"[Chart of latencies].Round-Trip Time (ms) Timeline\",\"mergedName\":\"Round-Trip Time (ms) Timeline\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"},{\"originalName\":\"[Frontend Public IP Addresses].id\",\"mergedName\":\"id\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"},{\"originalName\":\"[Frontend Public IP Addresses].IPAddress\",\"mergedName\":\"IPAddress\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"}]}", + "size": 0, + "title": "Round-Trip Time (ms), Average - Map", + "noDataMessage": "No running connection monitors found", + "queryType": 7, + "visualization": "map" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + { + "parameterName": "CM", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "name": "Round-Trip Time (ms), Average - Map" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\",\"mergeType\":\"inner\",\"leftTable\":\"Chart of latencies\",\"rightTable\":\"Frontend Public IP Addresses\",\"leftColumn\":\"Segment\",\"rightColumn\":\"IPAddress\"}],\"projectRename\":[{\"originalName\":\"[Chart of latencies].Subscription\",\"mergedName\":\"Subscription\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"},{\"originalName\":\"[Chart of latencies].Name\",\"mergedName\":\"Name\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"},{\"originalName\":\"[Chart of latencies].Segment\",\"mergedName\":\"FrontEnd IP\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"},{\"originalName\":\"[Chart of latencies].Round-Trip Time (ms)\",\"mergedName\":\"Round-Trip Time (ms)\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"},{\"originalName\":\"[Chart of latencies].Round-Trip Time (ms) Timeline\",\"mergedName\":\"Round-Trip Time (ms) Timeline\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"},{\"originalName\":\"[Frontend Public IP Addresses].id\",\"mergedName\":\"id\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"},{\"originalName\":\"[Frontend Public IP Addresses].IPAddress\",\"mergedName\":\"IPAddress\",\"fromId\":\"2443c844-b1e3-4db3-83a8-64dbfc2db0ce\"}]}", + "size": 0, + "title": "Round-Trip Time (ms), Average - Chart", + "noDataMessage": "No running connection monitors found", + "queryType": 7, + "visualization": "linechart" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + { + "parameterName": "CM", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "name": "Round-Trip Time (ms), Average - Chart" + }, + { + "type": 1, + "content": { + "json": "Basic Load Balancers don’t support metrics. Follow [our guide](https://docs.microsoft.com/azure/load-balancer/upgrade-basic-standard) to switch to Standard for this and other production level features today!\r\n\r\n" + }, + "conditionalVisibility": { + "parameterName": "SKU", + "comparison": "isEqualTo", + "value": "Basic" + }, + "customWidth": "50", + "name": "Frontend IP metric - Basic LB" + }, + { + "type": 1, + "content": { + "json": "\tNo running Connection Monitors found" + }, + "conditionalVisibilities": [ + { + "parameterName": "CM", + "comparison": "isEqualTo" + }, + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + } + ], + "conditionalVisibility": { + "parameterName": "CM", + "comparison": "isEqualTo" + }, + "customWidth": "50", + "name": "Round-Trip Time (ms), Average" + }, + { + "type": 1, + "content": { + "json": "# Connection Monitor Help\r\nConnection Monitors are used to test the latency of traffic to your Load Balancer Frontend IPs from regions all over the globe. If you have Connection Monitors configured, review the above map to see the latency of traffic to your Load Balancer from all regions with sources configured.\r\n\r\nIf you do not have any Connection Monitors configured, [create Connection Monitors](https://docs.microsoft.com/en-us/azure/network-watcher/connection-monitor) with source VMs in your regions of interest and set your destination to the Frontend IP address of your Load Balancer to analyze your round-trip latencies." + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "4" + }, + "customWidth": "70", + "name": "CM help" + }, + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--ByteCount", + "aggregation": 1, + "splitBy": "Direction", + "splitBySortOrder": -1, + "splitByLimit": 5, + "columnName": "Direction" + }, + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--ByteCount", + "aggregation": 1, + "splitBy": "FrontendIPAddress", + "splitBySortOrder": -1, + "splitByLimit": 5, + "columnName": "FrontEnd IP" + }, + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--ByteCount", + "aggregation": 1, + "splitBy": "FrontendPort", + "splitBySortOrder": -1, + "splitByLimit": 5, + "columnName": "FronEndPort" + } + ], + "title": "Load Balancer Data Throughput", + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "linkColumn": "Name", + "linkTarget": "Metrics", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Segment", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": false + }, + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + { + "parameterName": "SKU", + "comparison": "isNotEqualTo", + "value": "Basic" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + "customWidth": "100", + "name": "Data Throughput" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "VMSS Flow Creation and Network Traffic", + "items": [ + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "metricScope": 0, + "resourceIds": [ + "{BackendVMSS}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachinescalesets", + "resourceParameter": "BackendVMSS", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Inbound Flows Maximum Creation Rate", + "aggregation": 3 + } + ], + "title": "Inbound Flow Creation Rate (Max)", + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "linkColumn": "Name", + "linkTarget": "Metrics", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "showBorder": false, + "sortCriteriaField": "Value", + "sortOrderField": 2 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "linkColumn": "microsoft.compute/virtualmachines--Inbound Flows", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": null + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Average" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows", + "label": "Inbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "label": "Inbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "label": "Inbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "label": "Inbound Flows Maximum Creation Rate (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows", + "label": "Outbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "label": "Outbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "label": "Outbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "label": "Outbound Flows Maximum Creation Rate (Average) Timeline" + } + ] + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "BackendVMSS", + "comparison": "isNotEqualTo" + } + ], + "name": "VMSS Inbound Flow Creation Rate (Max)" + }, + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "metricScope": 0, + "resourceIds": [ + "{BackendVMSS}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachinescalesets", + "resourceParameter": "BackendVMSS", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Outbound Flows Maximum Creation Rate", + "aggregation": 3 + } + ], + "title": "Outbound Flow Creation Rate (Max)", + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "linkColumn": "Name", + "linkTarget": "Metrics", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "showBorder": false, + "sortCriteriaField": "Value", + "sortOrderField": 2 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "linkColumn": "microsoft.compute/virtualmachines--Inbound Flows", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": null + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Average" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows", + "label": "Inbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "label": "Inbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "label": "Inbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "label": "Inbound Flows Maximum Creation Rate (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows", + "label": "Outbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "label": "Outbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "label": "Outbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "label": "Outbound Flows Maximum Creation Rate (Average) Timeline" + } + ] + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "BackendVMSS", + "comparison": "isNotEqualTo" + } + ], + "name": "VMSS Outbound Flow Creation Rate (Max)" + }, + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 3, + "metricScope": 0, + "resourceIds": [ + "{BackendVMSS}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachinescalesets", + "resourceParameter": "BackendVMSS", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Inbound Flows", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Inbound Flows Maximum Creation Rate", + "aggregation": 4 + } + ], + "title": "Inbound Flow Count and Creation Rate ", + "gridFormatType": 2, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "showBorder": false, + "sortCriteriaField": "Name", + "sortOrderField": 2 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "linkColumn": "microsoft.compute/virtualmachines--Inbound Flows", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": null + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Average" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows", + "label": "Inbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "label": "Inbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "label": "Inbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "label": "Inbound Flows Maximum Creation Rate (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows", + "label": "Outbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "label": "Outbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "label": "Outbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "label": "Outbound Flows Maximum Creation Rate (Average) Timeline" + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "BackendVMSS", + "comparison": "isNotEqualTo" + } + ], + "name": "Inbound Flows - Backend VMSS" + }, + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 3, + "metricScope": 0, + "resourceIds": [ + "{BackendVMSS}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachinescalesets", + "resourceParameter": "BackendVMSS", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Outbound Flows", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Outbound Flows Maximum Creation Rate", + "aggregation": 4 + } + ], + "title": "Outbound Flow Count and Creation Rate", + "gridFormatType": 2, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "showBorder": false, + "sortCriteriaField": "Name", + "sortOrderField": 2 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "linkColumn": "microsoft.compute/virtualmachines--Inbound Flows", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": null + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Average" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows", + "label": "Inbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "label": "Inbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "label": "Inbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "label": "Inbound Flows Maximum Creation Rate (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows", + "label": "Outbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "label": "Outbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "label": "Outbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "label": "Outbound Flows Maximum Creation Rate (Average) Timeline" + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "BackendVMSS", + "comparison": "isNotEqualTo" + } + ], + "name": "Outbound Flows - Backend VMSS" + }, + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 3, + "metricScope": 0, + "resourceIds": [ + "{BackendVMSS}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachinescalesets", + "resourceParameter": "BackendVMSS", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Network In Total", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Network Out Total", + "aggregation": 1 + } + ], + "title": "Network Traffic by Direction", + "gridFormatType": 2, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "showBorder": false, + "sortCriteriaField": "Name", + "sortOrderField": 2 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "linkColumn": "microsoft.compute/virtualmachines--Inbound Flows", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": null + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Average" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows", + "label": "Inbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "label": "Inbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "label": "Inbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "label": "Inbound Flows Maximum Creation Rate (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows", + "label": "Outbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "label": "Outbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "label": "Outbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "label": "Outbound Flows Maximum Creation Rate (Average) Timeline" + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "BackendVMSS", + "comparison": "isNotEqualTo" + } + ], + "name": "LB backend VMSS - Network in/out" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "VMSS Flow and Traffic Group", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 1, + "content": { + "json": "\tNo Virtual machine scale set resources are configured in backend pool." + }, + "conditionalVisibilities": [ + { + "parameterName": "BackendVMSS", + "comparison": "isEqualTo", + "value": "" + }, + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + } + ], + "conditionalVisibility": { + "parameterName": "BackendVMSS", + "comparison": "isEqualTo", + "value": "" + }, + "customWidth": "50", + "name": "Backend Pool metric VMSS - LB" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "VM Flow Creation and Network Traffic", + "loadType": "always", + "items": [ + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "metricScope": 0, + "resourceIds": [ + "{BackenVMs}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "BackenVMs", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "aggregation": 4 + } + ], + "title": "Inbound Flow Creation Rate (Max)", + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "linkColumn": "Name", + "linkTarget": "Metrics", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "showBorder": false, + "sortCriteriaField": "Value", + "sortOrderField": 2 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "linkColumn": "microsoft.compute/virtualmachines--Inbound Flows", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": null + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Average" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows", + "label": "Inbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "label": "Inbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "label": "Inbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "label": "Inbound Flows Maximum Creation Rate (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows", + "label": "Outbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "label": "Outbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "label": "Outbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "label": "Outbound Flows Maximum Creation Rate (Average) Timeline" + } + ] + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "BackenVMs", + "comparison": "isNotEqualTo" + } + ], + "name": "VM Inbound Flow Creation Rate (Max)" + }, + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "metricScope": 0, + "resourceIds": [ + "{BackenVMs}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "BackenVMs", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "aggregation": 4 + } + ], + "title": "Outbound Flow Creation Rate (Max)", + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "linkColumn": "Name", + "linkTarget": "Metrics", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "showBorder": false, + "sortCriteriaField": "Value", + "sortOrderField": 2 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "linkColumn": "microsoft.compute/virtualmachines--Inbound Flows", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": null + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Average" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows", + "label": "Inbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "label": "Inbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "label": "Inbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "label": "Inbound Flows Maximum Creation Rate (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows", + "label": "Outbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "label": "Outbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "label": "Outbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "label": "Outbound Flows Maximum Creation Rate (Average) Timeline" + } + ] + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "BackenVMs", + "comparison": "isNotEqualTo" + } + ], + "name": "VM Outbound Flow Creation Rate (Max)" + }, + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 3, + "metricScope": 0, + "resourceIds": [ + "{BackenVMs}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "BackenVMs", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Inbound Flows", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "aggregation": 4 + } + ], + "title": "Inbound Flow Count and Creation Rate", + "gridFormatType": 2, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "showBorder": false, + "sortCriteriaField": "Name", + "sortOrderField": 2 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "linkColumn": "microsoft.compute/virtualmachines--Inbound Flows", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": null + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Average" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows", + "label": "Inbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "label": "Inbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "label": "Inbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "label": "Inbound Flows Maximum Creation Rate (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows", + "label": "Outbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "label": "Outbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "label": "Outbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "label": "Outbound Flows Maximum Creation Rate (Average) Timeline" + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "BackenVMs", + "comparison": "isNotEqualTo" + } + ], + "name": "Inbound Flows - Backend VM" + }, + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 3, + "metricScope": 0, + "resourceIds": [ + "{BackenVMs}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "BackenVMs", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Outbound Flows", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "aggregation": 4 + } + ], + "title": "Outbound Flow Count and Creation Rate", + "gridFormatType": 2, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "showBorder": false, + "sortCriteriaField": "Name", + "sortOrderField": 2 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "linkColumn": "microsoft.compute/virtualmachines--Inbound Flows", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": null + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Average" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows", + "label": "Inbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "label": "Inbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "label": "Inbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "label": "Inbound Flows Maximum Creation Rate (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows", + "label": "Outbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "label": "Outbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "label": "Outbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "label": "Outbound Flows Maximum Creation Rate (Average) Timeline" + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "BackenVMs", + "comparison": "isNotEqualTo" + } + ], + "name": "Outbound Flows - Backend VM" + }, + { + "type": 10, + "content": { + "chartId": "workbookd486cfe9-d48c-4718-a98e-14326b2b2eca", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 3, + "metricScope": 0, + "resourceIds": [ + "{BackenVMs}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "BackenVMs", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network In Total", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network Out Total", + "aggregation": 1 + } + ], + "title": "Network Traffic by Direction", + "gridFormatType": 2, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "subtitleContent": { + "columnMatch": "Aggregation", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "rightContent": { + "columnMatch": "Timeline", + "formatter": 10, + "formatOptions": { + "showIcon": true + } + }, + "secondaryContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "showBorder": false, + "sortCriteriaField": "Name", + "sortOrderField": 2 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "linkColumn": "microsoft.compute/virtualmachines--Inbound Flows", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": null + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true, + "aggregation": "Average" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "formatter": 10, + "formatOptions": { + "palette": "coldHot", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total (Sum) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows", + "label": "Inbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Timeline", + "label": "Inbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate", + "label": "Inbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Inbound Flows Maximum Creation Rate Timeline", + "label": "Inbound Flows Maximum Creation Rate (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows", + "label": "Outbound Flows (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Timeline", + "label": "Outbound Flows (Average) Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate", + "label": "Outbound Flows Maximum Creation Rate (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Outbound Flows Maximum Creation Rate Timeline", + "label": "Outbound Flows Maximum Creation Rate (Average) Timeline" + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "BackenVMs", + "comparison": "isNotEqualTo" + } + ], + "name": "LB backend VM - Network in/out" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "VM Flow and Traffic Group", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 1, + "content": { + "json": "\tNo Virtual machine resources are configured in backend pool." + }, + "conditionalVisibilities": [ + { + "parameterName": "BackenVMs", + "comparison": "isEqualTo", + "value": "" + }, + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + } + ], + "conditionalVisibility": { + "parameterName": "BackenVMs", + "comparison": "isEqualTo", + "value": "" + }, + "customWidth": "50", + "name": "Backend Pool metric VM - LB" + }, + { + "type": 1, + "content": { + "json": "# Flow Distribution Help\r\nThis page is intended to help customers visualize and manage the number of flows their backend VMs and VMSS instances are receiving and producing. \r\n* See the number of inbound and outbound flows and creation rate for each VM and VMSS instance to ensure the number of flows is not approaching the [per VM flow limit](https://docs.microsoft.com/azure/virtual-network/virtual-machine-network-throughput#flow-limits-and-recommendations)\r\n\t+ If approaching the flow limit, you consider scaling out to more instances in your backend pool \r\n\r\n* Use the inbound flows to visualize the load distribution of your load balancer\r\n\r\n* Use the outbound flows to determine if the processes running within your VM are creating significant outbound connections\r\n\r\n* Use the network throughput to see if there are indiviudal flows that are transmitting significantly larger than average data throughput" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "3" + }, + "name": "Flow Distribution Help" + }, + { + "type": 1, + "content": { + "json": "| **Metric** | **Resource type** | **Description** | **Recommended aggregation** |\r\n| --- | --- | --- | --- |\r\n| Data path availability | Public and internal load balancer | Standard Load Balancer continuously exercises the data path from within a region to the load balancer front end, all the way to the SDN stack that supports your VM. As long as healthy instances remain, the measurement follows the same path as your application's load-balanced traffic. The data path that your customers use is also validated. The measurement is invisible to your application and does not interfere with other operations. | Average |\r\n| Health probe status | Public and internal load balancer | Standard Load Balancer uses a distributed health-probing service that monitors your application endpoint's health according to your configuration settings. This metric provides an aggregate or per-endpoint filtered view of each instance endpoint in the load balancer pool. You can see how Load Balancer views the health of your application, as indicated by your health probe configuration. | Average |\r\n| SYN (synchronize) packets | Public and internal load balancer | Standard Load Balancer does not terminate Transmission Control Protocol (TCP) connections or interact with TCP or UDP packet flows. Flows and their handshakes are always between the source and the VM instance. To better troubleshoot your TCP protocol scenarios, you can make use of SYN packets counters to understand how many TCP connection attempts are made. The metric reports the number of TCP SYN packets that were received. | Average |\r\n| SNAT connections | Public load balancer | Standard Load Balancer reports the number of outbound flows that are masqueraded to the Public IP address front end. Source network address translation (SNAT) ports are an exhaustible resource. This metric can give an indication of how heavily your application is relying on SNAT for outbound originated flows. Counters for successful and failed outbound SNAT flows are reported and can be used to troubleshoot and understand the health of your outbound flows. | Average |\r\n| Byte counters | Public and internal load balancer | Standard Load Balancer reports the data processed per front end. You may notice that the bytes are not distributed equally across the backend instances. This is expected as Azure's Load Balancer algorithm is based on flows | Average |\r\n| Packet counters | Public and internal load balancer | Standard Load Balancer reports the packets processed per front end. | Average |" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "Metric Help" + }, + { + "type": 10, + "content": { + "chartId": "workbook213c3c1b-7370-406c-ae47-ead2d1db2c52", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--VipAvailability", + "aggregation": 4, + "splitBy": "FrontendIPAddress", + "splitBySortOrder": false, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--DipAvailability", + "aggregation": 4, + "splitBy": "FrontendIPAddress", + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "title": "Frontend and Backend Availability", + "gridFormatType": 1, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Metric", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Aggregation", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment Field", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Segment", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Value", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": ">=", + "thresholdValue": "100", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "4", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": ".*\\/Data Path Availability$", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Segment" + ], + "expandTopLevel": true + }, + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "Namespace" + }, + { + "columnId": "Metric" + }, + { + "columnId": "Metric ID" + }, + { + "columnId": "Aggregation" + }, + { + "columnId": "Segment Field", + "label": "" + }, + { + "columnId": "Segment", + "label": "FrontEnd IP" + }, + { + "columnId": "Value", + "label": "Availability" + }, + { + "columnId": "Timeline" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + { + "parameterName": "SKU", + "comparison": "isNotEqualTo", + "value": "Basic" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + "name": " Frontend and Backend Availability" + }, + { + "type": 10, + "content": { + "chartId": "workbookb9e64636-bcd1-4f43-a369-5883ef8e6abe", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--VipAvailability", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--DipAvailability", + "aggregation": 4 + } + ], + "title": "Frontend and Backend Availability", + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "name": " Frontend and Backend Availability" + }, + { + "type": 10, + "content": { + "chartId": "workbookd134607b-032e-45b7-998c-abcb0ad832ab", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--DipAvailability", + "aggregation": 4, + "splitBy": "BackendIPAddress" + } + ], + "title": "Health Probe Status by Backend IP Address", + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + { + "parameterName": "SKU", + "comparison": "isNotEqualTo", + "value": "Basic" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "customWidth": "50", + "name": "LB - Backend health probe by Backend IP" + }, + { + "type": 10, + "content": { + "chartId": "workbookd134607b-032e-45b7-998c-abcb0ad832ab", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--DipAvailability", + "aggregation": 4, + "splitBy": "BackendPort" + } + ], + "title": "Health Probe Status by Backend Port", + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + { + "parameterName": "SKU", + "comparison": "isNotEqualTo", + "value": "Basic" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "customWidth": "50", + "name": "LB - Backend health probe Backend port" + }, + { + "type": 10, + "content": { + "chartId": "workbookd134607b-032e-45b7-998c-abcb0ad832ab", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--DipAvailability", + "aggregation": 4, + "splitBy": "FrontendIPAddress" + } + ], + "title": "Health Probe Status by Frontend IP Address", + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + { + "parameterName": "SKU", + "comparison": "isNotEqualTo", + "value": "Basic" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "customWidth": "50", + "name": "LB Backend health probe Fronend IP" + }, + { + "type": 10, + "content": { + "chartId": "workbookd134607b-032e-45b7-998c-abcb0ad832ab", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--DipAvailability", + "aggregation": 4, + "splitBy": "FrontendPort" + } + ], + "title": "Health Probe Status by Frontend Port", + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibilities": [ + { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + { + "parameterName": "SKU", + "comparison": "isNotEqualTo", + "value": "Basic" + } + ], + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "customWidth": "50", + "name": "LB Backend health probe Frontend port" + }, + { + "type": 1, + "content": { + "json": "# Frontend & Backend Availability Help\r\nFirst, confirm that the Data Path Availability for your Load Balancer Frontends is showing 100. If Data Path Availability is less than 100, this implies an Azure issue creating Load Balancer connection issues. Check the Summary field in the load balancer status grid at the top of this page to learn if there is a known issue impacting your Load Balancer.\r\n\r\nAfter confirming Data Path Availability, review your Health Probe Status metrics to determine if your backend instances are responding. \r\n* Check by VM to see if the problem is specific to a VM\r\n\t+ If specific to a VM, check with this VM to make sure it is healthy\r\n\t\r\n* Check by Port to see if the problem is specific to a Port\r\n\t+ If specific to a Port, your application may not be listening to this port or there may be an NSG rule blocking this port \r\n\t\r\n* Check by Frontend IP or Frontend Port to monitor the backend pool for a specific load balancing rule or service" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "5" + }, + "name": "Frontend & Backend Availability Help" + }, + { + "type": 1, + "content": { + "json": "# Overview Help\r\nThe Overview tab is intended as an entry point to monitor your Load Balancer. It outlines data throughput and frontend/backend availability.\r\n\r\nTo get started:\r\n1. Configure the time range at the top of the workbook to your desired range\r\n\r\n1. Review data throughput to ensure values are within your expected range for the configured time span \r\n\t+ If detailed analysis is warranted view the Data Throughput tab\r\n\t\r\n1. Review Data Path and Backend Availability to ensure your load balancer is reachable and your backend instances are responding to health probes\r\n\t+ If either of these are below 100 and this is not expected, view the Frontend and Backend Availability tab " + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "Overview Help" + }, + { + "type": 10, + "content": { + "chartId": "workbook3a865b12-85e4-474a-857d-e5f9bb405eff", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--SnatConnectionCount", + "aggregation": 1, + "splitBy": "ConnectionState" + } + ], + "title": "Sum of SNAT Connection States", + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "7" + }, + "customWidth": "50", + "name": "Sum of SNAT Connection States" + }, + { + "type": 10, + "content": { + "chartId": "workbooke9b99cce-3d56-45df-a91e-abd08a803feb", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--SnatConnectionCount", + "aggregation": 1, + "splitBy": null + } + ], + "title": "Failed SNAT Connections by Backend IP", + "filters": [ + { + "id": "1", + "key": "ConnectionState", + "operator": 0, + "values": [ + "Failed" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "7" + }, + "customWidth": "50", + "name": "Failed SNAT Connections by Backend IP" + }, + { + "type": 10, + "content": { + "chartId": "workbook9960f8f7-9ba9-418b-9af7-502374d903da", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 1800000 + }, + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--AllocatedSnatPorts", + "aggregation": 1, + "splitBy": "BackendIPAddress", + "columnName": "Avg Allocated TCP SNAT Ports", + "filters": [ + { + "key": "ProtocolType", + "operator": 0, + "valueParam": "TCP" + } + ] + } + ], + "title": "Allocated TCP Ports", + "gridFormatType": 2, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "linkTarget": "Resource" + } + }, + { + "columnMatch": "Avg Allocated TCP SNAT Ports", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": true + }, + "emptyValCustomText": "0" + } + }, + { + "columnMatch": "Avg Allocated TCP SNAT Ports Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Max Used TCP SNAT Ports", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + }, + "emptyValCustomText": "0" + } + }, + { + "columnMatch": "Max Used TCP SNAT Ports Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Avg Allocated UDP SNAT Ports", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": true + }, + "emptyValCustomText": "0" + } + }, + { + "columnMatch": "Avg Allocated UDP SNAT Ports Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Max Used UDP SNAT Ports", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": true + }, + "emptyValCustomText": "0" + } + }, + { + "columnMatch": "Max Used UDP SNAT Ports Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.network/loadbalancers--SnatConnectionCount Timeline", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/loadbalancers--SnatConnectionCount", + "formatter": 1, + "numberFormat": { + "unit": 0, + "options": null + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "Segment", + "label": "Backend IP" + } + ] + }, + "sortBy": [] + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "7" + }, + "customWidth": "50", + "name": "metric - 36", + "styleSettings": { + "padding": "-50px" + } + }, + { + "type": 10, + "content": { + "chartId": "workbook0d9bb3fe-0f56-437a-a20f-22a9f0498710", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--UsedSnatPorts", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--AllocatedSnatPorts", + "aggregation": 1 + } + ], + "title": "Used TCP Ports by Backend IP", + "filters": [ + { + "id": "1", + "key": "ProtocolType", + "operator": 0, + "valueParam": "TCP" + }, + { + "id": "1", + "key": "ProtocolType", + "operator": 0, + "values": [ + "TCP" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "7" + }, + "customWidth": "50", + "name": "metric - 37" + }, + { + "type": 10, + "content": { + "chartId": "workbook9960f8f7-9ba9-418b-9af7-502374d903da", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--AllocatedSnatPorts", + "aggregation": 1, + "splitBy": "BackendIPAddress", + "columnName": "Avg Allocated TCP SNAT Ports", + "filters": [ + { + "key": "ProtocolType", + "operator": 0, + "valueParam": "UDP" + } + ] + } + ], + "title": "Allocated UDP Ports", + "gridFormatType": 2, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "linkTarget": "Resource" + } + }, + { + "columnMatch": "Avg Allocated TCP SNAT Ports", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": true + }, + "emptyValCustomText": "0" + } + }, + { + "columnMatch": "Avg Allocated TCP SNAT Ports Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Max Used TCP SNAT Ports", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + }, + "emptyValCustomText": "0" + } + }, + { + "columnMatch": "Max Used TCP SNAT Ports Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Avg Allocated UDP SNAT Ports", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": true + }, + "emptyValCustomText": "0" + } + }, + { + "columnMatch": "Avg Allocated UDP SNAT Ports Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Max Used UDP SNAT Ports", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": true + }, + "emptyValCustomText": "0" + } + }, + { + "columnMatch": "Max Used UDP SNAT Ports Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.network/loadbalancers--SnatConnectionCount Timeline", + "formatter": 5 + }, + { + "columnMatch": "microsoft.network/loadbalancers--SnatConnectionCount", + "formatter": 1, + "numberFormat": { + "unit": 0, + "options": null + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "Segment", + "label": "Backend IP" + } + ] + }, + "sortBy": [] + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "7" + }, + "customWidth": "50", + "name": "Allocated UDP Ports", + "styleSettings": { + "padding": "-50px" + } + }, + { + "type": 10, + "content": { + "chartId": "workbook1c0c77c5-003c-4ec2-bc6c-3de3fa566433", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--UsedSnatPorts", + "aggregation": 4, + "splitBy": "BackendIPAddress" + } + ], + "title": "Used UDP Ports by Backend IP", + "filters": [ + { + "id": "1", + "key": "ProtocolType", + "operator": 0, + "valueParam": "UDP" + }, + { + "id": "1", + "key": "ProtocolType", + "operator": 0, + "values": [ + "UDP" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "7" + }, + "customWidth": "50", + "name": "Used UDP Ports by Backend IP" + }, + { + "type": 10, + "content": { + "chartId": "workbook36c21220-1a33-47e9-8091-b45cceae698e", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--ByteCount", + "aggregation": 1, + "splitBy": "Direction" + } + ], + "title": "Total Data Throughput by Direction", + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "6" + }, + "name": "Total Data Throughput by Direction" + }, + { + "type": 10, + "content": { + "chartId": "workbook5d778019-a517-4fee-bb2b-f4287a97565c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--ByteCount", + "aggregation": 1, + "splitBy": "FrontendIPAddress", + "filters": [ + { + "key": "Direction", + "operator": 0, + "values": [ + "In" + ] + } + ] + } + ], + "title": "Inbound Data Throughput Per Frontend IP", + "filters": [ + { + "id": "1", + "key": "Direction", + "operator": 0, + "values": [ + "In" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "6" + }, + "customWidth": "50", + "name": "Inbound Data Throughput Per Frontend IP" + }, + { + "type": 10, + "content": { + "chartId": "workbook5d778019-a517-4fee-bb2b-f4287a97565c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--ByteCount", + "aggregation": 1, + "splitBy": "FrontendIPAddress", + "filters": [ + { + "key": "Direction", + "operator": 0, + "values": [ + "Out" + ] + } + ] + } + ], + "title": "Outbound Data Throughput Per Frontend IP", + "filters": [ + { + "id": "1", + "key": "Direction", + "operator": 0, + "values": [ + "Out" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "6" + }, + "customWidth": "50", + "name": "Outbound Data Throughput Per Frontend IP" + }, + { + "type": 10, + "content": { + "chartId": "workbook5d778019-a517-4fee-bb2b-f4287a97565c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--ByteCount", + "aggregation": 1, + "splitBy": "FrontendPort", + "filters": [ + { + "key": "Direction", + "operator": 0, + "values": [ + "Out" + ] + } + ] + } + ], + "title": "Inbound Data Throughput Per Frontend Port", + "filters": [ + { + "id": "2", + "key": "Direction", + "operator": 0, + "values": [ + "In" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "6" + }, + "customWidth": "50", + "name": "Inbound Data Throughput Per Frontend Port" + }, + { + "type": 10, + "content": { + "chartId": "workbook5d778019-a517-4fee-bb2b-f4287a97565c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{LoadBalancer}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/loadbalancers", + "resourceParameter": "LoadBalancer", + "metrics": [ + { + "namespace": "microsoft.network/loadbalancers", + "metric": "microsoft.network/loadbalancers--ByteCount", + "aggregation": 1, + "splitBy": "FrontendPort", + "filters": [ + { + "key": "Direction", + "operator": 0, + "values": [ + "Out" + ] + } + ] + } + ], + "title": "Outbound Data Throughput Per Frontend Port", + "filters": [ + { + "id": "1", + "key": "Direction", + "operator": 0, + "values": [ + "Out" + ] + } + ], + "gridSettings": { + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "6" + }, + "customWidth": "50", + "name": "Outbound Data Throughput Per Frontend Port" + }, + { + "type": 1, + "content": { + "json": "# Data Throughput Help\r\nThis page is intended to allow customers to visualize the amount of data flowing through their load balancer and filter this to specific services or load balancer rules.\r\n* Review your total inbound and outbound Data Throughput to identify if your traffic patterns are as expected\r\n\t+ If unexpected, view by Frontend IP and Port to see if a specific service is seeing higher than usual traffic\r\n\r\n* View by Frontend IP and/or Port to monitor specific services and load balancing rules\r\n\r\n**Note:** Graphs may have slight refresh time offset from each other, so graph totals may not match up. Please highlight specific time to get most accurate comparison." + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "6" + }, + "name": "Data Throughput Help" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Network Insights/Workbooks/LoadBalancerWorkbooks/NetworkInsights-LoadBalancerMetrics/settings.json b/Network Insights/Workbooks/LoadBalancerWorkbooks/NetworkInsights-LoadBalancerMetrics/settings.json new file mode 100644 index 0000000..0f4e74f --- /dev/null +++ b/Network Insights/Workbooks/LoadBalancerWorkbooks/NetworkInsights-LoadBalancerMetrics/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Network Insights LoadBalancers", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.network/loadbalancers", "order": 100 }] +} diff --git a/Network Insights/Workbooks/LoadBalancerWorkbooks/categoryResources.json b/Network Insights/Workbooks/LoadBalancerWorkbooks/categoryResources.json new file mode 100644 index 0000000..0b1ff2d --- /dev/null +++ b/Network Insights/Workbooks/LoadBalancerWorkbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Network Insights LoadBalancers", "description": "", "order": 100} +} \ No newline at end of file diff --git a/Network Insights/Workbooks/NetworkInsights-AppGatewayMetrics-Minified/NetworkInsights-AppGatewayMetrics-Minified.workbook b/Network Insights/Workbooks/NetworkInsights-AppGatewayMetrics-Minified/NetworkInsights-AppGatewayMetrics-Minified.workbook new file mode 100644 index 0000000..b79c265 --- /dev/null +++ b/Network Insights/Workbooks/NetworkInsights-AppGatewayMetrics-Minified/NetworkInsights-AppGatewayMetrics-Minified.workbook @@ -0,0 +1,825 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "571d231b-7627-4524-b720-c4f1afe40ca7", + "version": "KqlParameterItem/1.0", + "name": "HideVMSS", + "label": "Hide VMSS", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "b0dabaed-102e-4a3c-9135-99922686f1d7", + "version": "KqlParameterItem/1.0", + "name": "HideVMs", + "label": "Hide VMs", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "799c3cee-1f5d-4411-9ec9-00827e6db235", + "version": "KqlParameterItem/1.0", + "name": "HidePublicIPs", + "label": "Hide PublicIPs", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "ConditionalVariables" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "51f9f779-6b41-40ef-a8f0-aac280110a08", + "version": "KqlParameterItem/1.0", + "name": "ApplicationGateway", + "label": "Application gateway", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.network/applicationgateways": true + }, + "additionalResourceOptions": [] + }, + "jsonData": "" + }, + { + "id": "4fad9342-29f1-445d-a22d-063a6eb69637", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "label": "Time range", + "value": { + "durationMs": 86400000 + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "ApplicationGatewaysParam" + }, + { + "type": 10, + "content": { + "chartId": "workbook60676d8f-19b9-4593-999c-67b0ca993045", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 3, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--Throughput", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--ResponseStatus", + "aggregation": 1 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--FailedRequests", + "aggregation": 1 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--UnhealthyHostCount", + "aggregation": 4 + } + ], + "title": "Application gateway metrics", + "gridSettings": { + "rowLimit": 10000, + "labelSettings": [] + }, + "exportToExcelOptions": "visible" + }, + "showPin": true, + "name": "ApplicationGatewayMetrics" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "2e739e26-0168-4a42-a226-f400147bebbb", + "version": "KqlParameterItem/1.0", + "name": "BackendVMSS", + "label": "Backend VMSS", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachinescalesets": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "jsonData": "", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "HideVMSS", + "comparison": "isNotEqualTo", + "value": "true" + }, + "name": "VMSSParam" + }, + { + "type": 10, + "content": { + "chartId": "workbookc2031e24-e478-480c-8669-a7d645467b04", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "resourceIds": [ + "{BackendVMSS}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachinescalesets", + "resourceParameter": "BackendVMSS", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Percentage CPU", + "aggregation": 4, + "splitBy": null + } + ], + "title": "VMSS metrics", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Percentage CPU", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed", + "linkColumn": "microsoft.compute/virtualmachinescalesets--Percentage CPU", + "linkTarget": "Metrics", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Percentage CPU Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachinescalesets--Percentage CPU", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Network In Total", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Network In Total Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachinescalesets--Network In Total", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Network Out Total", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Network Out Total Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachinescalesets--Network Out Total", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Disk Read Bytes", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Disk Read Bytes Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachinescalesets--Disk Read Bytes", + "linkTarget": "Metrics", + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "labelSettings": [] + }, + "resourceLimit": 10000, + "showExportToExcel": true, + "exportToExcelOptions": "visible" + }, + "conditionalVisibility": { + "parameterName": "HideVMSS", + "comparison": "isNotEqualTo", + "value": "true" + }, + "showPin": true, + "name": "VMSS metrics" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "3230e948-6be0-4be7-b468-7aaccb128d88", + "version": "KqlParameterItem/1.0", + "name": "BackendVMs", + "label": "Backend VMs", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "jsonData": "", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "HideVMs", + "comparison": "isNotEqualTo", + "value": "true" + }, + "name": "VMParam" + }, + { + "type": 10, + "content": { + "chartId": "workbook8e886ca8-2f26-4370-8f1a-4ae8ca532d13", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "resourceIds": [ + "{BackendVMs}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "BackendVMs", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Percentage CPU", + "aggregation": 4, + "splitBy": null + } + ], + "title": "VM Metrics", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed", + "linkColumn": "microsoft.compute/virtualmachines--Percentage CPU", + "linkTarget": "Metrics", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachines--Percentage CPU", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachines--Network In Total", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachines--Network Out Total", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Disk Read Bytes", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Disk Read Bytes Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachines--Disk Read Bytes", + "linkTarget": "Metrics", + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.compute/virtualmachines--Percentage CPU_2", + "sortOrder": 1 + } + ], + "labelSettings": [] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.compute/virtualmachines--Percentage CPU_2", + "sortOrder": 1 + } + ], + "resourceLimit": 10000, + "showExportToExcel": true, + "exportToExcelOptions": "visible" + }, + "conditionalVisibility": { + "parameterName": "HideVMs", + "comparison": "isNotEqualTo", + "value": "true" + }, + "showPin": true, + "name": "VMMetrics" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "0acb058c-1c01-4235-8379-71a9cef263ea", + "version": "KqlParameterItem/1.0", + "name": "BackendPublicIPs", + "label": "Backend Public IPs", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.network/publicipaddresses": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "jsonData": "", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "HidePublicIPs", + "comparison": "isNotEqualTo", + "value": "true" + }, + "name": "PublicIPParam" + }, + { + "type": 10, + "content": { + "chartId": "workbook316b9bf2-549a-4d41-b5bf-898890b97777", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "resourceIds": [ + "{BackendPublicIPs}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/publicipaddresses", + "resourceParameter": "BackendPublicIPs", + "metrics": [ + { + "namespace": "microsoft.network/publicipaddresses", + "metric": "microsoft.network/publicipaddresses--TCPPacketsDroppedDDoS", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.network/publicipaddresses", + "metric": "microsoft.network/publicipaddresses--UDPPacketsDroppedDDoS", + "aggregation": 3 + }, + { + "namespace": "microsoft.network/publicipaddresses", + "metric": "microsoft.network/publicipaddresses--TCPBytesDroppedDDoS", + "aggregation": 3 + }, + { + "namespace": "microsoft.network/publicipaddresses", + "metric": "microsoft.network/publicipaddresses--UDPBytesDroppedDDoS", + "aggregation": 3 + } + ], + "title": "Public IP Metrics", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--TCPPacketsDroppedDDoS", + "formatter": 5, + "formatOptions": { + "palette": "greenRed", + "linkColumn": "microsoft.network/publicipaddresses--TCPBytesDroppedDDoS", + "linkTarget": "Metrics", + "showIcon": true + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--TCPPacketsDroppedDDoS Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.network/publicipaddresses--TCPPacketsDroppedDDoS", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--UDPPacketsDroppedDDoS", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--UDPPacketsDroppedDDoS Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.network/publicipaddresses--UDPPacketsDroppedDDoS", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--TCPBytesDroppedDDoS", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--TCPBytesDroppedDDoS Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.network/publicipaddresses--TCPBytesDroppedDDoS", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--UDPBytesDroppedDDoS", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--UDPBytesDroppedDDoS Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.network/publicipaddresses--UDPBytesDroppedDDoS", + "linkTarget": "Metrics", + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "labelSettings": [] + }, + "resourceLimit": 10000, + "showExportToExcel": true, + "exportToExcelOptions": "visible" + }, + "conditionalVisibility": { + "parameterName": "HidePublicIPs", + "comparison": "isNotEqualTo", + "value": "true" + }, + "showPin": true, + "name": "PublicIPMetrics" + } + ], + "styleSettings": { + "paddingStyle": "none", + "spacingStyle": "none" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Network Insights/Workbooks/NetworkInsights-AppGatewayMetrics-Minified/settings.json b/Network Insights/Workbooks/NetworkInsights-AppGatewayMetrics-Minified/settings.json new file mode 100644 index 0000000..9cb52e1 --- /dev/null +++ b/Network Insights/Workbooks/NetworkInsights-AppGatewayMetrics-Minified/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Network Insights AppGateways Minified", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.network/applicationGateways", "order": 100 }] +} \ No newline at end of file diff --git a/Network Insights/Workbooks/NetworkInsights-AppGatewayMetrics/NetworkInsights-AppGatewayMetrics.workbook b/Network Insights/Workbooks/NetworkInsights-AppGatewayMetrics/NetworkInsights-AppGatewayMetrics.workbook new file mode 100644 index 0000000..4708128 --- /dev/null +++ b/Network Insights/Workbooks/NetworkInsights-AppGatewayMetrics/NetworkInsights-AppGatewayMetrics.workbook @@ -0,0 +1,861 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e4451e8e-9f93-40c2-a17f-1233c5f17c83", + "version": "KqlParameterItem/1.0", + "name": "HideVMSS", + "label": "Hide VMSS", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "b3055533-5851-4f02-99ce-37feda2db2a3", + "version": "KqlParameterItem/1.0", + "name": "HideVMs", + "label": "Hide VMs", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "96e858f6-378f-4b1d-8c2a-e625929ce826", + "version": "KqlParameterItem/1.0", + "name": "HidePublicIPs", + "label": "Hide PublicIPs", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "ConditionalVariables" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "51f9f779-6b41-40ef-a8f0-aac280110a08", + "version": "KqlParameterItem/1.0", + "name": "ApplicationGateway", + "label": "Application gateway", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.network/applicationgateways": true + }, + "additionalResourceOptions": [] + }, + "jsonData": "" + }, + { + "id": "4fad9342-29f1-445d-a22d-063a6eb69637", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "label": "Time range", + "value": { + "durationMs": 86400000 + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "ApplicationGatewaysParam" + }, + { + "type": 10, + "content": { + "chartId": "workbook60676d8f-19b9-4593-999c-67b0ca993045", + "version": "MetricsItem/2.0", + "size": 3, + "chartType": 3, + "resourceIds": [ + "{ApplicationGateway}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/applicationgateways", + "resourceParameter": "ApplicationGateway", + "metrics": [ + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--Throughput", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--ResponseStatus", + "aggregation": 1 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--FailedRequests", + "aggregation": 1 + }, + { + "namespace": "microsoft.network/applicationgateways", + "metric": "microsoft.network/applicationgateways--UnhealthyHostCount", + "aggregation": 4 + } + ], + "title": "Application gateway metrics", + "gridSettings": { + "rowLimit": 10000, + "labelSettings": [] + }, + "exportToExcelOptions": "visible" + }, + "showPin": true, + "name": "ApplicationGatewayMetrics" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "2e739e26-0168-4a42-a226-f400147bebbb", + "version": "KqlParameterItem/1.0", + "name": "BackendVMSS", + "label": "Backend VMSS", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachinescalesets": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "jsonData": "", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "HideVMSS", + "comparison": "isNotEqualTo", + "value": "true" + }, + "name": "VMSSParam" + }, + { + "type": 10, + "content": { + "chartId": "workbookc2031e24-e478-480c-8669-a7d645467b04", + "version": "MetricsItem/2.0", + "size": 3, + "chartType": 0, + "resourceIds": [ + "{BackendVMSS}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachinescalesets", + "resourceParameter": "BackendVMSS", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Percentage CPU", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Network In Total", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Network Out Total", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachinescalesets", + "metric": "microsoft.compute/virtualmachinescalesets--Disk Read Bytes", + "aggregation": 1, + "splitBy": null + } + ], + "title": "VMSS metrics", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Percentage CPU", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed", + "linkColumn": "microsoft.compute/virtualmachinescalesets--Percentage CPU", + "linkTarget": "Metrics", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Percentage CPU Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachinescalesets--Percentage CPU", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Network In Total", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Network In Total Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachinescalesets--Network In Total", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Network Out Total", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Network Out Total Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachinescalesets--Network Out Total", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Disk Read Bytes", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachinescalesets--Disk Read Bytes Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachinescalesets--Disk Read Bytes", + "linkTarget": "Metrics", + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "labelSettings": [] + }, + "resourceLimit": 10000, + "showExportToExcel": true, + "exportToExcelOptions": "visible" + }, + "conditionalVisibility": { + "parameterName": "HideVMSS", + "comparison": "isNotEqualTo", + "value": "true" + }, + "showPin": true, + "name": "VMSS metrics" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "3230e948-6be0-4be7-b468-7aaccb128d88", + "version": "KqlParameterItem/1.0", + "name": "BackendVMs", + "label": "Backend VMs", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "jsonData": "", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "HideVMs", + "comparison": "isNotEqualTo", + "value": "true" + }, + "name": "VMParam" + }, + { + "type": 10, + "content": { + "chartId": "workbook8e886ca8-2f26-4370-8f1a-4ae8ca532d13", + "version": "MetricsItem/2.0", + "size": 3, + "chartType": 0, + "resourceIds": [ + "{BackendVMs}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "BackendVMs", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Percentage CPU", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network In Total", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network Out Total", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Disk Read Bytes", + "aggregation": 1, + "splitBy": null + } + ], + "title": "VM Metrics", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed", + "linkColumn": "microsoft.compute/virtualmachines--Percentage CPU", + "linkTarget": "Metrics", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachines--Percentage CPU", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachines--Network In Total", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachines--Network Out Total", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Disk Read Bytes", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Disk Read Bytes Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.compute/virtualmachines--Disk Read Bytes", + "linkTarget": "Metrics", + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.compute/virtualmachines--Percentage CPU_2", + "sortOrder": 1 + } + ], + "labelSettings": [] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.compute/virtualmachines--Percentage CPU_2", + "sortOrder": 1 + } + ], + "resourceLimit": 10000, + "showExportToExcel": true, + "exportToExcelOptions": "visible" + }, + "conditionalVisibility": { + "parameterName": "HideVMs", + "comparison": "isNotEqualTo", + "value": "true" + }, + "showPin": true, + "name": "VMMetrics" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "0acb058c-1c01-4235-8379-71a9cef263ea", + "version": "KqlParameterItem/1.0", + "name": "BackendPublicIPs", + "label": "Backend Public IPs", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.network/publicipaddresses": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "jsonData": "", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "HidePublicIPs", + "comparison": "isNotEqualTo", + "value": "true" + }, + "name": "PublicIPParam" + }, + { + "type": 10, + "content": { + "chartId": "workbook316b9bf2-549a-4d41-b5bf-898890b97777", + "version": "MetricsItem/2.0", + "size": 3, + "chartType": 0, + "resourceIds": [ + "{BackendPublicIPs}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.network/publicipaddresses", + "resourceParameter": "BackendPublicIPs", + "metrics": [ + { + "namespace": "microsoft.network/publicipaddresses", + "metric": "microsoft.network/publicipaddresses--TCPPacketsDroppedDDoS", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.network/publicipaddresses", + "metric": "microsoft.network/publicipaddresses--UDPPacketsDroppedDDoS", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.network/publicipaddresses", + "metric": "microsoft.network/publicipaddresses--TCPBytesDroppedDDoS", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.network/publicipaddresses", + "metric": "microsoft.network/publicipaddresses--UDPBytesDroppedDDoS", + "aggregation": 3, + "splitBy": null + } + ], + "title": "Public IP Metrics", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--TCPPacketsDroppedDDoS", + "formatter": 5, + "formatOptions": { + "palette": "greenRed", + "linkColumn": "microsoft.network/publicipaddresses--TCPBytesDroppedDDoS", + "linkTarget": "Metrics", + "showIcon": true + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--TCPPacketsDroppedDDoS Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.network/publicipaddresses--TCPPacketsDroppedDDoS", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--UDPPacketsDroppedDDoS", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--UDPPacketsDroppedDDoS Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.network/publicipaddresses--UDPPacketsDroppedDDoS", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--TCPBytesDroppedDDoS", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--TCPBytesDroppedDDoS Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.network/publicipaddresses--TCPBytesDroppedDDoS", + "linkTarget": "Metrics", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--UDPBytesDroppedDDoS", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.network/publicipaddresses--UDPBytesDroppedDDoS Timeline", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "linkColumn": "microsoft.network/publicipaddresses--UDPBytesDroppedDDoS", + "linkTarget": "Metrics", + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "labelSettings": [] + }, + "resourceLimit": 10000, + "showExportToExcel": true, + "exportToExcelOptions": "visible" + }, + "conditionalVisibility": { + "parameterName": "HidePublicIPs", + "comparison": "isNotEqualTo", + "value": "true" + }, + "showPin": true, + "name": "PublicIPMetrics" + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Network Insights/Workbooks/NetworkInsights-AppGatewayMetrics/settings.json b/Network Insights/Workbooks/NetworkInsights-AppGatewayMetrics/settings.json new file mode 100644 index 0000000..a6a8736 --- /dev/null +++ b/Network Insights/Workbooks/NetworkInsights-AppGatewayMetrics/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Network Insights AppGateways", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.network/applicationGateways", "order": 100 }] +} \ No newline at end of file diff --git a/Network Insights/Workbooks/categoryResources.json b/Network Insights/Workbooks/categoryResources.json new file mode 100644 index 0000000..410edad --- /dev/null +++ b/Network Insights/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Network Insights", "description": "", "order": 100} +} \ No newline at end of file diff --git a/Performance/Alerts/README b/Performance/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Performance/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Performance/Queries/README b/Performance/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Performance/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Performance/Workbooks/Apdex/Apdex.workbook b/Performance/Workbooks/Apdex/Apdex.workbook new file mode 100644 index 0000000..25845d7 --- /dev/null +++ b/Performance/Workbooks/Apdex/Apdex.workbook @@ -0,0 +1,383 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Apdex\n\n[Apdex (Application Performance Index)](http://apdex.org/overview.html) is an open standard method for measuring application performance. It contextualizes your application's performance in terms of the quality of experience you provide to your users.\n\nApdex classifies performance into three zones based on a baseline performance threshold T you define for your app:\n\n| Zone | Minimum Response Time | Maximum Response Time |\n| --- |: --- |: --- |: --- |\n| Satisfied | 0 seconds | T seconds |\n| Tolerating | T seconds | 4T seconds |\n| Frustrated | 4T seconds | - |\n" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Apdex Parameters" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "f3e68c23-278e-4175-815d-dc7961bf34a0", + "version": "KqlParameterItem/1.0", + "name": "Type", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable( column1:string, column2:string ) \r\n[ \r\n\"union pageViews, requests, dependencies\", \"Page Views, Requests and Dependencies\", \r\n\"union pageViews, requests\", \"Page Views and Requests\", \r\n\"pageViews\", \"Page Views\", \r\n\"requests\", \"Requests\", \r\n\"dependencies\", \"Dependencies\", \r\n] ", + "isHiddenWhenLocked": false, + "value": "pageViews" + }, + { + "id": "07a9044c-0e5d-40f2-b815-b002fdcf5220", + "version": "KqlParameterItem/1.0", + "name": "Operations", + "type": 2, + "description": "Comma seperated list of items to include in Apdex calculations. example: 'RequestA', 'RequestB', 'PageViewC'. Use '*' to include all", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "{Type}\n| where timestamp >= ago(7d)\n| summarize count() by name\n| order by count_ desc\n| project Id=name, Title=name, Selected=false\n| union (\ndatatable(Id:string, Title:string, Selected:boolean)[\n'*', 'All Operations', true\n]\n)" + }, + { + "id": "9e8aba54-518d-443e-9eaf-4c8e87d513be", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ], + "allowCustom": true + }, + "timeContextFromParameter": null + }, + { + "id": "e2d47629-1167-4d8b-bd88-3f5641e6d484", + "version": "KqlParameterItem/1.0", + "name": "OperationsFilter", + "type": 1, + "description": null, + "isRequired": false, + "isHiddenWhenLocked": false, + "value": "" + }, + { + "id": "822d691d-da84-46c8-84de-e2b091fb8387", + "version": "KqlParameterItem/1.0", + "name": "ApdexThresholdInMilliseconds", + "type": 1, + "description": "The threshold to use in Apdex calculations. It defaults to the average operation duration for the select activities.", + "isRequired": true, + "query": "{Type}\n| where timestamp {TimeRange}\n| where name in ({Operations}) or '*' in ({Operations})\n| summarize SumOfDuration = sum(duration), CountOfDuration = count()\n| project AverageDuration = round(iff(CountOfDuration == 0, 0.0, 1.0 * SumOfDuration / CountOfDuration))\n", + "isHiddenWhenLocked": false, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "17ac059b-c7b6-498c-81b8-23c3213f38ee", + "version": "KqlParameterItem/1.0", + "name": "Calculations", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(x: string, y: string) [\r\n'ConsiderFailures', 'Consider failures as frustrating', \r\n'DoNotConsiderFailures', 'Do not consider failures as frustrating'\r\n]", + "value": "ConsiderFailures" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "`ApdexThresholdInMilliseconds` defaults to the average duration for the selected operations. Set this to a threshold that makes sense for your app.\n\n### Drill-in parameters" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "2f57173e-c1de-4b51-90a6-fc4baee9fec6", + "version": "KqlParameterItem/1.0", + "name": "SplitBy", + "type": 2, + "isRequired": true, + "query": "datatable(value:string, text:string)[\r\n'name', '⚪ Activity Name',\r\n'cloud_RoleInstance', '🖥️ Machine',\r\n'client_CountryOrRegion', '📍 Country or Region',\r\n'client_StateOrProvince', '📍 State or Province',\r\n'application_Version', '⚪ Application Version',\r\n'operation_Name', '⚪ Operation',\r\n]\r\n| union ({Type}\r\n| where timestamp {TimeRange}\r\n| where name in ({Operations}) or '*' in ({Operations})\r\n| project customDimensions \r\n| summarize schema = buildschema(customDimensions) \r\n| mvexpand schema\r\n| extend e = extract(@'{\"(.+)\":.+}', 1, tostring(schema))\r\n| project text = strcat('❄️ ', e), value = strcat('customDimensions[\"', e, '\"]'))", + "value": "name", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "6d8ec5b4-d1a7-45a0-9703-870eea3fad3d", + "version": "KqlParameterItem/1.0", + "name": "OrderBy", + "type": 2, + "isRequired": true, + "query": "datatable(value:string, text:string)[\r\n'Relevance desc', 'Most Relevant',\r\n'[\"Apdex Score\"] desc', 'Highest Apdex',\r\n'[\"Apdex Score\"] asc', 'Lowest Apdex',\r\n'Users desc', 'Most Users',\r\n]", + "value": "Relevance desc", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "dd476d22-f17b-4ad9-ad00-e5d0cf73fe25", + "version": "KqlParameterItem/1.0", + "name": "SegmentFilters", + "type": 2, + "isRequired": false, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "{Type}\r\n| where timestamp {TimeRange}\r\n| where name in ({Operations}) or '*' in ({Operations})\r\n| extend Dim = iff(isempty({SplitBy})== true, 'Unknown', {SplitBy})\r\n| summarize by Value = Dim, Name = Dim\r\n| extend isDefault = false\r\n| order by Name asc\r\n| union (datatable(Value:string, Name:string, isDefault:boolean)[ '*', 'Include All', true])\r\n", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let apdexThreshhold = toint('{ApdexThresholdInMilliseconds}');\r\nlet apdexData = {Type}\r\n| where timestamp {TimeRange}\r\n| where name in ({Operations}) or '*' in ({Operations})\r\n{OperationsFilter}\r\n| extend success = columnifexists('success', true)\r\n| extend Failure = iff('{Calculations}' == 'ConsiderFailures' and success == false, 1, 0)\r\n| extend InterestingDimension = iff(isempty({SplitBy})== true, 'Unknown', {SplitBy})\r\n| where InterestingDimension in ({SegmentFilters}) or '*' in ({SegmentFilters})\r\n| summarize AverageDuration = avg(duration), Failures = sum(Failure) by user_Id\r\n| extend UserExperience = case(AverageDuration <= apdexThreshhold, 'Satisfied', AverageDuration <= 4 * apdexThreshhold, 'Tolerating', 'Frustrated')\r\n| extend UserExperience = case(Failures > 0, \"Frustrated\", UserExperience)\r\n| summarize Satisfied = countif(UserExperience == 'Satisfied'), Tolerating = countif(UserExperience == 'Tolerating'), Frustrated = countif(UserExperience == 'Frustrated'), Total = count()\r\n| project Satisfied, Tolerating, Frustrated, ApdexScore = round((Satisfied + (Tolerating / 2.0)) / Total, 2);\r\napdexData\r\n//| extend [\"Apdex Interpretation\"] = case([\"Apdex Score\"] <= 0.5, '⛔ Unacceptable', [\"Apdex Score\"] <= 0.7, '⚠️ Poor', [\"Apdex Score\"] <= 0.85, '⚠️ Fair', [\"Apdex Score\"] <= 0.94, '✔️ Good', '✔️ Excellent')\r\n| evaluate narrow()\r\n| extend Value = toreal(Value)\r\n| project Name = case(Column == 'Satisfied', 'Satisfied Users', Column == 'Tolerating', 'Tolerating Users', Column == 'Frustrated', 'Frustrated Users', 'Apdex Score'), Value, Rank = case(Column == 'Satisfied', 2, Column == 'Tolerating', 3, Column == 'Frustrated', 4, 1), Interperation = iff(Column == 'ApdexScore', case(Value <= 0.5, '⛔ Unacceptable', Value <= 0.7, '⚠️ Poor', Value <= 0.85, '⚠️ Fair', Value <= 0.94, '✔️ Good', '✔️ Excellent'), '')\r\n| order by Rank asc", + "showQuery": false, + "size": 3, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + "secondaryContent": { + "columnMatch": "Interperation", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": false + } + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let apdexThreshhold = toint('{ApdexThresholdInMilliseconds}');\nlet apdexData = {Type}\n| where timestamp {TimeRange}\n| where name in ({Operations}) or '*' in ({Operations})\n{OperationsFilter}\n| extend success = columnifexists('success', true)\n| extend Failure = iff('{Calculations}' == 'ConsiderFailures' and success == false, 1, 0)\n| extend InterestingDimension = iff(isempty({SplitBy})== true, 'Unknown', {SplitBy})\n| where InterestingDimension in ({SegmentFilters}) or '*' in ({SegmentFilters})\n| summarize AverageDuration = avg(duration), Failures = sum(Failure) by user_Id, InterestingDimension\n| extend UserExperience = case(AverageDuration <= apdexThreshhold, 'Satisfied', AverageDuration <= 4 * apdexThreshhold, 'Tolerating', 'Frustrated')\n| extend UserExperience = case(Failures > 0, \"Frustrated\", UserExperience)\n| summarize Satisfied = countif(UserExperience == 'Satisfied'), Tolerating = countif(UserExperience == 'Tolerating'), Frustrated = countif(UserExperience == 'Frustrated'), Total = count() by InterestingDimension\n| project InterestingDimension, [\"Satisfied Users\"] = Satisfied, [\"Tolerating Users\"] = Tolerating, [\"Frustrated Users\"] = Frustrated, [\"Apdex Score\"] = round((Satisfied + (Tolerating / 2.0)) / Total, 2), Total\n| extend Relevance = iff([\"Apdex Score\"] == 0, pow(Total, 1.6), Total / [\"Apdex Score\"])\n| project-rename Users = Total\n| order by {OrderBy}\n| project-away Users, Relevance;\napdexData\n| extend [\"Apdex Interpretation\"] = case([\"Apdex Score\"] <= 0.5, '⛔ Unacceptable', [\"Apdex Score\"] <= 0.7, '⚠️ Poor', [\"Apdex Score\"] <= 0.85, '⚠️ Fair', [\"Apdex Score\"] <= 0.94, '✔️ Good', '✔️ Excellent')\n| project Values = InterestingDimension, [\"Apdex Score\"], [\"Apdex Interpretation\"], [\"Satisfied Users\"], [\"Tolerating Users\"], [\"Frustrated Users\"]\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Apdex Score", + "formatter": 3, + "formatOptions": { + "min": 0, + "max": 1, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Satisfied", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Tolerating Users", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Frustrated Users", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "alwaysShowPin": true + }, + { + "type": 1, + "content": { + "json": "# Daily Apdex Score\nSee how your Apdex Score changes over time." + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let apdexThreshhold = toint('{ApdexThresholdInMilliseconds}');\nlet failureThreshhold = 1;\nlet apdexData = {Type}\n| where timestamp {TimeRange}\n| where name in ({Operations}) or '*' in ({Operations})\n{OperationsFilter}\n| extend success = columnifexists('success', true)\n| extend Failure = iff('{Calculations}' == 'ConsiderFailures' and success == false, 1, 0)\n| extend InterestingDimension = iff(isempty({SplitBy})== true, 'Unknown', {SplitBy})\n| where InterestingDimension in ({SegmentFilters}) or '*' in ({SegmentFilters})\n| summarize AverageDuration = avg(duration), Failures = sum(Failure) by user_Id, bin(timestamp, {TimeRange:grain}), InterestingDimension\n| extend UserExperience = case(AverageDuration <= apdexThreshhold, 'Satisfied', AverageDuration <= 4 * apdexThreshhold, 'Tolerating', 'Frustrated')\n| extend UserExperience = case(Failures >= failureThreshhold, \"Frustrated\", UserExperience)\n| summarize Satisfied = countif(UserExperience == 'Satisfied'), Tolerating = countif(UserExperience == 'Tolerating'), Total = count() by timestamp, InterestingDimension\n| project timestamp, ApdexScore = (Satisfied + (Tolerating / 2.0)) / Total, Users = Total, InterestingDimension;\nlet pageRelevance = apdexData\n| summarize [\"Apdex Score\"] = avg(ApdexScore), Users=sum(Users) by InterestingDimension\n| extend Relevance = iff([\"Apdex Score\"] == 0, 1.0 * Users * Users, Users / [\"Apdex Score\"])\n| order by {OrderBy}\n| project InterestingDimension\n| take 7;\napdexData\n| join kind = leftouter (pageRelevance) on InterestingDimension\n| extend InterestingDimension = iff(isempty(InterestingDimension1) == true, 'Other', InterestingDimension)\n| project timestamp, ApdexScore, Users, InterestingDimension \n| summarize ApdexScore = avg(ApdexScore) by timestamp, InterestingDimension\n| extend ApdexScore = round(ApdexScore, 3)", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "showAnalytics": false, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "timechart" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "# Daily Quality Trend\nSee your how the performance experience of your users have changed over time." + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let apdexThreshhold = toint('{ApdexThresholdInMilliseconds}');\nlet failureThreshhold = 1;\n{Type}\n| where timestamp {TimeRange}\n| where name in ({Operations}) or '*' in ({Operations})\n{OperationsFilter}\n| extend success = columnifexists('success', true)\n| extend Failure = iff('{Calculations}' == 'ConsiderFailures' and success == false, 1, 0)\n| extend InterestingDimension = iff(isempty({SplitBy})== true, 'Unknown', {SplitBy})\n| where InterestingDimension in ({SegmentFilters}) or '*' in ({SegmentFilters})\n| summarize AverageDuration = avg(duration), Failures = sum(Failure) by user_Id, bin(timestamp, {TimeRange:grain})\n| extend UserExperience = case(AverageDuration <= apdexThreshhold, 'Satisfied', AverageDuration <= 4 * apdexThreshhold, 'Tolerating', 'Frustrated')\n| extend UserExperience = case(Failures >= failureThreshhold, \"Frustrated\", UserExperience)\n| summarize count() by UserExperience, timestamp", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "showAnalytics": false, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "barchart" + }, + "conditionalVisibility": null + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Performance/Workbooks/Apdex/settings.json b/Performance/Workbooks/Apdex/settings.json new file mode 100644 index 0000000..1cbe110 --- /dev/null +++ b/Performance/Workbooks/Apdex/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"App Performance Index (Apdex)", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.insights/components", "order": 150 }] +} \ No newline at end of file diff --git a/Performance/Workbooks/Performance Counter Analysis/Performance Counter Analysis.workbook b/Performance/Workbooks/Performance Counter Analysis/Performance Counter Analysis.workbook new file mode 100644 index 0000000..6188391 --- /dev/null +++ b/Performance/Workbooks/Performance Counter Analysis/Performance Counter Analysis.workbook @@ -0,0 +1,164 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Performance Counter Analysis\nWindows provides a wide variety of [performance counters](http://www.codeproject.com/Articles/8590/An-Introduction-To-Performance-Counters) such as CPU occupancy, memory, disk, and network usage. You can also define your own. [Application Insights](https://docs.microsoft.com/en-us/azure/application-insights/app-insights-overview) can show these performance counters if your application is running under IIS on an on-premises host or virtual machine to which you have administrative access. The charts indicate the resources available to your live application, and can help to identify unbalanced load between server instances. More details can be found at [Performance counters in Application Insights](https://docs.microsoft.com/en-us/azure/application-insights/app-insights-performance-counters)\n\nThis report will help you analyze your app's performance counters and potentially indentify issues in resource utilization." + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "0cfd17fb-eb71-437e-adef-2abb387f3eed", + "version": "KqlParameterItem/1.0", + "name": "PerformanceCounter", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(value:string)[\n'% Processor Time Normalized', '% Processor Time', 'Available Bytes',\t\n'Requests In Application Queue',\t\n'Private Bytes', 'IO Data Bytes/sec', \n'Request Execution Time',\n'Requests/Sec'\n]", + "value": "% Processor Time Normalized" + }, + { + "id": "846bc272-8fd8-4336-ad2c-7ab6727e7af4", + "version": "KqlParameterItem/1.0", + "name": "AnalysisWindow", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(value:string, text:string)[\n'30m', 'Last 30 minutes', \n'1h', 'Last hour', \n'2h', 'Last 2 hours', \n'4h', 'Last 4 hours', \n'24h', 'Last 24 hours', \n'2d', 'Last 2 days',\n'7d', 'Last 7 days',\n]", + "value": "2h" + }, + { + "id": "fed4649a-2d80-4546-85cf-9b6966082963", + "version": "KqlParameterItem/1.0", + "name": "RollingTimeWindow", + "type": 1, + "description": null, + "isRequired": true, + "query": "let t = totimespan({AnalysisWindow});\nlet w = case(t == 30m, '15m', t == 1h, '30m', t == 2h, '30m', t == 4h, '1h', t == 24h, '4h', t == 2d, '12h', t == 7d, '1d', '1m');\nrange i from 1 to 1 step 1\n| project x = w" + }, + { + "id": "21285db2-f41e-4889-91ea-b9675f4b153f", + "version": "KqlParameterItem/1.0", + "name": "ChartGrain", + "type": 1, + "description": null, + "isRequired": true, + "query": "let t = totimespan({AnalysisWindow});\nlet w = case(t == 30m, '30s', t == 1h, '1m', t == 2h, '1m', t == 4h, '5m', t == 24h, '30m', t == 2d, '1h', t == 7d, '4d', '1m');\nrange i from 1 to 1 step 1\n| project x = w" + }, + { + "id": "ac9c2ff8-7a50-4a9e-9d62-c7f450bcfca4", + "version": "KqlParameterItem/1.0", + "name": "Machines", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "performanceCounters\n| where timestamp >= ago({AnalysisWindow})\n| where name == '{PerformanceCounter}'\n| summarize by cloud_RoleInstance\n| order by cloud_RoleInstance asc\n| project value = cloud_RoleInstance, text = cloud_RoleInstance, Default = false\n| union (datatable(value:string, text:string, Default:boolean)[\n'*', 'All Machines', true\n])" + }, + { + "id": "57d9ddb2-a6f8-487b-b2ef-3e9f98abfa66", + "version": "KqlParameterItem/1.0", + "name": "Instances", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "performanceCounters\n| where timestamp >= ago({AnalysisWindow})\n| where name == '{PerformanceCounter}'\n| summarize by instance\n| order by instance asc\n| project value = instance, text = instance, Default = false\n| extend text = iff(text == '', '', text)\n| union (datatable(value:string, text:string, Default:boolean)[\n'*', 'All Instances', true\n])", + "value": [ + "*" + ] + } + ] + } + }, + { + "type": 1, + "content": { + "json": "## Perf Counter Trend Compared to the {RollingTimeWindow} Moving Average" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let rollingInterval = {RollingTimeWindow};\nlet timeRange = {AnalysisWindow};\nlet grain = {ChartGrain};\nlet timeWindow = bin(ago(timeRange + rollingInterval), grain);\nlet windowRange = toscalar(range i from 0m to rollingInterval - grain step grain\n| summarize makelist(i)); \nlet perfData = performanceCounters\n| where timestamp >= timeWindow \n| where name == '{PerformanceCounter}'\n| where cloud_RoleInstance in ({Machines}) or '*' in ({Machines})\n| where instance in ({Instances}) or '*' in ({Instances})\n| summarize Data = avg(value) by Window = bin(timestamp, grain);\nrange i from 0m to timeRange - grain step grain\n| extend Time = bin(now() - i, grain)\n| project-away i\n| extend Range = windowRange\n| mvexpand Range\n| extend Window = Time - totimespan(Range) \n| project-away Range \n| order by Time desc, Window desc\n| join kind=inner (perfData) on Window\n| summarize Data = avg(Data) by bin(Time, grain)\n| extend T = 'Simple Moving Average'\n| union (perfData | project Time = Window, T = 'Actual', Data)\n| where Time >= ago(timeRange) and Time < bin(now() - 1m, grain)\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "timechart" + } + }, + { + "type": 1, + "content": { + "json": "## Breakouts in Perf Counter" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "bcad0e53-5421-4982-a1a2-472a7755070c", + "version": "KqlParameterItem/1.0", + "name": "BreakoutCriterion", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(value:string, text:string)[\n'1.281552', 'Outside 80% Population',\n'1.959964', 'Outside 95% Population',\n'2.575829', 'Outside 99% Population',\n'3.290527', 'Outside 99.9% Population'\n]", + "value": "1.959964" + } + ] + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let rollingInterval = {RollingTimeWindow};\nlet timeRange = {AnalysisWindow};\nlet grain = {ChartGrain};\nlet timeWindow = bin(ago(timeRange + rollingInterval), grain);\nlet windowRange = toscalar(range i from 0m to rollingInterval - grain step grain\n| summarize makelist(i)); \nlet perfData = performanceCounters\n| where timestamp >= timeWindow \n| where name == '{PerformanceCounter}'\n| where cloud_RoleInstance in ({Machines}) or '*' in ({Machines})\n| where instance in ({Instances}) or '*' in ({Instances})\n| summarize Data = avg(value) by Window = bin(timestamp, grain);\nlet data = range i from 0m to timeRange - grain step grain\n| extend Time = bin(now() - i, grain)\n| project-away i\n| extend Range = windowRange\n| mvexpand Range\n| extend Window = Time - totimespan(Range) \n| project-away Range \n| order by Time desc, Window desc\n| join kind=inner (perfData) on Window\n| summarize Data = avg(Data), Stdev = stdev(Data) by bin(Time, grain)\n| join kind = inner (perfData | project Time = Window, Data) on Time\n| where Time >= ago(timeRange) and Time < bin(now() - 1m, grain)\n| extend Series = iff(Data1 >= Data - {BreakoutCriterion} * Stdev and Data1 <= Data + {BreakoutCriterion} * Stdev, 'N', 'A')\n| project Time, Data = Data1, Series;\ndata\n | where Series == 'N'\n | extend T = 'Normal'\n| union (data\n | where Series == 'A'\n | extend T = 'Breakout')\n| union (data\n | where Series == 'A'\n | extend T = 'Breakout (For Reds)')\n| project Time, Data, T", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "scatterchart" + } + }, + { + "type": 1, + "content": { + "json": "## Perf Counters by Machine" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {AnalysisWindow};\nlet grain = {ChartGrain};\nperformanceCounters\n| where timestamp >= ago(bin(timeRange, grain)) and timestamp <= bin(now() - 1m, grain)\n| where name == '{PerformanceCounter}'\n| where cloud_RoleInstance in ({Machines}) or '*' in ({Machines})\n| where instance in ({Instances}) or '*' in ({Instances})\n| summarize Data = avg(value) by cloud_RoleInstance, bin(timestamp, grain)\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "timechart" + } + } + ] +} \ No newline at end of file diff --git a/Performance/Workbooks/Performance Counter Analysis/settings.json b/Performance/Workbooks/Performance Counter Analysis/settings.json new file mode 100644 index 0000000..c4b4ec6 --- /dev/null +++ b/Performance/Workbooks/Performance Counter Analysis/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance Counter Analysis", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.insights/components", "order": 200 }] +} \ No newline at end of file diff --git a/Performance/Workbooks/Performance Insights/Performance Insights.workbook b/Performance/Workbooks/Performance Insights/Performance Insights.workbook new file mode 100644 index 0000000..d37ed3e --- /dev/null +++ b/Performance/Workbooks/Performance Insights/Performance Insights.workbook @@ -0,0 +1,475 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Application Performance Insights\nUse this report to identify the slowest operations in your applications. This information can be used to diagnose potential problems or help focus your ongoing development to improve the overall performance of the application." + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", + "version": "KqlParameterItem/1.0", + "name": "Apps", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.insights/components": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + }, + "value": [ + "value::3" + ] + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": false, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + }, + { + "id": "1014e6d9-72b9-4729-a3a0-f5704768854e", + "version": "KqlParameterItem/1.0", + "name": "Operation", + "type": 1, + "isRequired": false, + "isHiddenWhenLocked": true, + "value": "{\"App\":\"\",\"Operation\":\"\"}" + }, + { + "id": "9fb8e529-2818-4000-bdf0-48808de48eb7", + "version": "KqlParameterItem/1.0", + "name": "Columns", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "isHiddenWhenLocked": false, + "jsonData": "[\"Mean\", \"Median\", \"p80\", \"p95\", \"p99\", \"Count\", \"Users\"]", + "value": [ + "Mean", + "Median", + "p95", + "Count" + ] + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = requests\n| where timestamp {TimeRange};\ndata\n| summarize Mean = avg(duration), (Median, p80, p95, p99) = percentiles(duration, 50, 80, 95, 99), Count = count(), Users = dcount(user_Id) by name, appName\n| project App = appName, Operation = name, Mean, Median, p80, p95, p99, Count, Users, rank = 2\n| union (data\n | summarize Mean = avg(duration), (Median, p80, p95, p99) = percentiles(duration, 50, 80, 95, 99), Count = count(), Users = dcount(user_Id)\n | project App = '🔸 All Apps', Operation = '🔸 All operations', Mean, Median, p80, p95, p99, Count, Users, rank = 1)\n| extend Relevance = Mean * Count\n| order by rank asc, Relevance desc\n| project-away Relevance, rank\n| extend Mean = round(Mean, 2), Median = round(Median, 1), p80 = round(p80, 2), p95 = round(p95, 2), p99 = round(p99, 2)\n| project App, Operation, {Columns}\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "exportParameterName": "Operation", + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Mean|Median|p80|p95|p99", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + }, + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Users", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blueDark" + } + } + ] + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "💡 *Click on the rows of the table above to see details for other operations*" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "b09bfb5a-093f-4099-a5fb-e0fca139cc3d", + "version": "KqlParameterItem/1.0", + "name": "SelectedOperation", + "type": 1, + "isRequired": true, + "query": "let row = dynamic({Operation});\r\nlet operation = tostring(row.Operation);\r\nlet app = tostring(row.App);\r\nrange i from 1 to 1 step 1\r\n| project Operation = iff((operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps'), 'all operations', operation)", + "isHiddenWhenLocked": true, + "jsonData": "", + "resourceType": "microsoft.insights/components" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Operation Details -- {SelectedOperation}\n" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Operation Duration (ms)\n" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### All Operations" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "1bbd1900-9445-4ac0-bb5d-f15dbe5f4485", + "version": "KqlParameterItem/1.0", + "name": "Show", + "type": 2, + "isRequired": true, + "query": "datatable(value:string, label:string)[\n\"avg(duration)\", \"Mean\",\n\"percentile(duration, 50)\", \"Median\",\n\"percentile(duration, 80)\", \"p80\",\n\"percentile(duration, 95)\", \"p95\",\n\"percentile(duration, 99)\", \"p99\"\n]", + "value": "percentile(duration, 95)", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nrequests\n| where timestamp {TimeRange}\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\n| make-series Duration = {Show} default = 0 on timestamp in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain})\n| mvexpand timestamp to typeof(datetime), Duration to typeof(long)\n", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\nlet operation = tostring(row.Operation);\nlet app = tostring(row.App);\nrequests\n| where timestamp {TimeRange}\n| where (name == operation and appName == app) or (operation == '' and app == '') or (operation == '🔸 All operations' and app == '🔸 All Apps')\n| make-series Requests = count() default = 0 on timestamp in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain})\n| mvexpand timestamp to typeof(datetime), Requests to typeof(long)\n", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "crossComponentResources": [ + "{Apps}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Dependency Performance\n" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "Select an operation in the table above to see the performance of its dependencies. " + }, + "conditionalVisibility": { + "parameterName": "SelectedOperation", + "comparison": "isEqualTo", + "value": "all operations" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "a5b7de6f-eb50-49c6-8aaa-556d84ca9e3f", + "version": "KqlParameterItem/1.0", + "name": "AnalysisSet", + "type": 2, + "isRequired": true, + "query": "datatable(value:string, label:string)[\r\n'{\"from\":93, \"to\":97}', \"p95\",\r\n'{\"from\":77, \"to\":83}', \"p80\",\r\n'{\"from\":45, \"to\":55}', \"p50\",\r\n]", + "value": "{\"from\":93, \"to\":97}", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "be711374-a833-44a2-b9a4-5307ebc58253", + "version": "KqlParameterItem/1.0", + "name": "StartPercentile", + "type": 1, + "isRequired": true, + "query": "let analysisSet = dynamic({AnalysisSet});\r\nlet analysisStart = toreal(analysisSet.from);\r\nrange i from 1 to 1 step 1\r\n| project Start = analysisStart", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "fbca7275-4f5a-407e-84c2-e350f385eb53", + "version": "KqlParameterItem/1.0", + "name": "EndPercentile", + "type": 1, + "isRequired": true, + "query": "let analysisSet = dynamic({AnalysisSet});\r\nlet analysisStart = toreal(analysisSet[\"to\"]);\r\nrange i from 1 to 1 step 1\r\n| project Start = analysisStart", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "SelectedOperation", + "comparison": "isNotEqualTo", + "value": "all operations" + } + }, + { + "type": 1, + "content": { + "json": "The charts below show performance of the dependencies of *{SelectedOperation}*. The data is filtered only to those operations whose durations fall between p{StartPercentile} and p{EndPercentile} of the entire distribution. Change parameters `AnalysisSet`, `StartPercentile` or `EndPercentile` to tweak the percentile window of analysis" + }, + "conditionalVisibility": { + "parameterName": "SelectedOperation", + "comparison": "isNotEqualTo", + "value": "all operations" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\r\nlet operation = tostring(row.Operation);\r\nlet app = tostring(row.App);\r\nlet data = requests\r\n| where timestamp {TimeRange}\r\n| where (name == operation and appName == app);\r\nlet minDuration = toscalar(data\r\n| summarize Start = percentile(duration, {StartPercentile}));\r\nlet maxDuration = toscalar(data\r\n| summarize End = percentile(duration, {EndPercentile}));\r\nlet operations = data\r\n| where duration >= minDuration and duration <= maxDuration\r\n| summarize by operation_Id\r\n| take 100000; // Limit to 100K operations for perf\r\ndependencies\r\n| where timestamp {TimeRange}\r\n| where operation_Id in (operations)\r\n| summarize Duration = avg(duration) by name, bin(timestamp, {TimeRange:grain})", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "title": "Dependency Performance Trend (ms)", + "resourceType": "microsoft.insights/components", + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "SelectedOperation", + "comparison": "isNotEqualTo", + "value": "all operations" + }, + "customWidth": "55" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let row = dynamic({Operation});\r\nlet operation = tostring(row.Operation);\r\nlet app = tostring(row.App);\r\nlet data = requests\r\n| where timestamp {TimeRange}\r\n| where (name == operation and appName == app);\r\nlet minDuration = toscalar(data\r\n| summarize Start = percentile(duration, {StartPercentile}));\r\nlet maxDuration = toscalar(data\r\n| summarize End = percentile(duration, {EndPercentile}));\r\nlet operations = data\r\n| where duration >= minDuration and duration <= maxDuration\r\n| summarize by operation_Id\r\n| take 100000; // Limit to 100K operations for perf\r\ndependencies\r\n| where timestamp {TimeRange}\r\n| where operation_Id in (operations)\r\n| summarize Duration = avg(duration), Item = any(itemId) by name\r\n| extend Duration = round(Duration, 2)\r\n| order by Duration desc\r\n| project-rename [\"Mean Duration (ms)\"] = Duration", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "title": "Dependency Performance - Summary", + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Mean Duration (ms)", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + }, + { + "columnMatch": "Item", + "formatter": 7, + "formatOptions": { + "linkTarget": "DependencyDetails", + "linkLabel": "Sample" + } + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "SelectedOperation", + "comparison": "isNotEqualTo", + "value": "all operations" + }, + "customWidth": "45" + } + ] +} \ No newline at end of file diff --git a/Performance/Workbooks/Performance Insights/settings.json b/Performance/Workbooks/Performance Insights/settings.json new file mode 100644 index 0000000..8fb7649 --- /dev/null +++ b/Performance/Workbooks/Performance Insights/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance Analysis", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.insights/components", "order": 100 }] +} \ No newline at end of file diff --git a/Performance/Workbooks/Single Page Application Insights/Single Page Application Website Insights.workbook b/Performance/Workbooks/Single Page Application Insights/Single Page Application Website Insights.workbook new file mode 100644 index 0000000..197857d --- /dev/null +++ b/Performance/Workbooks/Single Page Application Insights/Single Page Application Website Insights.workbook @@ -0,0 +1,666 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Initial Load Performance Insights of Single Page Applications\r\nThis Workbook template allows you to view your Single Page Application (SPA) performance data logged by the Mezzurite Timing Library and the Application Insights Mezzurite Plugin\r\n\r\n" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e20e78fc-f0d0-40ba-b183-d68b351f91c3", + "version": "KqlParameterItem/1.0", + "name": "has_Mezzurite_Data", + "type": 1, + "isRequired": false, + "query": "customEvents\r\n| filter name == \"mz\"\r\n| where timestamp > ago(90d)\r\n| summarize value = tostring(sign(count()))\r\n\r\n\r\n\r\n\r\n\r\n", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "

This workbook was unable to load because no Mezzurite Timing data was detected.

\r\n

\r\nTo configure Mezzurite, please follow the guide below for your site’s specific framework Implementation\r\n

\r\n\r\nOnce the Mezzurite Timing library is added, you will need \r\n

\r\n\r\n

Mezzurite Ecosystem

\r\n\r\n\r\n\r\n\r\n\r\n\r\n
ProjectDescription
ApplicationInsights-JS-MezzuriteApplication Insights plugin of Mezzurite
MezzuriteBase SDK for Mezzurite with Angular, AngularJS and React integration
Mezzurite DevToolsSee Mezzurite metrics being captured with a browser extension
VSCode MezzuriteCheck which components and modules are instrumented within VS Code
\r\n" + }, + "conditionalVisibility": { + "parameterName": "has_Mezzurite_Data", + "comparison": "isNotEqualTo", + "value": "1.0" + } + }, + { + "type": 1, + "content": { + "json": "The flow of the template:\r\n\r\n1. View the performance of your routes\r\n2. Select a route to dive deeper into diagnostics. \r\n3. Charts provided for the selected route are:\r\n
a. Component Load Time for each of the components included in the selected route\r\n
b. Application Load Time break down\r\n\r\n

**The below parameters affect all charts below:**

\r\n" + }, + "conditionalVisibility": { + "parameterName": "has_Mezzurite_Data", + "comparison": "isEqualTo", + "value": "1.0" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "39725ecb-66f7-40c5-bae7-40bc1eef8ca7", + "version": "KqlParameterItem/1.0", + "name": "Duration", + "type": 4, + "description": "Scopes the timeframe of the workbook", + "isRequired": true, + "value": { + "durationMs": 2592000000, + "createdTime": "2019-02-13T20:05:00.418Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 3600000, + "createdTime": "2019-02-13T20:05:00.416Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-02-13T20:05:00.417Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-02-13T20:05:00.417Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-02-13T20:05:00.417Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-02-13T20:05:00.417Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-02-13T20:05:00.418Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-02-13T20:05:00.418Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-02-13T20:05:00.418Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-02-13T20:05:00.418Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": false + }, + "timeContextFromParameter": null + }, + { + "id": "6178b34a-cf9a-42cf-b4b1-3d1ec46ca34c", + "version": "KqlParameterItem/1.0", + "name": "Time_Bucket", + "type": 2, + "description": "Group results by time", + "isRequired": true, + "value": "15m", + "isHiddenWhenLocked": false, + "jsonData": "[{\"value\":\"1m\",\"label\":\"Minute\"},\r\n {\"value\":\"15m\",\"label\":\"15 Minutes\"},\r\n {\"value\":\"1h\",\"label\":\"Hour\"},\r\n {\"value\":\"1d\", \"label\": \"Day\"},\r\n {\"value\":\"7d\", \"label\": \"Week\"}\r\n ]", + "timeContextFromParameter": null + }, + { + "id": "7196f5c4-bfe6-4fc0-9712-aa345a56927c", + "version": "KqlParameterItem/1.0", + "name": "Percentile", + "type": 2, + "description": "Percentile which all charts are calcualted", + "isRequired": true, + "value": "95", + "isHiddenWhenLocked": false, + "jsonData": "[50, 75, 90, 95, 99]", + "timeContextFromParameter": null + }, + { + "id": "df4a6862-5029-42c0-9371-2fc97279e1ad", + "version": "KqlParameterItem/1.0", + "name": "Country", + "type": 2, + "description": "Focus the results to a specific country", + "isRequired": true, + "query": "customEvents\r\n| where name == \"mz\"\r\n| distinct client_CountryOrRegion\r\n| project b = client_CountryOrRegion, n = client_CountryOrRegion\r\n| union (\r\ndatatable(b:string, n:string )[\r\n'*', 'All Countries'\r\n]\r\n)", + "value": "*", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-01-30T18:31:57.571Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "Duration", + "resourceType": "microsoft.insights/components" + }, + { + "id": "a1214636-4e9f-41b3-9502-9b42064553fa", + "version": "KqlParameterItem/1.0", + "name": "Browser", + "type": 2, + "description": "Foucs the results to a specific browser", + "isRequired": true, + "query": "customEvents\r\n| where name == \"mz\"\r\n| distinct client_Browser\r\n| project b = client_Browser, n = client_Browser\r\n| union (\r\ndatatable(b:string, n:string )[\r\n'*', 'All Browser Versions'\r\n]\r\n)", + "value": "*", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-01-30T18:32:11.918Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "Duration", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "has_Mezzurite_Data", + "comparison": "isEqualTo", + "value": "1.0" + } + }, + { + "type": 1, + "content": { + "json": "

Performance of All Routes

\r\nThis is a landing page for your SPA, it maps to the route name in your application code.\r\n

Select a route below to view route-specific data:

" + }, + "conditionalVisibility": { + "parameterName": "has_Mezzurite_Data", + "comparison": "isEqualTo", + "value": "1.0" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": " let alt = customEvents\r\n | where name == \"mz\"\r\n | where isnotempty(customDimensions.RouteUrl)\r\n | filter client_CountryOrRegion == '{Country}' or '{Country}' == '*'\r\n | filter client_Browser == '{Browser}' or '{Browser}' == '*'\r\n | project ALT = todouble(customMeasurements.ALT), operation_ParentId, Route = tostring(customDimensions.RouteUrl)\r\n | summarize ALT_Count = count(), percentiles(ALT, {Percentile}) by Route;\r\n\r\nlet vlt = customEvents\r\n | where name == \"mz\"\r\n | where isnotempty(customMeasurements.VLT)\r\n | where isnotempty(customDimensions.RouteUrl)\r\n | filter client_CountryOrRegion == '{Country}' or '{Country}' == '*'\r\n | filter client_Browser == '{Browser}' or '{Browser}' == '*'\r\n | project VLT = todouble(customMeasurements.VLT), operation_ParentId, Route = tostring(customDimensions.RouteUrl)\r\n | summarize VLT_Count = count(), percentiles(VLT, {Percentile}) by Route;\r\n\r\nlet flt = customEvents\r\n | where name == \"mz\"\r\n | where isnotempty(customMeasurements.FVLT)\r\n | where isnotempty(customDimensions.RouteUrl)\r\n | filter client_CountryOrRegion == '{Country}' or '{Country}' == '*'\r\n | filter client_Browser == '{Browser}' or '{Browser}' == '*'\r\n | project FLT = todouble(customMeasurements.FVLT), operation_ParentId, Route = tostring(customDimensions.RouteUrl)\r\n | summarize FLT_Count = count(), percentiles(FLT, {Percentile}) by Route;\r\n\r\nalt \r\n| join vlt on Route\r\n| join flt on Route\r\n| project ['Route Name'] = Route, ['Route Traffic'] = ALT_Count, ['FLT {Percentile}th Percentile'] = round(percentile_FLT_{Percentile}, 0), ['ALT {Percentile}th Percentile'] = round(percentile_ALT_{Percentile},0), ['VLT {Percentile}th Percentile'] = round(percentile_VLT_{Percentile},0)\r\n| order by ['Route Traffic'] desc\r\n\r\n", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "exportFieldName": "Route Name", + "exportParameterName": "Route", + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-02-14T18:18:29.200Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "Duration", + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Route Traffic", + "formatter": 4, + "formatOptions": { + "palette": "blueDark" + } + }, + { + "columnMatch": "FLT 50th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "ALT 50th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "VLT 50th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "FLT 90th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "ALT 90th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "VLT 90th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "FLT 99th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "ALT 99th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "VLT 99th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "FLT 95th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "ALT 95th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "VLT 95th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "FLT 75th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "ALT 75th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "VLT 75th Percentile", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "useGrouping": true + } + } + } + ], + "filter": true + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Route", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "percentile_ALT_50", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "has_Mezzurite_Data", + "comparison": "isEqualTo", + "value": "1.0" + } + }, + { + "type": 1, + "content": { + "json": "
\r\n

Performance for Route \"{Route}\"

\r\n

The FLT gives you the length of time of the first load of the route. It includes the first VLT and the ALT.

\r\n

If the route is hit after the first load, there won't be an ALT for it. There will only be a VLT.

\r\n\r\n

This chart gives you a high-level view of your site, and can tell you if your VLT or ALT has regressed from the FLT.

\r\n

When the VLT has regressed use the \"Performance of the Components Loaded In Route\" chart to further explore what happened on the page

\r\n\r\n

For ALT regressions, use the \"Performance of Application Sub-Timings for Route\" to see what sub timings are affecting your ALT.

" + }, + "conditionalVisibility": { + "parameterName": "Route", + "comparison": "isNotEqualTo", + "value": null + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "\r\nlet alt = customEvents\r\n | where name == \"mz\"\r\n | where isnotempty(customMeasurements.ALT)\r\n | where isnotempty(customDimensions.RouteUrl)\r\n | filter client_CountryOrRegion == '{Country}' or '{Country}' == '*'\r\n | filter client_Browser == '{Browser}' or '{Browser}' == '*'\r\n | filter customDimensions.RouteUrl == '{Route}'\r\n | project value = todouble(customMeasurements.ALT), operation_ParentId, Route = tostring(customDimensions.RouteUrl), timestamp\r\n | summarize ['ALT Percentile (ms)'] = percentiles( value ,{Percentile}) by bin(timestamp, {Time_Bucket});\r\n\r\nlet vlt = customEvents\r\n | where name == \"mz\"\r\n | where isnotempty(customMeasurements.VLT)\r\n | where isnotempty(customDimensions.RouteUrl)\r\n | filter client_CountryOrRegion == '{Country}' or '{Country}' == '*'\r\n | filter client_Browser == '{Browser}' or '{Browser}' == '*'\r\n | filter customDimensions.RouteUrl == '{Route}'\r\n | project value = todouble(customMeasurements.VLT), operation_ParentId, Route = tostring(customDimensions.RouteUrl), timestamp\r\n | summarize ['VLT Percentile (ms)'] = percentiles( value ,{Percentile}) by bin(timestamp, {Time_Bucket});\r\n\r\nlet fvlt = customEvents\r\n | where name == \"mz\"\r\n | where isnotempty(customMeasurements.FVLT)\r\n | where isnotempty(customDimensions.RouteUrl)\r\n | filter client_CountryOrRegion == '{Country}' or '{Country}' == '*'\r\n | filter client_Browser == '{Browser}' or '{Browser}' == '*'\r\n | filter customDimensions.RouteUrl == '{Route}'\r\n | project value = todouble(customMeasurements.FVLT), operation_ParentId, Route = tostring(customDimensions.RouteUrl), timestamp\r\n | summarize ['FLT Percentile (ms)'] = percentiles( value ,{Percentile}) by bin(timestamp, {Time_Bucket});\r\n\r\nfvlt\r\n| join alt on timestamp\r\n| join vlt on timestamp\r\n| project timestamp, ['FLT Percentile (ms)'], ['VLT Percentile (ms)'], ['ALT Percentile (ms)']\r\n| render timechart\r\n\r\n", + "showQuery": false, + "size": 0, + "aggregation": 2, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-02-14T18:18:29.230Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "Duration", + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "Route", + "comparison": "isNotEqualTo", + "value": null + } + }, + { + "type": 1, + "content": { + "json": "
" + }, + "conditionalVisibility": { + "parameterName": "Route", + "comparison": "isNotEqualTo", + "value": null + } + }, + { + "type": 1, + "content": { + "json": "

Performance of Components Loaded in Route \"{Route}\"

\r\nIf the VLT has regressed, the chart below will show you all the components make up the VLT time." + }, + "conditionalVisibility": { + "parameterName": "Route", + "comparison": "isNotEqualTo", + "value": null + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "customEvents\r\n | where name == \"mz\"\r\n | where isnotempty(customMeasurements.clt)\r\n | where customDimensions.metricType == \"VLT\"\r\n | where isnotempty(customDimensions.RouteUrl)\r\n | filter client_CountryOrRegion == '{Country}' or '{Country}' == '*'\r\n | filter client_Browser == '{Browser}' or '{Browser}' == '*'\r\n | filter customDimensions.RouteUrl == '{Route}'\r\n | project value = todouble(customMeasurements.clt), cName= strcat(tostring(customDimensions.componentName),\" \", '(ms)'), Route = tostring(customDimensions.RouteUrl), timestamp\r\n | summarize percentiles(todouble(value), {Percentile}) by cName, bin(timestamp, {Time_Bucket})\r\n | render timechart\r\n", + "showQuery": false, + "size": 0, + "aggregation": 2, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-02-14T18:18:29.259Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "Duration", + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "Route", + "comparison": "isNotEqualTo", + "value": null + } + }, + { + "type": 1, + "content": { + "json": "
" + }, + "conditionalVisibility": { + "parameterName": "Route", + "comparison": "isNotEqualTo", + "value": null + } + }, + { + "type": 1, + "content": { + "json": "

Performance of Application Load Sub-Timings for Route \"{Route}\"

\r\nThis chart is used if your ALT has regress. The timings here are from the Performance timings object from the browser. These sub timings come from the Perfomance Navigation timing from the browser and are based on the W3C standards. See the Mezzurite GitHub for more info." + }, + "conditionalVisibility": { + "parameterName": "Route", + "comparison": "isNotEqualTo", + "value": null + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = browserTimings\r\n| filter client_CountryOrRegion == '{Country}' or '{Country}' == '*'\r\n| filter client_Browser == '{Browser}' or '{Browser}' == '*'\r\n| filter url == '{Route}'\r\n| project timestamp , networkDuration , sendDuration , receiveDuration , processingDuration;\r\n\r\nlet send = data\r\n| summarize ['Send Duration (ms)'] = percentiles(sendDuration, {Percentile}) by bin(timestamp, {Time_Bucket});\r\n\r\nlet receive = data\r\n| summarize ['Receive Duration (ms)'] = percentiles(receiveDuration, {Percentile}) by bin(timestamp, {Time_Bucket});\r\n\r\nlet network = data\r\n| summarize ['Network Duration (ms)'] = percentiles(networkDuration, {Percentile}) by bin(timestamp, {Time_Bucket});\r\n\r\nnetwork\r\n| join send on timestamp\r\n| join receive on timestamp\r\n| project timestamp, ['Send Duration (ms)'], ['Receive Duration (ms)'], ['Network Duration (ms)']\r\n| render timechart\r\n\r\n\r\n\r\n\r\n\r\n", + "showQuery": false, + "size": 0, + "aggregation": 2, + "showAnnotations": false, + "showAnalytics": false, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2019-02-14T18:18:29.277Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "Duration", + "resourceType": "microsoft.insights/components", + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "Route", + "comparison": "isNotEqualTo", + "value": null + } + }, + { + "type": 1, + "content": { + "json": "

Definitions

\r\n

SPA: Single Page Application built on top of JavaScript frameworks like Angular or React\r\n

Route: This is the SPA route (URL segment) for the given page.

\r\n

Component: A Component can be a single html element or a group of elements. These are defined inside your JavaScript and are the building blocks for your SPA page. A route can have more than one component inside of it. The chart below shows performance timings for all components present in the currently selected route.

\r\n

Component Load Time (CLT): The time it takes for a given component to load on the page.

\r\n

Viewport: The area which is viewable in your browser.

\r\n

Viewport Load Time (VLT): The time it takes from the route start to when the last component is loaded in your viewport.

\r\n

Application Load Time (ALT): The time it takes from the navigation start to when your router starts processing the first route.

\r\n

First Load Time (FLT): The high level metric which is a sum of the application load time and the first viewport load time of our route.

\r\n

The following are all pulled from the Browser Performance Timing object

\r\n

Send DurationRequest Start to Response Start

\r\n

Receive DurationResponce Start to Response End

\r\n

Network Duration is Navigation Start to Connection End

\r\n
\r\n" + }, + "conditionalVisibility": { + "parameterName": "has_Mezzurite_Data", + "comparison": "isEqualTo", + "value": "1.0" + } + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Performance/Workbooks/Single Page Application Insights/settings.json b/Performance/Workbooks/Single Page Application Insights/settings.json new file mode 100644 index 0000000..9f63577 --- /dev/null +++ b/Performance/Workbooks/Single Page Application Insights/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Single Page Application Insights", + "description": "Visiualization of Single Page Application Telemetry created by Mezzurite Timing Library", + "author": "Microsoft", + "tags": ["SPA", "Angular", "React"], + "galleries": [{ "type": "workbook", "resourceType": "microsoft.insights/components", "order": 300 }] +} \ No newline at end of file diff --git a/Performance/Workbooks/categoryResources.json b/Performance/Workbooks/categoryResources.json new file mode 100644 index 0000000..36337c8 --- /dev/null +++ b/Performance/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Performance", "description": "", "order": 300} +} \ No newline at end of file diff --git a/Resource Groups/Alerts/README b/Resource Groups/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Resource Groups/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Resource Groups/Queries/README b/Resource Groups/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Resource Groups/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Resource Groups/Workbooks/Sql databases/Sql databases.workbook b/Resource Groups/Workbooks/Sql databases/Sql databases.workbook new file mode 100644 index 0000000..37064aa --- /dev/null +++ b/Resource Groups/Workbooks/Sql databases/Sql databases.workbook @@ -0,0 +1,264 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "40fcb136-32f6-4e82-bf81-88e48781a62f", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroup", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/resourcegroups": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "8f91c041-eceb-4159-903d-fbf0de6ecf69", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "SQL databases", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where id startswith('{ResourceGroup}') and type =~ 'microsoft.sql/servers/databases'\r\n", + "value": [ + "value::all" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.sql/servers/databases": true + }, + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2241c21b-5a59-4a42-b3a9-b503de023938", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ] + } + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 1" + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases-Basic-cpu_percent", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases-Basic-physical_data_read_percent", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases-Basic-connection_failed", + "aggregation": 1, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-cpu_percent", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-cpu_percent Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-physical_data_read_percent", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-physical_data_read_percent Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-connection_failed", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-connection_failed Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "labelSettings": [] + }, + "sortBy": [], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "Resources", + "comparison": "isNotEqualTo", + "value": null + }, + "showPin": true, + "name": "Resource group sql db metrics" + }, + { + "type": 1, + "content": { + "json": "⚠️ Looks like you don't have any SQL databases in this resource group." + }, + "conditionalVisibility": { + "parameterName": "Resources", + "comparison": "isEqualTo", + "value": null + }, + "name": "No resource message" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Resource Groups/Workbooks/Sql databases/settings.json b/Resource Groups/Workbooks/Sql databases/settings.json new file mode 100644 index 0000000..97d7c7c --- /dev/null +++ b/Resource Groups/Workbooks/Sql databases/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Sql databases", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.resources/resourcegroups", "order": 300 }] +} \ No newline at end of file diff --git a/Resource Groups/Workbooks/Storage Accounts/Storage Accounts.workbook b/Resource Groups/Workbooks/Storage Accounts/Storage Accounts.workbook new file mode 100644 index 0000000..67623fb --- /dev/null +++ b/Resource Groups/Workbooks/Storage Accounts/Storage Accounts.workbook @@ -0,0 +1,343 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "40fcb136-32f6-4e82-bf81-88e48781a62f", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroup", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/resourcegroups": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "8f91c041-eceb-4159-903d-fbf0de6ecf69", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "Storage accounts", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where id startswith('{ResourceGroup}') and type =~ 'microsoft.storage/storageaccounts'", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "value": [ + "value::all" + ] + }, + { + "id": "2241c21b-5a59-4a42-b3a9-b503de023938", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ] + } + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 1" + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{Resources}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "Resources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Transactions", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Availability", + "aggregation": 4 + }, + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency", + "aggregation": 4, + "columnName": "E2E Latency" + }, + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-SuccessServerLatency", + "aggregation": 4, + "columnName": "Server Latency" + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-Transactions$|Transactions \\(Sum\\)$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-Transactions Timeline|Transactions Timeline", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-Availability$|Availability \\(Average\\)$", + "formatter": 18, + "formatOptions": { + "linkTarget": "WorkbookTemplate", + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "is Empty", + "representation": "Blank", + "text": "-" + }, + { + "operator": "<", + "thresholdValue": "90", + "representation": "4", + "text": "{0}{1}" + }, + { + "operator": "<", + "thresholdValue": "99", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ], + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Availability", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.storage/storageaccounts" + } + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-Availability Timeline$|Availability Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency$|microsoft.storage/storageaccounts-Transaction-SuccessServerLatency$|E2E Latency$|Server Latency$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "linkTarget": "WorkbookTemplate", + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Performance", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.storage/storageaccounts" + } + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency Timeline|microsoft.storage/storageaccounts-Transaction-SuccessServerLatency Timeline|Latency Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.storage/storageaccounts-Transaction-Transactions$|Transactions \\(Sum\\)$_2", + "sortOrder": 2 + } + ], + "labelSettings": [] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.storage/storageaccounts-Transaction-Transactions$|Transactions \\(Sum\\)$_2", + "sortOrder": 2 + } + ], + "filters": [], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "Resources", + "comparison": "isNotEqualTo", + "value": null + }, + "showPin": true, + "name": "Resource group storage account metrics" + }, + { + "type": 1, + "content": { + "json": "💡 _Click on the links in the cells to see more details about a storage account_" + }, + "conditionalVisibility": { + "parameterName": "Resources", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "text - 3" + }, + { + "type": 1, + "content": { + "json": "⚠️ Looks like you don't have any storage accounts in this resource group." + }, + "conditionalVisibility": { + "parameterName": "Resources", + "comparison": "isEqualTo", + "value": null + }, + "name": "No resource message" + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Resource Groups/Workbooks/Storage Accounts/settings.json b/Resource Groups/Workbooks/Storage Accounts/settings.json new file mode 100644 index 0000000..f89b2eb --- /dev/null +++ b/Resource Groups/Workbooks/Storage Accounts/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Storage accounts", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.resources/resourcegroups", "order": 200 }] +} \ No newline at end of file diff --git a/Resource Groups/Workbooks/Virtual Machines/Virtual Machines.workbook b/Resource Groups/Workbooks/Virtual Machines/Virtual Machines.workbook new file mode 100644 index 0000000..1bac9e6 --- /dev/null +++ b/Resource Groups/Workbooks/Virtual Machines/Virtual Machines.workbook @@ -0,0 +1,340 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "40fcb136-32f6-4e82-bf81-88e48781a62f", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroup", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/resourcegroups": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "8f91c041-eceb-4159-903d-fbf0de6ecf69", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachines", + "label": "Virtual Machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where id startswith('{ResourceGroup}') and type =~ 'microsoft.compute/virtualmachines'", + "value": [ + "value::all" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2241c21b-5a59-4a42-b3a9-b503de023938", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ] + } + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/resourcegroups" + }, + "name": "parameters - 1" + }, + { + "type": 10, + "content": { + "chartId": "workbookcd79343c-051f-41e1-8dab-fa6bd9f9ea60", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 0, + "resourceIds": [ + "{VirtualMachines}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Percentage CPU", + "aggregation": 4, + "splitBy": null, + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Disk Read Bytes", + "aggregation": 1, + "splitBy": null, + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Disk Write Bytes", + "aggregation": 1, + "splitBy": null, + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network In Total", + "aggregation": 1, + "splitBy": null, + "splitBySortOrder": -1, + "splitByLimit": 5 + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network Out Total", + "aggregation": 1, + "splitBy": null, + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "title": "Virtual machine metrics", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU$|Percentage CPU \\(Average\\)", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Virtual Machines/Virtual machine details", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.compute/virtualmachines" + } + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU Timeline|Percentage CPU Timeline", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Disk Read Bytes$|microsoft.compute/virtualmachines--Disk Write Bytes$|Disk Read Bytes \\(Sum\\)$|Disk Write Bytes \\(Sum\\)$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Disk Read Bytes Timeline|Disk Read Bytes Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Disk Write Bytes Timeline|Disk Write Bytes Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total$|microsoft.compute/virtualmachines--Network Out Total$|Network In Total \\(Sum\\)$|Network Out Total \\(Sum\\)$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline$|Network In Total Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline$|Network Out Total Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.compute/virtualmachines--Percentage CPU$|Percentage CPU \\(Average\\)_2", + "sortOrder": 2 + } + ], + "labelSettings": [] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.compute/virtualmachines--Percentage CPU$|Percentage CPU \\(Average\\)_2", + "sortOrder": 2 + } + ], + "filters": [], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "VirtualMachines", + "comparison": "isNotEqualTo", + "value": null + }, + "showPin": true, + "name": "Resource Group VM summary" + }, + { + "type": 1, + "content": { + "json": "💡 _Click on `Percentage CPU` cell to see more information about the virtual machine_" + }, + "conditionalVisibility": { + "parameterName": "VirtualMachines", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "text - 6" + }, + { + "type": 1, + "content": { + "json": "⚠️ Looks like you don't have any virtual machines in this resource group." + }, + "conditionalVisibility": { + "parameterName": "VirtualMachines", + "comparison": "isEqualTo", + "value": null + }, + "name": "No resource message" + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Resource Groups/Workbooks/Virtual Machines/settings.json b/Resource Groups/Workbooks/Virtual Machines/settings.json new file mode 100644 index 0000000..5801d8d --- /dev/null +++ b/Resource Groups/Workbooks/Virtual Machines/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Virtual machines", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.resources/resourcegroups", "order": 100 }] +} \ No newline at end of file diff --git a/Resource Groups/Workbooks/Virtual machines CPU use/Virtual machines CPU use.workbook b/Resource Groups/Workbooks/Virtual machines CPU use/Virtual machines CPU use.workbook new file mode 100644 index 0000000..f3bfd29 --- /dev/null +++ b/Resource Groups/Workbooks/Virtual machines CPU use/Virtual machines CPU use.workbook @@ -0,0 +1,362 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "40fcb136-32f6-4e82-bf81-88e48781a62f", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroup", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/resourcegroups": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "8f91c041-eceb-4159-903d-fbf0de6ecf69", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachines", + "label": "Virtual Machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where id startswith('{ResourceGroup}') and type =~ 'microsoft.compute/virtualmachines'", + "value": [ + "value::all" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2241c21b-5a59-4a42-b3a9-b503de023938", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ] + } + }, + { + "id": "1b3b41aa-801b-45bb-b608-bf0668ddcbc3", + "version": "KqlParameterItem/1.0", + "name": "CpuThreshold", + "label": "Cpu Threshold", + "type": 1, + "value": "70" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/resourcegroups" + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "⚠️ Looks like you don't have any virtual machines in this resource group." + }, + "conditionalVisibility": { + "parameterName": "VirtualMachines", + "comparison": "isEqualTo", + "value": null + }, + "name": "No resource message" + }, + { + "type": 10, + "content": { + "chartId": "workbookcd79343c-051f-41e1-8dab-fa6bd9f9ea60", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": 0, + "resourceIds": [ + "{VirtualMachines}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Percentage CPU", + "aggregation": 4, + "splitBy": null, + "splitBySortOrder": -1, + "splitByLimit": 5 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Percentage CPU (Average)", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Percentage CPU Timeline", + "formatter": 9, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Disk Read Bytes|Disk Write Bytes", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Disk Read Bytes Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Disk Write Bytes Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Network In Total|Network Out Total", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Network In Total Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Network Out Total Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "sortBy": [ + { + "itemKey": "$gen_heatmap_Percentage CPU (Average)_2", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Percentage CPU (Average)_2", + "sortOrder": 2 + } + ], + "filters": [] + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "VM summary" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"cf687616-f5fe-4665-a466-6a336d8b03b6\",\"mergeType\":\"table\",\"leftTable\":\"VM summary\"}],\"projectRename\":[{\"originalName\":\"[VM summary].Subscription\",\"mergedName\":\"Subscription\"},{\"originalName\":\"[VM summary].Name\",\"mergedName\":\"Name\"},{\"originalName\":\"[VM summary].Percentage CPU (Average)\",\"mergedName\":\"Percentage CPU (Average)\"},{\"originalName\":\"[VM summary].Percentage CPU Timeline\",\"mergedName\":\"Percentage CPU Timeline\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Cpu Threshold\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"condition\":\"Default\",\"newColumnContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"expression\",\"resultVal\":\"{CpuThreshold}\"}}]},{\"originalName\":\"[Added column]\",\"mergedName\":\"Color\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"condition\":\"Percentage CPU (Average) > Cpu Threshold Result is E8976A\",\"newColumnContext\":{\"leftColumn\":\"Percentage CPU (Average)\",\"operator\":\">\",\"rightValType\":\"column\",\"rightVal\":\"Cpu Threshold\",\"resultValType\":\"static\",\"resultVal\":\"E8976A\"}},{\"condition\":\"Default\",\"newColumnContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"8CC896\"}}]},{\"originalName\":\"[Added column]\",\"mergedName\":\"Text\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"condition\":\"Percentage CPU (Average) is empty Result is -\",\"newColumnContext\":{\"leftColumn\":\"Percentage CPU (Average)\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"-\"}},{\"condition\":\"Default\",\"newColumnContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\",\"resultVal\":\"Percentage CPU (Average)\"}}]}]}", + "size": 2, + "exportFieldName": "Name", + "exportParameterName": "SelectedVM", + "title": "Percentage CPU heatmap", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 7, + "visualization": "graph", + "graphSettings": { + "type": 2, + "topContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": false + } + }, + "centerContent": { + "columnMatch": "Text", + "formatter": 12, + "formatOptions": { + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Virtual Machines/Virtual machine details", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.compute/virtualmachines" + } + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "nodeIdField": "Name", + "nodeSize": null, + "staticNodeSize": 100, + "colorSettings": { + "nodeColorField": "Color", + "type": 2, + "colorPalette": null + }, + "hivesMargin": 5 + } + }, + "name": "query - 7" + }, + { + "type": 1, + "content": { + "json": "💡 _Click on the links in the cell to see more details about the virtual machine_" + }, + "conditionalVisibility": { + "parameterName": "VirtualMachines", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "text - 6" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Resource Groups/Workbooks/Virtual machines CPU use/settings.json b/Resource Groups/Workbooks/Virtual machines CPU use/settings.json new file mode 100644 index 0000000..36446b1 --- /dev/null +++ b/Resource Groups/Workbooks/Virtual machines CPU use/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Virtual machines CPU use", + "author": "Microsoft", + "galleries": [] +} \ No newline at end of file diff --git a/Resource Groups/Workbooks/categoryResources.json b/Resource Groups/Workbooks/categoryResources.json new file mode 100644 index 0000000..ffc4b25 --- /dev/null +++ b/Resource Groups/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Metrics", "description": "", "order": 100} +} \ No newline at end of file diff --git a/Resource Insights/Alerts/README b/Resource Insights/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Resource Insights/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Resource Insights/Queries/README b/Resource Insights/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Resource Insights/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Resource Insights/Workbooks/RedisCache/ResourceInsights.workbook b/Resource Insights/Workbooks/RedisCache/ResourceInsights.workbook new file mode 100644 index 0000000..c25d879 --- /dev/null +++ b/Resource Insights/Workbooks/RedisCache/ResourceInsights.workbook @@ -0,0 +1,1435 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "f3c4e9cb-8f5c-45ef-9ff9-9517d2a4aa19", + "version": "KqlParameterItem/1.0", + "name": "RedisCache", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.cache/redis": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "e317c0a5-18fa-4dbf-b394-9b09267be6c9", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + }, + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 8" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "overview", + "preText": "", + "style": "link" + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Performance", + "subTarget": "performance", + "style": "link" + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Operations", + "subTarget": "operations", + "style": "link" + } + ] + }, + "name": "links - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 10, + "content": { + "chartId": "workbook7b475670-4421-486e-b158-a46da04ba378", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--percentProcessorTime", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemory", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--connectedclients", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--errors", + "aggregation": 4 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--expiredkeys", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--evictedkeys", + "aggregation": 3 + } + ], + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "secondaryContent": { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": {} + }, + "showBorder": false + }, + "gridSettings": { + "rowLimit": 10000 + } + }, + "name": "metric - 4" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 14400000 + }, + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--percentProcessorTime0", + "aggregation": 3, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--percentProcessorTime1", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--percentProcessorTime2", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--percentProcessorTime3", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--percentProcessorTime4", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--percentProcessorTime5", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--percentProcessorTime6", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--percentProcessorTime7", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--percentProcessorTime8", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--percentProcessorTime9", + "aggregation": 3 + } + ], + "title": "CPU Shard", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 6" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 14400000 + }, + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemory0", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemory2", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemory2", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemory3", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemory4", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemory5", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemory6", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemory7", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemory8", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--usedmemory9", + "aggregation": 1 + } + ], + "title": "Used Memory", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 7" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--connectedclients", + "aggregation": 1, + "splitBy": null + } + ], + "title": "Connected Clients", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 3" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--errors", + "aggregation": 1, + "splitBy": null + } + ], + "title": "Errors", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 0" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--expiredkeys", + "aggregation": 1, + "splitBy": null + } + ], + "title": "Expired Keys", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 1" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--evictedkeys", + "aggregation": 1, + "splitBy": null + } + ], + "title": "Evicted Keys", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 2" + } + ] + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "overview" + }, + "name": "Overview" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 10, + "content": { + "chartId": "workbook9b15f2b0-76b4-4914-bee8-6c938f3e783c", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheWrite", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead", + "aggregation": 7 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheLatency", + "aggregation": 4 + } + ], + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": {} + }, + "showBorder": false + }, + "gridSettings": { + "rowLimit": 10000 + } + }, + "name": "metric - 4" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 14400000 + }, + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheWrite", + "aggregation": 1 + } + ], + "title": "Cache Read and Write", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 4" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 14400000 + }, + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses", + "aggregation": 1 + } + ], + "title": "Cache Hit and Miss", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 5" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits0", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits1", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits2", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits3", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits4", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits5", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits6", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits7", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits8", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachehits9", + "aggregation": 1 + } + ], + "title": "Cache Hits", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 0" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses0", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses1", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses2", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses3", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses4", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses5", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses6", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses7", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses8", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cachemisses9", + "aggregation": 1 + } + ], + "title": "Cache Misses", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 1" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead0", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead1", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead2", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead3", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead4", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead5", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead6", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead7", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead8", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead9", + "aggregation": 1 + } + ], + "title": "Cache Reads", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 2" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead0", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead1", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead2", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead3", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead4", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead5", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead6", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead7", + "aggregation": 3 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead8", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--cacheRead9", + "aggregation": 1 + } + ], + "title": "Cache Writes", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 3" + } + ] + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "performance" + }, + "name": "Performance" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 10, + "content": { + "chartId": "workbookdc9131f9-1498-455b-89e1-03695d077124", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": -1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--totalcommandsprocessed", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--operationsPerSecond", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--getcommands", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--setcommands", + "aggregation": 1 + } + ], + "gridFormatType": 1, + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": false + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "secondaryContent": { + "columnMatch": "Timeline", + "formatter": 9, + "formatOptions": {} + }, + "showBorder": false + }, + "gridSettings": { + "rowLimit": 10000 + } + }, + "name": "metric - 4" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--totalcommandsprocessed0", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--totalcommandsprocessed1", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--totalcommandsprocessed2", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--totalcommandsprocessed3", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--totalcommandsprocessed4", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--totalcommandsprocessed5", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--totalcommandsprocessed6", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--totalcommandsprocessed7", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--totalcommandsprocessed8", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--totalcommandsprocessed9", + "aggregation": 1 + } + ], + "title": "Total Operations", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 0" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--operationsPerSecond0", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--operationsPerSecond1", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--operationsPerSecond2", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--operationsPerSecond3", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--operationsPerSecond4", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--operationsPerSecond5", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--operationsPerSecond6", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--operationsPerSecond7", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--operationsPerSecond8", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--operationsPerSecond9", + "aggregation": 1 + } + ], + "title": "Operation Rate", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 1" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--getcommands0", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--getcommands1", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--getcommands2", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--getcommands3", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--getcommands4", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--getcommands5", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--getcommands6", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--getcommands7", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--getcommands8", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--getcommands9", + "aggregation": 1 + } + ], + "title": "Gets", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 2" + }, + { + "type": 10, + "content": { + "chartId": "workbook11988d6a-5d1d-48b8-83d0-044d7341608c", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 1, + "metricScope": 0, + "resourceIds": [ + "{RedisCache}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.cache/redis", + "resourceParameter": "RedisCache", + "metrics": [ + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--setcommands0", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--setcommands1", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--setcommands2", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--setcommands3", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--setcommands4", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--setcommands5", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--setcommands6", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--setcommands7", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--setcommands8", + "aggregation": 1 + }, + { + "namespace": "microsoft.cache/redis", + "metric": "microsoft.cache/redis--setcommands9", + "aggregation": 1 + } + ], + "title": "Sets", + "showOpenInMe": true, + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "50", + "showPin": true, + "name": "metric - 3" + } + ] + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "operations" + }, + "name": "Operations" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Resource Insights/Workbooks/RedisCache/settings.json b/Resource Insights/Workbooks/RedisCache/settings.json new file mode 100644 index 0000000..680006a --- /dev/null +++ b/Resource Insights/Workbooks/RedisCache/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Azure Cache For Redis Resource Overview", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "microsoft.cache/redis"}] +} \ No newline at end of file diff --git a/Resource Insights/Workbooks/categoryResources.json b/Resource Insights/Workbooks/categoryResources.json new file mode 100644 index 0000000..4582da3 --- /dev/null +++ b/Resource Insights/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Resource Insights", "description": "Provides insights at the resource level", "order": 100} +} \ No newline at end of file diff --git a/ResourceTypes/KeyVault/Are-there-any-slow-requests.md b/ResourceTypes/KeyVault/Are-there-any-slow-requests.md deleted file mode 100644 index f78743b..0000000 --- a/ResourceTypes/KeyVault/Are-there-any-slow-requests.md +++ /dev/null @@ -1,15 +0,0 @@ -// Author: someone@somewhere.com -// Display name: Are there any slow requests? -// Description: List of KeyVault requests that took longer than 1sec. -// Category: Azure Resources -// Topic: General -// ResourceType: KeyVault // may no be needed, support for smart saving, helps if saved in solutions folder -// Keywords: - -``` -let threshold=1000; // let operator defines a constant that can be further used in the query -AzureDiagnostics -| where ResourceProvider =="MICROSOFT.KEYVAULT" -| where DurationMs > threshold -| summarize count() by OperationName -``` \ No newline at end of file diff --git a/ResourceTypes/KeyVault/How-active-has-this-keyVault-been.md b/ResourceTypes/KeyVault/How-active-has-this-keyVault-been.md deleted file mode 100644 index 648ae9b..0000000 --- a/ResourceTypes/KeyVault/How-active-has-this-keyVault-been.md +++ /dev/null @@ -1,16 +0,0 @@ -// Author: someone@somewhere.com -// Display name: How active has this KeyVault been? -// Description: Line chart showing trend of KeyVault requests volume, per operation over time. -// Category: Azure Resources -// Topic: General -// ResourceType: KeyVault -// Keywords: #render - -``` -// KeyVault diagnostic currently stores logs in AzureDiagnostics table which stores logs for multiple services. -// Filter on ResourceProvider for logs specific to a service. -AzureDiagnostics -| where ResourceProvider =="MICROSOFT.KEYVAULT" -| summarize count() by bin(TimeGenerated, 1h), OperationName // Aggregate by hour -| render timechart -``` diff --git a/ResourceTypes/KeyVault/How-fast-is-this-KeyVault-serving-requests.md b/ResourceTypes/KeyVault/How-fast-is-this-KeyVault-serving-requests.md deleted file mode 100644 index 12c8339..0000000 --- a/ResourceTypes/KeyVault/How-fast-is-this-KeyVault-serving-requests.md +++ /dev/null @@ -1,17 +0,0 @@ -// Author: someone@somewhere.com -// Display name: How fast is this KeyVault serving requests? -// Description: Line chart showing trend of request duration over time using different aggregations. -// Category: Azure Resources -// Topic: General -// ResourceType: KeyVault // may no be needed, support for smart saving, helps if saved in solutions folder -// Keywords: - -``` -AzureDiagnostics -| where ResourceProvider =="MICROSOFT.KEYVAULT" -| where httpStatusCode_d >= 300 and not(OperationName == "Authentication" and httpStatusCode_d == 401) -| summarize count() by requestUri_s, ResultSignature -// ResultSignature contains HTTP status such as "OK" or "Forbidden". -// httpStatusCode_d contains HTTP status code returned by the request such as 200 or 401. -// requestUri_s contains the URI of the request. -``` \ No newline at end of file diff --git a/ResourceTypes/KeyVault/What-changes-occurred-last-month.md b/ResourceTypes/KeyVault/What-changes-occurred-last-month.md deleted file mode 100644 index 32b688e..0000000 --- a/ResourceTypes/KeyVault/What-changes-occurred-last-month.md +++ /dev/null @@ -1,17 +0,0 @@ -// Author: someone@somewhere.com -// Display name: What changes occurred last month? -// Description: Lists all update and patch requests from the last 30 days -// Category: Azure Resources, Audit -// Topic: General -// ResourceType: KeyVault // may no be needed, support for smart saving, helps if saved in solutions folder -// Keywords: - -``` -// KeyVault diagnostic currently stores logs in AzureDiagnostics table which stores logs for multiple services. -// Filter on ResourceProvider for logs specific to a service. -AzureDiagnostics -| where TimeGenerated > ago(30d) // Time range specified in the query. Overrides time picker in portal. -| where ResourceProvider =="MICROSOFT.KEYVAULT" -| where OperationName == "VaultPut" or OperationName == "VaultPatch" -| sort by TimeGenerated desc. -``` \ No newline at end of file diff --git a/ResourceTypes/KeyVault/Who-is-calling-this-KeyVault.md b/ResourceTypes/KeyVault/Who-is-calling-this-KeyVault.md deleted file mode 100644 index 1b0c4dc..0000000 --- a/ResourceTypes/KeyVault/Who-is-calling-this-KeyVault.md +++ /dev/null @@ -1,14 +0,0 @@ -// Author: someone@somewhere.com -// Display name: Who is calling this KeyVault? -// Description: List of callers identified by their IP address with their request count. -// Category: Azure Resources, Security -// Topic: General -// ResourceType: KeyVault // may no be needed, support for smart saving, helps if saved in solutions folder - -``` -// KeyVault diagnostic currently stores logs in AzureDiagnostics table which stores logs for multiple services. -// Filter on ResourceProvider for logs specific to a service. -AzureDiagnostics -| where ResourceProvider =="MICROSOFT.KEYVAULT" -| summarize count() by CallerIPAddress -``` diff --git a/Retention/Alerts/README b/Retention/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Retention/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Retention/Queries/README b/Retention/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Retention/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Retention/Workbooks/Cohort Analysis/Cohort Analysis.workbook b/Retention/Workbooks/Cohort Analysis/Cohort Analysis.workbook new file mode 100644 index 0000000..22638cc --- /dev/null +++ b/Retention/Workbooks/Cohort Analysis/Cohort Analysis.workbook @@ -0,0 +1,245 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Cohort Analysis\n\nCohort Analysis measures how many of your users come back to perform one of the `RetainingActivities` in a particular period after they perform one of the `CohortingActivities` in your app - split by a dimension you choose. For instance, you could be measuring the number of users who returned to use your app on the 10th day from the day they first downloaded it, split by the country they are from. Seeing the retention trend for days 1-10 will give you an indication of the stickiness of your app. \n\nCohort Analysis is similar to N-day or Bracket retention and is only different in how the cohorts are defined. \n\nThis type of analysis is well-suited for gaming apps, or other kinds of app where you are trying to get users to develop a daily habit. Cohort Analysis will help you see differences in user retention across standard dimensions like country, app version, etc. or custom dimensions like 'Is Premium Customer' or 'Flight name in an experiment group'." + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Activity Selection\nUse these fields to set events that that correspond to interesting user activities. The `Understanding Cohort Analysis Parameters` section at the bottom describes these parameters in detail." + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "97ae2ae5-ec95-455b-bac2-36caf2db61db", + "version": "KqlParameterItem/1.0", + "name": "CohortingActivities", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let events = union customEvents, pageViews\n| where timestamp >= ago(7d)\n| summarize Count = count() by name;\nlet top3 = events\n| top 3 by Count desc\n| summarize makelist(name);\nevents\n| order by Count desc\n| project Id=name, Title=name, Selected=iff(name in (top3), true, false)\n| union (\ndatatable(Id:string, Title:string, Selected:boolean)[\n'*', 'All Events and Page Views', false\n]\n)" + }, + { + "name": "CohortingFilters", + "id": "94bacf68-78db-4755-8a40-c2702dea4018", + "type": 1, + "value": "" + }, + { + "id": "6cb4afed-7dac-4608-892b-154f4943ddb6", + "version": "KqlParameterItem/1.0", + "name": "RetainingActivities", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\n| where timestamp >= ago(7d)\n| summarize count() by name\n| order by count_ desc\n| project Id=name, Title=name, Selected=false\n| union (\ndatatable(Id:string, Title:string, Selected:boolean)[\n'#', 'Same as cohorting activities', true,\n'*', 'All Events and Page Views', false\n]\n)" + }, + { + "id": "0cc5211a-557e-4648-9569-1236bf16559f", + "version": "KqlParameterItem/1.0", + "name": "RetainingFilters", + "type": 1, + "isRequired": false, + "query": "datatable(x:int)[ 1 ]\r\n| extend retainingFilter = iff('#' in ({RetainingActivities}), '{CohortingFilters}', '')\r\n| project retainingFilter", + "isHiddenWhenLocked": false + } + ], + "style": "pills", + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Cohort Analysis Parameters\nUse these fields to customize your retention settings." + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "1c53914e-0c06-4944-b2b8-fd4abaeb2f9f", + "version": "KqlParameterItem/1.0", + "name": "CohortType", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(value:string, text:string)[\n'itemType', '❌ None',\n'name', '📛 Activity',\n'cloud_RoleInstance', '🖥️ Machine',\n'client_CountryOrRegion', '📍 Country or Region',\n'client_StateOrProvince', '📍 State or Province',\n'client_City', '📍 City',\n'client_Browser', '🌐 Client Browser',\n'client_OS', '️️🖥️ Client Operating System',\n'client_Model', '📱 Client Model',\n'application_Version', '⚪ Application Version',\n'operation_Name', '⚪ Operation',\n]\n| union (union pageViews, customEvents\n| where timestamp >= ago(1d)\n| where name in ({CohortingActivities}) or '*' in ({CohortingActivities})\n| project customDimensions \n| summarize schema = buildschema(customDimensions) \n| mvexpand schema\n| extend e = extract(@'{\"(.+)\":.+}', 1, tostring(schema))\n| project text = strcat('❄️ ', e), value = strcat('customDimensions[\"', e, '\"]'))", + "value": "name" + }, + { + "id": "e62098ae-ac3f-4800-8e62-3e7d9a052e56", + "version": "KqlParameterItem/1.0", + "name": "RetentionPeriod", + "type": 2, + "description": "1d: Daily, 7d: Weekly, 30/28d: Monthly", + "isRequired": true, + "multiSelect": null, + "query": "datatable(id:string, text:string)[\n'1d', 'Daily',\n'7d', 'Weekly',\n'28d', 'Monthly (28 days)', \n'30d', 'Monthly (30 days)'\n]", + "value": "7d" + }, + { + "id": "fa4b29d9-bfc1-46e3-98f1-3cba05afbea3", + "version": "KqlParameterItem/1.0", + "name": "PeriodsToAnalyze", + "type": 1, + "description": "Number of cohort periods to analyze", + "isRequired": true, + "value": "4" + }, + { + "id": "7912aca9-1688-4886-aec1-838c68131e25", + "version": "KqlParameterItem/1.0", + "name": "BasedOn", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(v:string, t:string)[\r\n'user_Id', 'Anonymous Users',\r\n'user_AuthenticatedId', 'Authenticated Users'\r\n]", + "isHiddenWhenLocked": false, + "value": "user_Id" + }, + { + "id": "f6511ffa-e2ea-4a34-ad2e-454856288bd5", + "version": "KqlParameterItem/1.0", + "name": "Show", + "type": 2, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": \"RetentionRate\", \"label\": \"Retention Rate\", \"selected\": true},\r\n { \"value\": \"RetainedCount\", \"label\": \"Retained Users\", \"selected\": false},\r\n { \"value\": \"UserCount\", \"label\": \"Potentially Retainable Users\", \"selected\": false}\r\n]", + "timeContextFromParameter": null + } + ], + "style": "pills", + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Cohort Analysis Table" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let periodsToAnalyze = {PeriodsToAnalyze};\nlet cohortSize = {RetentionPeriod};\nlet retainingActivities = iff(({RetainingActivities}) in ('#'), dynamic([{CohortingActivities}]), dynamic([{RetainingActivities}]));\nlet cohortUnit = case(cohortSize == 30d or cohortSize == 28d, \"month\", cohortSize == 7d, \"week\", \"day\");\nlet timeRange = startofday(now()) - case(cohortSize == 30d or cohortSize == 28d, startofmonth(now() - periodsToAnalyze * cohortSize), cohortSize == 7d, startofweek(now() - periodsToAnalyze * cohortSize), startofday(now() - periodsToAnalyze * cohortSize));\nlet data = union customEvents, pageViews\n| where user_Id != \"undefined\"\n| where timestamp > startofday(now() - timeRange);\nlet cohorts = data\n| where name in ({CohortingActivities}) or '*' in ({CohortingActivities})\n| extend Cohort = iff('{CohortType}' == 'itemType', 'Overall', iff({CohortType} == '', 'Unknown', {CohortType})) // reusing itemType to indicate no segmentation\n| summarize EarliestInCohort = min(startofday(timestamp)) by user_Id, Cohort\n| summarize NewUsers = hll(user_Id) by EarliestInCohort, Cohort;\nlet usage = data\n| where name in (retainingActivities) or '*' in (retainingActivities)\n| extend Cohort = iff('{CohortType}' == 'itemType', 'Overall', iff({CohortType} == '', 'Unknown', {CohortType})) // reusing itemType to indicate no segmentation\n| summarize UsersInCohort = hll(user_Id) by Day = startofday(timestamp), Cohort;\ncohorts\n| extend RetentionEvaluationDay = range(EarliestInCohort + 1d, now(), 1d)\n| mvexpand RetentionEvaluationDay to typeof(datetime) limit 1000\n| extend RetentionWeek = bin((RetentionEvaluationDay - EarliestInCohort) / cohortSize, 1)\n| join kind=inner\n(\n usage\n)\non $left.RetentionEvaluationDay == $right.Day, Cohort\n| project EarliestInCohort, Cohort, RetentionWeek, EvaluationDayUsers = UsersInCohort, NewUsers\n| summarize Users = hll_merge(EvaluationDayUsers), NewUsers = hll_merge(NewUsers) by EarliestInCohort, Cohort, RetentionWeek\n| evaluate dcount_intersect(NewUsers, Users)\n| project EarliestInCohort, Cohort, RetentionWeek, CohortUserCount = s0, CohortRetainedCount = s1\n| summarize UserCount = sum(CohortUserCount), RetainedCount = sum(CohortRetainedCount) by Cohort, RetentionWeek\n| extend RetentionRate = round(100.0 * RetainedCount / UserCount, 2)\n| order by RetentionWeek asc, UserCount desc\n| project Cohort, RetentionWeek, Metric = {Show}\n| extend RetentionWeek = case(RetentionWeek == 0, strcat(\"<1 \", cohortUnit), strcat(\"+\", toint(RetentionWeek), \" \", cohortUnit))\n| serialize\n| evaluate pivot(RetentionWeek, sum(Metric))\n\n\n\n\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContextFromParameter": null, + "resourceType": "microsoft.insights/components", + "gridSettings": { + "formatters": [ + { + "columnMatch": "week|month|day", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Interpreting the table\nThis section shows how to read and interpret a retention table. The section below shows a row from a weekly retention report that we will try to read.\n" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "datatable(Cohort:string, Users:int, ['<1 week']:int, ['+1 week']:int, ['+2 week']:int, ['+3 week']:int, ['+4 week']:int)[ \r\n'Add to Cart', 1000, 50, 30, 20, 15, 10\r\n]\r\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContextFromParameter": null, + "resourceType": "microsoft.insights/components", + "gridSettings": { + "formatters": [ + { + "columnMatch": "week", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "| Column | Explanation | Interpretation in the example |\n| ----- | :----- | :----- |\n| Cohort | Identifies the cohorting criteria specified by the CohortType parameter. | This row explains the retention behavior of users who used the 'Add to Cart' event. |\n| Total Users | Number of unique users who used the Add to Cart feature | 1000 unique users added an item to their cart in your app |\n| <1 week | Percentage of cohort users who returned between 1 and 6 days after using 'Add to Cart' (using it again the same day does not count towards retention) | 50% or 500 users returned to use your app within the first week after they added an item to their cart |\n| +1 week | Percentage of cohort users who returned between 7 and 13 days after using 'Add to Cart' | 30% or 300 users returned to use your app a week later |\n| +N week | Percentage of cohort users who returned in the Nth week after 'Add to Cart' | 15% or 150 users, when N = 3 |\n\n\n\n\n" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Understanding Cohort Analysis Parameters\n| Parameter | Used for |\n| ----- | ----- |\n| Cohort Type | The dimension by which to split the retention numbers |\n| Retention Period | The period to use in retention calculation. Can be Daily, Weekly or Monthly |\n| Periods To Analyze | The number of retention periods to analyze. |\n| Cohorting Activities | The activities that selects a cohort of users. Example: Users who used event *Read Product Review* (cohorting activity). |\n| Retaining Activities | The activities that indicates retention of a cohorted user selected above. Example: Users who used event *Read Product Review* (cohorting activity) and returned to use *Purchase Product* (retaining activity). |\n| Cohorting/Retaining Filters | An analytics query snippet to further filter the cohorting activity. Example: *| where application_Version = '1.0'* |\n| Show | The metric to visualize in the table. *Retention Rate* shows the rate at which users returned for the time period in the column. *Retained Users* is raw number of retained users for the time period. *Potentially Retainable Users* is the number of users who could potentially have been retained for that period.' |\n" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## What is a week for a user?\nThe short answer is that it is unique for each user. Our analysis treats each user's retention window seperately - giving an accurate view of their actual behavior with your app. \n\nConsider the example below of two users X and Y: \n\n| User | First use of app | Weeks for user |\n| ----- | :----- | :----- |\n| X | April 3 | w1 = April 10, w2 = April 17, w3 = April 24 |\n| Y | April 5 | w1 = April 12, w2 = April 19, w3 = April 26 |\n\nEach user gets a seperate retention window. So, if both users came back on April 18, then it considered as Week 2 usage for User X but Week 1 usage for User Y. \n\nThis allows the normalization their app use over the retention window - making it seem as if all users in a cohort used the app on the same day. This allow for better analysis and comparision of user behavior." + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Related Workbook Templates\n* Retention - N-Period\n* Retention - Unbounded\n* Retention - Bracket" + }, + "conditionalVisibility": null + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Retention/Workbooks/Cohort Analysis/settings.json b/Retention/Workbooks/Cohort Analysis/settings.json new file mode 100644 index 0000000..21c8774 --- /dev/null +++ b/Retention/Workbooks/Cohort Analysis/settings.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Cohort Analysis", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 100 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 100 + } + ] +} \ No newline at end of file diff --git a/Retention/Workbooks/Retention - Bracket/Retention - Bracket.workbook b/Retention/Workbooks/Retention - Bracket/Retention - Bracket.workbook new file mode 100644 index 0000000..64521fc --- /dev/null +++ b/Retention/Workbooks/Retention - Bracket/Retention - Bracket.workbook @@ -0,0 +1,200 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Bracket Retention\n---\n\nBracket retention measures how many of your users come back to perform one of the `RetainingActivities` in a particular period after they perform one of the `CohortingActivities` in your app. For instance, you could be measuring the number of users who returned to use your app one week from day from the day they first downloaded it. Seeing the retention trend for days 7-13 will give you an indication of the stickiness of your app. \n\nBracket retention is similar to N-period retention, except that the retention time ranges or buckets are not fixed. You are free to choose any time bucket that makes sense for your app. This gives app owners a lot more flexibility in analyzing their user retention.\n\nBracket retention is well-suited for gaming apps, or other kinds of app where you are trying to get users to develop a daily habit." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Activity Selection\nUse these fields to set events that that correspond to interesting user activities. The `Understanding Retention Parameter` section at the bottom describes these parameters in detail." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "1bf002e1-a1cf-45fc-9b2a-2a0a0718f4c5", + "version": "KqlParameterItem/1.0", + "name": "CohortingActivities", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\r\n| where timestamp >= ago(7d)\r\n| summarize count() by name\r\n| order by count_ desc\r\n| project Id=name, Title=name, Selected=false\r\n| union (\r\ndatatable(Id:string, Title:string, Selected:boolean)[\r\n'*', 'All Events and Page Views', true\r\n]\r\n)" + }, + { + "id": "3d623c97-550a-4214-9fa7-164dfee39fc5", + "version": "KqlParameterItem/1.0", + "name": "CohortingFilters", + "type": 1, + "description": null, + "isRequired": false, + "value": "" + }, + { + "id": "7a6de1a4-1cc5-4f93-83d5-5a906a786bcf", + "version": "KqlParameterItem/1.0", + "name": "RetainingActivities", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\r\n| where timestamp >= ago(7d)\r\n| summarize count() by name\r\n| order by count_ desc\r\n| project Id=name, Title=name, Selected=false\r\n| union (\r\ndatatable(Id:string, Title:string, Selected:boolean)[\r\n'#', 'Same as cohorting activities', true,\r\n'*', 'All Events and Page Views', false\r\n])" + }, + { + "id": "0eb882bb-3a17-456d-bae3-6510833982db", + "version": "KqlParameterItem/1.0", + "name": "RetainingFilters", + "type": 1, + "description": null, + "isRequired": false, + "query": "datatable(x:int)[ 1 ]\r\n| extend retainingFilter = iff('#' in ({RetainingActivities}), '{CohortingFilters}', '')\r\n| project retainingFilter", + "isHiddenWhenLocked": false + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Retention Parameters\nUse these fields to customize your retention settings. " + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "39bddfc5-884d-4961-b740-67a0e275d7f4", + "version": "KqlParameterItem/1.0", + "name": "CohortSize", + "type": 2, + "description": "1d: Daily, 7d: Weekly, 30/28d: Monthly", + "isRequired": true, + "multiSelect": null, + "query": "datatable(id:string, text:string)[\r\n'1d', 'Daily',\r\n'7d', 'Weekly',\r\n'28d', 'Monthly (28 days)', \r\n'30d', 'Monthly (30 days)'\r\n]", + "value": "7d" + }, + { + "id": "3f79ef58-8e21-4d79-923a-2293888b0b0f", + "version": "KqlParameterItem/1.0", + "name": "CohortsToAnalyze", + "type": 1, + "description": "Number of cohort periods to analyze", + "isRequired": true, + "value": "6" + }, + { + "id": "bdd221c7-ed8d-4e35-b2cd-644a81bdfd16", + "version": "KqlParameterItem/1.0", + "name": "SelectBrackets", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(value:string, text:string)[\r\n'1d, 7d, 29d', '1-6 days and 7-29 days',\r\n'1d, 5d, 10d, 15d', '1-4 days, 5-9 days and 10-14 days',\r\n'1d, 2d, 7d, 14d, 29d', '1 day, 2-6 days, 7-13 days and 14-29 days',\r\n]", + "value": "1d, 2d, 7d, 14d, 29d" + }, + { + "id": "68b965ed-def3-40da-9445-a7fce363dd66", + "version": "KqlParameterItem/1.0", + "name": "CustomBrackets", + "type": 1, + "description": null, + "isRequired": true, + "query": "datatable(x:string)['{SelectBrackets}']" + }, + { + "id": "16c1668c-38b2-426d-bf2f-eb6ff7162e71", + "version": "KqlParameterItem/1.0", + "name": "BasedOn", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(v:string, t:string)[ \r\n'user_Id', 'Anonymous Users', \r\n'user_AuthenticatedId', 'Authenticated Users' \r\n]", + "isHiddenWhenLocked": false, + "value": "user_Id" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Bracket Retention Table\n" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bracketDefinition = dynamic([{CustomBrackets}]);\r\nlet periodsToAnalyze = {CohortsToAnalyze};\r\nlet cohortSize = {CohortSize};\r\nlet retainingActivities = iff('#' in ({RetainingActivities}), dynamic([{CohortingActivities}]), dynamic([{RetainingActivities}]));\r\nlet cohortUnit = case(cohortSize == 30d or cohortSize == 28d, \"month\", cohortSize == 7d, \"week\", \"day\");\r\nlet timeRange = startofday(now()) - case(cohortSize == 30d or cohortSize == 28d, startofmonth(now() - periodsToAnalyze * cohortSize), cohortSize == 7d, startofweek(now() - periodsToAnalyze * cohortSize), startofday(now() - periodsToAnalyze * cohortSize));\r\nlet bracketTables = range i from 1 to 1 step 1\r\n| extend bracketDefinition = bracketDefinition\r\n| mvexpand bracketDefinition limit 1000\r\n| extend brackets = totimespan(bracketDefinition)\r\n| serialize id = row_number();\r\nlet brackets = bracketTables\r\n| join kind = inner (bracketTables) on i\r\n| where id1 - id == 1\r\n//| project Bracket = id, Start = brackets, End = brackets1, jkey = 1\r\n| extend Range = range(brackets, brackets1 - 1d, 1d)\r\n| project Bracket = id, Range, jkey = 1, BracketTitle = iff(brackets == brackets1 - 1d, strcat('Day ', toint(brackets / 1d)), strcat('Days ', toint(brackets / 1d), '-', toint((brackets1 - 1d) / 1d)));\r\nlet cohorts = union customEvents, pageViews\r\n| where timestamp > startofday(now() - timeRange)\r\n| where name in ({CohortingActivities}) or '*' in ({CohortingActivities})\r\n{CohortingFilters}\r\n| extend Cohort = case(cohortSize == 30d or cohortSize == 28d, startofmonth(timestamp), cohortSize == 7d, startofweek(timestamp), startofday(timestamp))\r\n| summarize EarliestInCohort = min(startofday(timestamp)) by {BasedOn}, Cohort\r\n| summarize UsersInCohort = hll({BasedOn}) by EarliestInCohort, Cohort;\r\nlet users = union customEvents, pageViews\r\n| where timestamp > startofday(now() - timeRange)\r\n| where name in (retainingActivities) or '*' in (retainingActivities)\r\n{RetainingFilters}\r\n| summarize Users = hll({BasedOn}) by Day = startofday(timestamp);\r\nlet Retention = materialize(range i from 0d to timeRange step 1d\r\n| extend Day = startofday(now() - i)\r\n| extend jkey = 1\r\n| join kind = inner (brackets | project-away BracketTitle) on jkey\r\n| mvexpand Range limit 10000\r\n| extend RetentionDay = Day + totimespan(Range) \r\n| where RetentionDay <= startofday(now())\r\n| project Day, Bracket, RetentionDay\r\n| join kind=inner\r\n(\r\n users\r\n | project UsersOnDay = Users, RetentionDay = Day\r\n)\r\non RetentionDay\r\n| summarize UsersForRetentionWeek = hll_merge(UsersOnDay) by Day, Bracket\r\n| join kind=inner\r\n(\r\n cohorts\r\n | project UsersInCohort, Cohort, Day = EarliestInCohort\r\n)\r\non Day\r\n| project-away Day1\r\n| evaluate dcount_intersect(UsersInCohort, UsersForRetentionWeek)\r\n| summarize RetainedUsers = sum(s1) by Cohort, Bracket);\r\ncohorts\r\n| summarize UsersInCohort = hll_merge(UsersInCohort) by Cohort\r\n| project Cohort, CohortUsers = dcount_hll(UsersInCohort)\r\n| join kind=inner\r\n(\r\n Retention\r\n)\r\non Cohort\r\n| project-away Cohort1\r\n| extend RetentionRate = round(100.0 * RetainedUsers / CohortUsers, 2)\r\n| project-away RetainedUsers\r\n| join kind = inner (brackets | project Bracket, BracketTitle) on Bracket\r\n| order by Cohort asc, Bracket asc\r\n| serialize rank = row_number()\r\n| project-away Bracket, Bracket1\r\n| extend month = monthofyear(Cohort)\r\n| extend friendlyMonthName = case(month == 1, 'January', month == 2, 'February', month == 3, 'March', month == 4, 'April', month == 5, 'May', month == 6, 'June', month == 7, 'July', month == 8, 'August', month == 9, 'September', month == 10, 'October', month == 11, 'November', 'December')\r\n| extend dayofweek = dayofweek(Cohort)\r\n| extend friendlyDayOfweek = case(dayofweek == 0d, \"Sun\", dayofweek == 1d, \"Mon\", dayofweek == 2d, \"Tue\", dayofweek == 3d, \"Wed\", dayofweek == 4d, \"Thu\", dayofweek == 5d, \"Fri\", \"Sat\")\r\n| extend Cohort = iff(cohortSize == 1d, strcat(friendlyMonthName, ' ', dayofmonth(Cohort), ' (', friendlyDayOfweek, ')'), strcat(friendlyMonthName, ' ', dayofmonth(Cohort)))\r\n| order by rank asc\r\n| project-away month, friendlyMonthName, dayofweek, friendlyDayOfweek, rank\r\n| evaluate pivot(BracketTitle, sum(RetentionRate))", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Day", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Understanding the Retention Parameters\n| Parameter | Used for |\n| ----- | ----- |\n| Retention Period | The period to use in retention calculation. Can be Daily, Weekly or Monthly |\n| Cohorts To Analyze | The number of cohorts to analyze. This corresponds to the N in N-period retention |\n| Cohorting Activities | The activities that selects a cohort of users. Example: Users who used event *Read Product Review* (cohorting activity). |\n| Retaining Activities | The activities that indicates retention of a cohorted user selected above. Example: Users who used event *Read Product Review* (cohorting activity) and returned to use *Purchase Product* (retaining activity). |\n| Cohorting/Retaining Filters | An analytics query snippet to further filter the cohorting activity. Example: *| where application_Version = '1.0'* |\n| SelectBrackets | Some example time brackets to get your started with |\n| CustomBrackets | Use this field to set custom time brackets that make sense for your app. It contains is a comma seperated list of timespans that correspond to bracket boundaries. |\n" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Related Workbook Templates\n* Retention - N-Period\n* Retention - Unbounded\n* Cohort Analysis" + }, + "conditionalVisibility": null, + "halfWidth": false + } + ] +} \ No newline at end of file diff --git a/Retention/Workbooks/Retention - Bracket/settings.json b/Retention/Workbooks/Retention - Bracket/settings.json new file mode 100644 index 0000000..0ee0a21 --- /dev/null +++ b/Retention/Workbooks/Retention - Bracket/settings.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Bracket Retention", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 400 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 400 + } + ] +} \ No newline at end of file diff --git a/Retention/Workbooks/Retention - N Period/Retention - N Period.workbook b/Retention/Workbooks/Retention - N Period/Retention - N Period.workbook new file mode 100644 index 0000000..0b4c816 --- /dev/null +++ b/Retention/Workbooks/Retention - N Period/Retention - N Period.workbook @@ -0,0 +1,218 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# N-Period Retention\n\nN-period retention measures how many of your users come back to perform one of the `RetainingActivities` in a particular period after they perform one of the `CohortingActivities` in your app. For instance, you could be measuring the number of users who returned to use your app on the 10th day from the day they first downloaded it. Seeing the retention trend for days 1-10 will give you an indication of the stickiness of your app. \n\nN-day retention is well-suited for gaming apps, or other kinds of app where you are trying to get users to develop a daily habit." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Activity Selection\nUse these fields to set events that that correspond to interesting user activities. The `Understanding Retention Parameter` section at the bottom describes these parameters in detail." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "97ae2ae5-ec95-455b-bac2-36caf2db61db", + "version": "KqlParameterItem/1.0", + "name": "CohortingActivities", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\n| where timestamp >= ago(7d)\n| summarize count() by name\n| order by count_ desc\n| project Id=name, Title=name, Selected=false\n| union (\ndatatable(Id:string, Title:string, Selected:boolean)[\n'*', 'All Custom Events and Page Views', true,\n'&', 'All Page Views', false,\n'@', 'All Custom Events', false\n]\n)", + "isHiddenWhenLocked": false + }, + { + "name": "CohortingFilters", + "id": "94bacf68-78db-4755-8a40-c2702dea4018", + "type": 1, + "value": "" + }, + { + "id": "6cb4afed-7dac-4608-892b-154f4943ddb6", + "version": "KqlParameterItem/1.0", + "name": "RetainingActivities", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\n| where timestamp >= ago(7d)\n| summarize count() by name\n| order by count_ desc\n| project Id=name, Title=name, Selected=false\n| union (\ndatatable(Id:string, Title:string, Selected:boolean)[\n'#', 'Same as cohorting activities', true,\n'*', 'All Custom Events and Page Views', false,\n'&', 'All Page Views', false,\n'@', 'All Custom Events', false\n]\n)", + "isHiddenWhenLocked": false + }, + { + "id": "0cc5211a-557e-4648-9569-1236bf16559f", + "version": "KqlParameterItem/1.0", + "name": "RetainingFilters", + "type": 1, + "isRequired": false, + "query": "datatable(x:int)[ 1 ]\r\n| extend retainingFilter = iff('#' in ({RetainingActivities}), '{CohortingFilters}', '')\r\n| project retainingFilter", + "isHiddenWhenLocked": false + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Retention Parameters\nUse these fields to customize your retention settings. " + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e62098ae-ac3f-4800-8e62-3e7d9a052e56", + "version": "KqlParameterItem/1.0", + "name": "RetentionPeriod", + "type": 2, + "description": "1d: Daily, 7d: Weekly, 30/28d: Monthly", + "isRequired": true, + "multiSelect": null, + "query": "datatable(id:string, text:string)[\n'1d', 'Daily',\n'7d', 'Weekly',\n'28d', 'Monthly (28 days)', \n'30d', 'Monthly (30 days)'\n]", + "value": "7d" + }, + { + "id": "fa4b29d9-bfc1-46e3-98f1-3cba05afbea3", + "version": "KqlParameterItem/1.0", + "name": "CohortsToAnalyze", + "type": 1, + "description": "Number of cohort periods to analyze", + "isRequired": true, + "value": "6" + }, + { + "id": "2cdfcf8e-2413-41d2-a829-249e27d817ee", + "version": "KqlParameterItem/1.0", + "name": "BasedOn", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(v:string, t:string)[\r\n'user_Id', 'Anonymous Users',\r\n'user_AuthenticatedId', 'Authenticated Users'\r\n]", + "isHiddenWhenLocked": false, + "value": "user_Id" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let periodsToAnalyze = {CohortsToAnalyze};\nlet cohortSize = {RetentionPeriod};\nlet retainingActivities = iff('#' in ({RetainingActivities}), dynamic([{CohortingActivities}]), dynamic([{RetainingActivities}]));\nlet cohortUnit = case(cohortSize == 30d or cohortSize == 28d, \"month\", cohortSize == 7d, \"week\", \"day\");\nlet timeRange = startofday(now()) - case(cohortSize == 30d or cohortSize == 28d, startofmonth(now() - periodsToAnalyze * cohortSize), cohortSize == 7d, startofweek(now() - periodsToAnalyze * cohortSize), startofday(now() - periodsToAnalyze * cohortSize));\nlet cohorts = union customEvents, pageViews\n| where timestamp > startofday(now() - timeRange)\n| where name in ({CohortingActivities}) or '*' in ({CohortingActivities}) or ('&' in ({CohortingActivities}) and itemType == 'pageView') or ('@' in ({CohortingActivities}) and itemType == 'customEvent')\n{CohortingFilters}\n| extend Cohort = case(cohortSize == 30d or cohortSize == 28d, startofmonth(timestamp), cohortSize == 7d, startofweek(timestamp), startofday(timestamp))\n| summarize EarliestInCohort = min(startofday(timestamp)) by {BasedOn}, Cohort\n| summarize UsersInCohort = hll({BasedOn}) by EarliestInCohort, Cohort;\nlet users = union customEvents, pageViews\n| where timestamp > startofday(now() - timeRange)\n| where name in (retainingActivities) or '*' in (retainingActivities) or ('&' in (retainingActivities) and itemType == 'pageView') or ('@' in (retainingActivities) and itemType == 'customEvent')\n{RetainingFilters}\n| summarize Users = hll({BasedOn}) by Day = startofday(timestamp);\nlet Retention = materialize(range i from 0d to timeRange step 1d\n| extend Day = startofday(now() - i)\n| extend RetentionRange = range(1d, timeRange, 1d)\n| mvexpand RetentionRange limit 10000\n| extend RetentionDay = Day + totimespan(RetentionRange)\n| extend RetentionWeek = toint(totimespan(RetentionRange) / cohortSize)\n| where RetentionDay <= startofday(now())\n| project Day, RetentionDay, RetentionWeek\n| join kind=inner\n(\n users\n | project UsersOnDay = Users, RetentionDay = Day\n) on RetentionDay\n| summarize UsersForRetentionWeek = hll_merge(UsersOnDay) by Day, RetentionWeek\n| join kind=inner\n(\n cohorts\n | project UsersInCohort, Cohort, Day = EarliestInCohort\n)\non Day\n| project-away Day1\n| evaluate dcount_intersect(UsersInCohort, UsersForRetentionWeek)\n| summarize RetainedUsers = sum(s1) by Cohort, RetentionWeek\n);\ncohorts\n| summarize UsersInCohort = hll_merge(UsersInCohort) by Cohort\n| project Cohort, CohortUsers = dcount_hll(UsersInCohort) \n| join kind=inner (Retention) on Cohort\n| project-away Cohort1\n| extend RetentionRate = round(100.0 * RetainedUsers / CohortUsers, 2)\n| project-away RetainedUsers \n| order by Cohort asc, RetentionWeek asc\n| serialize rank = row_number()\n| extend RetentionWeek = case(RetentionWeek == 0, strcat(\"<1 \", cohortUnit), strcat(\"+\", RetentionWeek, \" \", cohortUnit))\n| extend month = monthofyear(Cohort)\n| extend friendlyMonthName = case(month == 1, 'January', month == 2, 'February', month == 3, 'March', month == 4, 'April', month == 5, 'May', month == 6, 'June', month == 7, 'July', month == 8, 'August', month == 9, 'September', month == 10, 'October', month == 11, 'November', 'December')\n| extend dayofweek = dayofweek(Cohort)\n| extend friendlyDayOfweek = case(dayofweek == 0d, \"Sun\", dayofweek == 1d, \"Mon\", dayofweek == 2d, \"Tue\", dayofweek == 3d, \"Wed\", dayofweek == 4d, \"Thu\", dayofweek == 5d, \"Fri\", \"Sat\")\n| extend Cohort = iff(cohortSize == 1d, strcat(friendlyMonthName, ' ', dayofmonth(Cohort), ' (', friendlyDayOfweek, ')'), strcat(friendlyMonthName, ' ', dayofmonth(Cohort)))\n| project-away month, friendlyMonthName, dayofweek, friendlyDayOfweek\n| order by rank asc\n| project Cohort, ['Users'] = CohortUsers, RetentionWeek, RetentionRate\n| evaluate pivot(RetentionWeek, sum(RetentionRate))", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "gridSettings": { + "formatters": [ + { + "columnMatch": "week|month|day", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Interpreting the data\nThe section below shows a row from a weekly retention report:\n" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "datatable(Cohort:string, Users:int, ['<1 week']:int, ['+1 week']:int, ['+2 week']:int, ['+3 week']:int, ['+4 week']:int, ['+5 week']:int, ['+6 week']:int)[ \r\n'April 1', 1000, 50, 30, 20, 15, 10, 7, 5,\r\n]\r\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "gridSettings": { + "formatters": [ + { + "columnMatch": "week", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "| Column | Explanation | Interpretation in the example |\n| ----- | :----- | :----- |\n| Cohort | Identifies the cohorting period. | This row explains the retention behavior of users who used your app in the week of April 1 to April 7 |\n| Users | Number of unique users who used your app in the cohorting period | 1000 unique users used your app in the week of April 1 to April 7 |\n| <1 week | Percentage of cohort users who returned to use the app between 1 and 6 days (using it again the same day does not count towards retention) | 50% or 500 users returned to use your app within the first week |\n| +1 week | Percentage of cohort users who returned to use the app between 7 and 13 days | 30% or 300 users returned to use your app a week later |\n| +N week | Percentage of cohort users who returned to use the app in the Nth week | 15% or 150 users, when N = 3 |\n\n\n\n\n" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Understanding Retention Parameters\n| Parameter | Used for |\n| ----- | ----- |\n| Retention Period | The period to use in retention calculation. Can be Daily, Weekly or Monthly |\n| Cohorts To Analyze | The number of cohorts to analyze. This corresponds to the N in N-period retention |\n| Cohorting Activities | The activities that selects a cohort of users. Example: Users who used event *Read Product Review* (cohorting activity). |\n| Retaining Activities | The activities that indicates retention of a cohorted user selected above. Example: Users who used event *Read Product Review* (cohorting activity) and returned to use *Purchase Product* (retaining activity). |\n| Cohorting/Retaining Filters | An analytics query snippet to further filter the cohorting activity. Example: *| where application_Version = '1.0'* |\n" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## What is a week for a user?\n\nThe short answer is that it is unique for each user. Our analysis treats each user's retention window seperately - giving an accurate view of their actual behavior with your app. \n\nConsider the example below of two users X and Y in the cohort of April 1-6: \n\n| User | First use of app | Weeks for user |\n| ----- | :----- | :----- |\n| X | April 3 | w1 = April 10, w2 = April 17, w3 = April 24 |\n| Y | April 5 | w1 = April 12, w2 = April 19, w3 = April 26 |\n\nEach user gets a seperate retention window. So, if both users came back on April 18, then it considered as Week 2 usage for User X but Week 1 usage for User Y. \n\nThis allows the normalization their app use over the retention window - making it seem as if all users in a cohort used the app on the same day. This allow for better analysis and comparision of user behavior." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Related Workbook Templates\n* Retention - Bracket\n* Retention - Unbounded\n* Cohort Analysis" + }, + "conditionalVisibility": null, + "halfWidth": false + } + ] +} \ No newline at end of file diff --git a/Retention/Workbooks/Retention - N Period/settings.json b/Retention/Workbooks/Retention - N Period/settings.json new file mode 100644 index 0000000..f3f6038 --- /dev/null +++ b/Retention/Workbooks/Retention - N Period/settings.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "N-Period Retention", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 200 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 200 + } + ] +} \ No newline at end of file diff --git a/Retention/Workbooks/Retention - Unbounded/Retention - Unbounded.workbook b/Retention/Workbooks/Retention - Unbounded/Retention - Unbounded.workbook new file mode 100644 index 0000000..d385804 --- /dev/null +++ b/Retention/Workbooks/Retention - Unbounded/Retention - Unbounded.workbook @@ -0,0 +1,168 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Unbounded Retention\n\nUnbounded retention shows you the percentage of users who came back on a specific day **or anytime after that day**. It is useful in cases where you want to see how many new users returning to your app after the first week." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Activity Selection\nUse these fields to set events that that correspond to interesting user activities. The `Understanding Retention Parameter` section at the bottom describes these parameters in detail." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "97ae2ae5-ec95-455b-bac2-36caf2db61db", + "version": "KqlParameterItem/1.0", + "name": "CohortingActivities", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\n| where timestamp >= ago(7d)\n| summarize count() by name\n| order by count_ desc\n| project Id=name, Title=name, Selected=false\n| union (\ndatatable(Id:string, Title:string, Selected:boolean)[\n'*', 'All Events and Page Views', true\n]\n)", + "value": [ + "*" + ] + }, + { + "name": "CohortingFilters", + "id": "94bacf68-78db-4755-8a40-c2702dea4018", + "type": 1, + "value": "" + }, + { + "id": "6cb4afed-7dac-4608-892b-154f4943ddb6", + "version": "KqlParameterItem/1.0", + "name": "RetainingActivities", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\n| where timestamp >= ago(7d)\n| summarize count() by name\n| order by count_ desc\n| project Id=name, Title=name, Selected=false\n| union (\ndatatable(Id:string, Title:string, Selected:boolean)[\n'#', 'Same as cohorting activities', true,\n'*', 'All Events and Page Views', false\n]\n)" + }, + { + "id": "0cc5211a-557e-4648-9569-1236bf16559f", + "version": "KqlParameterItem/1.0", + "name": "RetainingFilters", + "type": 1, + "isRequired": false, + "query": "datatable(x:int)[ 1 ]\r\n| extend retainingFilter = iff('#' in ({RetainingActivities}), '{CohortingFilters}', '')\r\n| project retainingFilter", + "isHiddenWhenLocked": false + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Retention Parameter\nUse these fields to customize your retention settings." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e62098ae-ac3f-4800-8e62-3e7d9a052e56", + "version": "KqlParameterItem/1.0", + "name": "RetentionPeriod", + "type": 2, + "description": "1d: Daily, 7d: Weekly, 30/28d: Monthly", + "isRequired": true, + "multiSelect": null, + "query": "datatable(id:string, text:string)[\n'1d', 'Daily',\n'7d', 'Weekly',\n'28d', 'Monthly (28 days)', \n'30d', 'Monthly (30 days)'\n]", + "value": "7d" + }, + { + "isRequired": true, + "name": "CohortsToAnalyze", + "value": "6", + "description": "Number of cohort periods to analyze", + "id": "fa4b29d9-bfc1-46e3-98f1-3cba05afbea3", + "type": 1 + }, + { + "id": "bddf64ec-8ac1-4c19-9613-11456aff1adb", + "version": "KqlParameterItem/1.0", + "name": "BasedOn", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(v:string, t:string)[ \r\n'user_Id', 'Anonymous Users', \r\n'user_AuthenticatedId', 'Authenticated Users' \r\n]", + "isHiddenWhenLocked": false, + "value": "user_Id" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let periodsToAnalyze = {CohortsToAnalyze};\r\nlet cohortSize = {RetentionPeriod};\r\nlet retainingActivities = iff('#' in ({RetainingActivities}), dynamic([{CohortingActivities}]), dynamic([{RetainingActivities}]));\r\nlet cohortUnit = case(cohortSize == 30d or cohortSize == 28d, \"month\", cohortSize == 7d, \"week\", \"day\");\r\nlet timeRange = startofday(now()) - case(cohortSize == 30d or cohortSize == 28d, startofmonth(now() - periodsToAnalyze * cohortSize), cohortSize == 7d, startofweek(now() - periodsToAnalyze * cohortSize), startofday(now() - \r\nperiodsToAnalyze * cohortSize));\r\nlet totalWeeks = toint(timeRange / cohortSize);\r\nlet cohorts = union customEvents, pageViews\r\n| where timestamp > startofday(now() - timeRange)\r\n| where name in ({CohortingActivities}) or '*' in ({CohortingActivities})\r\n{CohortingFilters}\r\n| extend Cohort = case(cohortSize == 30d or cohortSize == 28d, startofmonth(timestamp), cohortSize == 7d, startofweek(timestamp), startofday(timestamp))\r\n| summarize EarliestInCohort = min(startofday(timestamp)) by {BasedOn}, Cohort\r\n| summarize UsersInCohort = hll({BasedOn}) by EarliestInCohort, Cohort;\r\nlet users = union customEvents, pageViews\r\n| where timestamp > startofday(now() - timeRange)\r\n| where name in (retainingActivities) or '*' in (retainingActivities)\r\n{RetainingFilters}\r\n| summarize Users = hll({BasedOn}) by Day = startofday(timestamp);\r\nlet Retention = materialize(range i from 1d to timeRange step 1d\r\n| extend Day = startofday(now() - i)\r\n| extend WeeksUntilNow = toint(i / cohortSize)\r\n| extend Weeks = range(0, WeeksUntilNow, 1)\r\n| mvexpand Weeks limit 10000\r\n| extend WeeksLater = Day + toint(Weeks) * cohortSize\r\n| project-away WeeksUntilNow\r\n| extend Range = range(1d, i, 1d)\r\n| mvexpand Range limit 10000\r\n| extend RetentionDay = Day + totimespan(Range)\r\n| where RetentionDay > WeeksLater\r\n| project Day, RetentionDay, Weeks\r\n| join kind=inner\r\n(\r\n users\r\n | project UsersOnDay = Users, RetentionDay = Day\r\n) on RetentionDay\r\n| summarize ReturningUsers = hll_merge(UsersOnDay) by ForDay = Day, AfterWeek = toint(Weeks)\r\n| project ForDay, AfterWeek, ReturningUsers\r\n| join kind=inner\r\n(\r\n cohorts\r\n | project UsersInCohort, Cohort, ForDay = EarliestInCohort\r\n)\r\non ForDay\r\n| project-away ForDay1\r\n| evaluate dcount_intersect(UsersInCohort, ReturningUsers)\r\n| summarize RetainedUsers = sum(s1) by Cohort, AfterWeek\r\n);\r\ncohorts\r\n| summarize UsersInCohort = hll_merge(UsersInCohort) by Cohort\r\n| project Cohort, CohortUsers = dcount_hll(UsersInCohort) \r\n| join kind=inner (Retention) on Cohort\r\n| project-away Cohort1\r\n| extend RetentionRate = round(100.0 * RetainedUsers / CohortUsers, 2)\r\n| project-away RetainedUsers \r\n//| extend AfterWeek = AfterWeek + totalWeeks - toint((now() - Cohort) / cohortSize)\r\n| order by Cohort asc, AfterWeek asc\r\n| serialize rank = row_number()\r\n| extend AfterWeek = strcat(AfterWeek, \"-\", cohortUnit, \" +\")\r\n| extend month = monthofyear(Cohort)\r\n| extend friendlyMonthName = case(month == 1, 'January', month == 2, 'February', month == 3, 'March', month == 4, 'April', month == 5, 'May', month == 6, 'June', month == 7, 'July', month == 8, 'August', month == 9, 'September', month == 10, 'October', month == 11, 'November', 'December')\r\n| extend dayofweek = dayofweek(Cohort)\r\n| extend friendlyDayOfweek = case(dayofweek == 0d, \"Sun\", dayofweek == 1d, \"Mon\", dayofweek == 2d, \"Tue\", dayofweek == 3d, \"Wed\", dayofweek == 4d, \"Thu\", dayofweek == 5d, \"Fri\", \"Sat\")\r\n| extend Cohort = iff(cohortSize == 1d, strcat(friendlyMonthName, ' ', dayofmonth(Cohort), ' (', friendlyDayOfweek, ')'), strcat(friendlyMonthName, ' ', dayofmonth(Cohort)))\r\n| order by rank asc\r\n| project Cohort, ['Users'] = CohortUsers, AfterWeek, RetentionRate\r\n| evaluate pivot(AfterWeek, sum(RetentionRate))", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "gridSettings": { + "formatters": [ + { + "columnMatch": "week|month|day", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Understanding Retention Paramters\n| Parameter | Used for |\n| ----- | ----- |\n| Retention Period | The period to use in retention calculation. Can be Daily, Weekly or Monthly |\n| Cohorts To Analyze | The number of cohorts to analyze. This corresponds to the N in N-period retention |\n| Cohorting Activities | The activities that selects a cohort of users. Example: Users who used event *Read Product Review* (cohorting activity). |\n| Retaining Activities | The activities that indicates retention of a cohorted user selected above. Example: Users who used event *Read Product Review* (cohorting activity) and returned to use *Purchase Product* (retaining activity). |\n| Cohorting/Retaining Filters | An analytics query snippet to further filter the cohorting activity. Example: *| where application_Version = '1.0'* |\n" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Related Workbook Templates\n* Retention - N-Period\n* Retention - Bracket\n* Cohort Analysis" + }, + "conditionalVisibility": null, + "halfWidth": false + } + ] +} \ No newline at end of file diff --git a/Retention/Workbooks/Retention - Unbounded/settings.json b/Retention/Workbooks/Retention - Unbounded/settings.json new file mode 100644 index 0000000..2ba1c3d --- /dev/null +++ b/Retention/Workbooks/Retention - Unbounded/settings.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Unbounded Retention", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 300 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 300 + } + ] +} \ No newline at end of file diff --git a/Retention/Workbooks/categoryResources.json b/Retention/Workbooks/categoryResources.json new file mode 100644 index 0000000..b9d0dd3 --- /dev/null +++ b/Retention/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Retention", "description": "", "order": 500} +} \ No newline at end of file diff --git a/SapMonitor/Alerts/README b/SapMonitor/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/SapMonitor/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/SapMonitor/Queries/README b/SapMonitor/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/SapMonitor/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/SapMonitor/Workbooks/SapHanaInfrastructure/SapHanaInfrastructure.workbook b/SapMonitor/Workbooks/SapHanaInfrastructure/SapHanaInfrastructure.workbook new file mode 100644 index 0000000..ed62c41 --- /dev/null +++ b/SapMonitor/Workbooks/SapHanaInfrastructure/SapHanaInfrastructure.workbook @@ -0,0 +1,1237 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "386c5637-375e-437c-acdb-542be563ed5a", + "version": "KqlParameterItem/1.0", + "name": "testDataExist", + "type": 1, + "query": "SapHana_LoadHistory_CL\r\n| project HOST_s\r\n| take 1", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 43200000 + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "5bca0011-344c-42a3-b69d-af95eb75fea2", + "version": "KqlParameterItem/1.0", + "name": "testProviderExists", + "type": 1, + "query": "SapHana_LoadHistory_CL \r\n| extend providerExists = case( columnifexists(\"PROVIDER_INSTANCE_s\", false)==false, false, true)\r\n| limit 1\r\n| where providerExists\r\n| project providerExists", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "dummy", + "comparison": "isEqualTo", + "value": "0" + }, + "name": "testExist_Parameters" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "696da4a1-0e13-40a2-9463-202f0ea90375", + "version": "KqlParameterItem/1.0", + "name": "Provider", + "label": "Provider instance", + "type": 2, + "description": "Please select the instance of the monitoring provider", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "SapHana_LoadHistory_CL\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\n| distinct p", + "crossComponentResources": [], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "testProviderExists", + "comparison": "isNotEqualTo" + }, + "name": "Provider_Parameters" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Utilization", + "subTarget": "1", + "postText": "", + "style": "secondary" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Anomalies", + "subTarget": "2", + "style": "secondary" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Host Config", + "subTarget": "3", + "style": "secondary" + } + ] + }, + "conditionalVisibility": { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + }, + "name": "Tabs" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "8e3577a4-1f9f-4935-a2b2-c42a6911ae8a", + "version": "KqlParameterItem/1.0", + "name": "Host", + "label": "HANA host", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "\"", + "delimiter": ",", + "query": "SapHana_LoadHistory_CL\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| distinct HOST_s", + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": [ + "value::all" + ] + }, + { + "id": "8a72f4ec-ce64-49b7-88dc-d9b27de74f7a", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + } + ] + }, + "label": "Time range", + "resourceType": "microsoft.insights/components" + }, + { + "id": "fae26122-3768-43dd-ac98-9b9768924799", + "version": "KqlParameterItem/1.0", + "name": "Granularity", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"1m\", \"label\":\"1 Minute\", \"selected\":false},\r\n{ \"value\":\"5m\", \"label\":\"5 Minutes\", \"selected\":false},\r\n{ \"value\":\"15m\", \"label\":\"15 Minutes\", \"selected\":true},\r\n{ \"value\":\"30m\", \"label\":\"30 Minutes\", \"selected\":false},\r\n{ \"value\":\"1h\", \"label\":\"1 Hour\", \"selected\":false}\r\n]\r\n", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "97bd0cb4-8720-4e4c-87ff-f8156a475d44", + "version": "KqlParameterItem/1.0", + "name": "ShowForecast", + "label": "Show forecast metrics", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":0, \"label\":\"No\", \"selected\":true},\r\n { \"value\":1, \"label\":\"Yes\", \"selected\":false}\r\n]\r\n", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "Utilization_Parameters" + }, + { + "type": 1, + "content": { + "json": "⚠ Metrics ingestion is still in progress; please note that it may take up to 30 minutes for data to appear.\r\n" + }, + "conditionalVisibility": { + "parameterName": "testDataExist", + "comparison": "isEqualTo", + "value": "" + }, + "name": "Error_NoData" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST:string, ACTIVE:string,HOST_STATUS_s:string,INDEXSERVERROLE:string,NAMESERVERROLE:string)\r\n[\r\n\"N\\\\A\", \"YES\",\"OK\",\"MASTER\",\"MASTER\"\r\n];\r\nSapHana_HostConfig_CL\r\n| where TimeGenerated > ago(30d)\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| summarize arg_max(TimeGenerated, *) by HOST_s \r\n| project HOST=HOST_s , ACTIVE=HOST_ACTIVE_s , HOST_STATUS_s , INDEXSERVERROLE=INDEXSERVER_ACTUAL_ROLE_s , NAMESERVERROLE=NAMESERVER_ACTUAL_ROLE_s\r\n| union isfuzzy=true nodata | where HOST <> \"N\\\\A\" ", + "size": 0, + "title": "HANA Host Status", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Host", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "CPU", + "formatter": 18, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "redDark", + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "<", + "thresholdValue": "70", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": ">=", + "text": "{0}{1}" + }, + { + "thresholdValue": "70", + "representation": "warning", + "text": "{0}{1}" + }, + { + "operator": ">=", + "text": "{0}{1}" + }, + { + "thresholdValue": "85", + "representation": "4", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "MEM", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "<=", + "thresholdValue": "70", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": ">", + "thresholdValue": "70", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": ">=", + "thresholdValue": "85", + "representation": "critical", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Disk_Used", + "formatter": 18, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "red", + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "<=", + "thresholdValue": "70", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": ">", + "thresholdValue": "70", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": ">", + "thresholdValue": "80", + "representation": "4", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "NW_IN", + "formatter": 4, + "formatOptions": { + "palette": "orange", + "showIcon": true + } + }, + { + "columnMatch": "NW_OUT", + "formatter": 4, + "formatOptions": { + "showIcon": true + } + } + ] + }, + "tileSettings": { + "titleContent": { + "columnMatch": "HOST", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "HOST_STATUS_s", + "formatter": 18, + "formatOptions": { + "palette": "auto", + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "OK", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "WARNING", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "3", + "text": "{0}{1}" + } + ] + } + }, + "showBorder": false + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "HOST", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "Status", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "33", + "name": "HostConfig_HostStatus" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST:string, ACTIVE:string,HOST_STATUS_s:string,INDEXSERVERROLE:string,NAMESERVERROLE:string)\r\n[\r\n\"N\\\\A\", \"YES\",\"OK\",\"MASTER\",\"MASTER\"\r\n];\r\nSapHana_HostConfig_CL\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where TimeGenerated > ago(30d)\r\n| summarize arg_max(TimeGenerated, *) by HOST_s \r\n| project HOST=HOST_s , ACTIVE=HOST_ACTIVE_s , HOST_STATUS_s , INDEXSERVERROLE=INDEXSERVER_ACTUAL_ROLE_s , NAMESERVERROLE=NAMESERVER_ACTUAL_ROLE_s\r\n| union isfuzzy=true nodata | where HOST <> \"N\\\\A\" ", + "size": 0, + "title": "HANA IndexServer Role", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Host", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ] + }, + "tileSettings": { + "titleContent": { + "columnMatch": "HOST", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "INDEXSERVERROLE", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "HOST", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "Status", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "33", + "name": "HostConfig_IndexserverRole" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST:string, ACTIVE:string,HOST_STATUS_s:string,INDEXSERVERROLE:string,NAMESERVERROLE:string)\r\n[\r\n\"N\\\\A\", \"YES\",\"OK\",\"MASTER\",\"MASTER\"\r\n];\r\nSapHana_HostConfig_CL\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where TimeGenerated > ago(30d)\r\n| summarize arg_max(TimeGenerated, *) by HOST_s \r\n| project HOST=HOST_s , ACTIVE=HOST_ACTIVE_s , HOST_STATUS_s , INDEXSERVERROLE=INDEXSERVER_ACTUAL_ROLE_s , NAMESERVERROLE=NAMESERVER_ACTUAL_ROLE_s\r\n| union isfuzzy=true nodata | where HOST <> \"N\\\\A\" \r\n", + "size": 0, + "title": "HANA NameServer Role", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Host", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ] + }, + "tileSettings": { + "titleContent": { + "columnMatch": "HOST", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "NAMESERVERROLE", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": true + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "HOST", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "Status", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "3" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "3" + }, + "customWidth": "33", + "name": "HostConfig_NameserverRole" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable([\"HANA Host\"]:string, [\"CPU used (%)\"]:real,[\"Memory used (%)\"]:real,[\"Disk used (GB)\"]:real,[\"Network in (MB/s)\"]:real,[\"Network out (MB/s)\"]:real)\r\n[\r\n\"N\\\\A\", 0,0,0,0,0\r\n];\r\nSapHana_LoadHistory_CL\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where HOST_s in ({Host}) or '*' in ({Host})\r\n| summarize arg_max(TimeGenerated, *) by HOST_s\r\n| project [\"HANA Host\"]=HOST_s , [\"CPU used (%)\"]=CPU_d , [\"Memory used (%)\"]=round((MEMORY_USED_d/MEMORY_SIZE_d)*100,2),[\"Disk used (GB)\"]=DISK_USED_d , [\"Network in (MB/s)\"]=NETWORK_IN_d , [\"Network out (MB/s)\"]=NETWORK_OUT_d \r\n| union isfuzzy=true nodata | where [\"HANA Host\"] <> \"N\\\\A\" ", + "size": 4, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Host", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "CPU used (%)", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Memory used (%)", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Disk used (GB)", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Network in (MB/s)", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Network out (MB/s)", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "CPU", + "formatter": 0, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "redDark", + "showIcon": true + } + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "LoadHistory_UtilizationSummary" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST_s:string,avg_CPU_d:real)\r\n[\r\n\"N\\\\A\",0,\r\n];\r\nSapHana_LoadHistory_CL\r\n| where TimeGenerated {TimeRange}\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where HOST_s in ({Host}) or '*' in ({Host})\r\n| summarize avg(CPU_d) by HOST_s , bin(TimeGenerated, {Granularity})\r\n| union isfuzzy=true nodata |where HOST_s <> \"N\\\\A\"", + "size": 0, + "aggregation": 3, + "title": "CPU used (%)", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "chartSettings": { + "ySettings": { + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowForecast", + "comparison": "isNotEqualTo", + "value": "1" + }, + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "ShowForecast", + "comparison": "isNotEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "LoadHistory_CPUActual", + "styleSettings": { + "maxWidth": "100" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST_s:string, TimeGenerated:dynamic,avgCPU:dynamic,CPU_Forecast:dynamic)\r\n[\r\n\"N\\\\A\", \"[\\\"2019-09-01T00:00:00Z\\\",\\\"2019-09-02T00:00:00Z\\\"]\",\"[0,0,0,0]\",\"[0,0,0,0]\"\r\n];\r\nlet startDate = startofday(ago(7d)); // go back in time nn days\r\nlet endDate = now(); // what is the date now\r\nlet projectTo = now()+7d; // project forward nn days\r\nlet projectForward = 7; // must be same as projectTo value\r\nSapHana_LoadHistory_CL\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where HOST_s in ({Host}) or '*' in ({Host})\r\n|where TimeGenerated {TimeRange} //> ago(7d)\r\n| make-series avgCPU=avg(CPU_d) default=0 on TimeGenerated in range({TimeRange:start},projectTo, {TimeRange:grain}) by HOST_s\r\n| extend CPU_Forecast = series_decompose_forecast(avgCPU, projectForward*24)\r\n| union isfuzzy=true nodata |where HOST_s <> \"N\\\\A\"", + "size": 0, + "aggregation": 3, + "title": "CPU (%) - Actual vs. Forecast", + "color": "blue", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "scatterchart", + "chartSettings": { + "ySettings": { + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowForecast", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "ShowForecast", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "LoadHistory_CPUForecast", + "styleSettings": { + "maxWidth": "100" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST_s:string,avgMEM:real)\r\n[\r\n\"N\\\\A\",0,\r\n];\r\nSapHana_LoadHistory_CL\r\n| where TimeGenerated {TimeRange}\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where HOST_s in ({Host}) or '*' in ({Host})\r\n| summarize avgMEM=avg(MEMORY_USED_d/MEMORY_SIZE_d)*100 by HOST_s, bin(TimeGenerated, {Granularity})\r\n| union isfuzzy=true nodata |where HOST_s <> \"N\\\\A\"", + "size": 0, + "title": "Memory used (%)", + "color": "orange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "chartSettings": { + "ySettings": { + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowForecast", + "comparison": "isNotEqualTo", + "value": "1" + }, + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "ShowForecast", + "comparison": "isNotEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "LoadHistory_MemoryPercentageActual", + "styleSettings": { + "maxWidth": "100" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST_s:string, TimeGenerated:dynamic,avgMEM:dynamic,MEM_Forecast:dynamic)\r\n[\r\n\"N\\\\A\", \"[\\\"2019-09-01T00:00:00Z\\\",\\\"2019-09-02T00:00:00Z\\\"]\",\"[0,0,0,0]\",\"[0,0,0,0]\"\r\n];\r\nlet startDate = startofday(ago(7d)); // go back in time nn days\r\nlet endDate = now(); // what is the date now\r\nlet projectTo = now()+7d; // project forward nn days\r\nlet projectForward = 7; // must be same as projectTo value\r\nSapHana_LoadHistory_CL\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where HOST_s in ({Host}) or '*' in ({Host})\r\n|where TimeGenerated {TimeRange}\r\n| make-series avgMEM=avg(MEMORY_USED_d/MEMORY_SIZE_d)*100 default=0 on TimeGenerated in range({TimeRange:start},projectTo, {TimeRange:grain}) by HOST_s\r\n| extend MEM_Forecast = series_decompose_forecast(avgMEM, projectForward*24)\r\n| union isfuzzy=true nodata |where HOST_s <> \"N\\\\A\"", + "size": 0, + "title": "Memory (%) - Actual vs. Forecast", + "color": "orange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "scatterchart", + "chartSettings": { + "ySettings": { + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowForecast", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "ShowForecast", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "LoadHistory_MemoryPercentageForecast", + "styleSettings": { + "maxWidth": "100" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST_s:string, [\"Allocation limit\"]:real, [\"Resident memory\"]:real, [\"Memory size\"]:real, [\"Total resident memory\"]:real, [\"Memory used\"]:real)\r\n[\r\n\"N\\\\A\",0,0,0,0,0\r\n];SapHana_LoadHistory_CL\r\n| where TimeGenerated {TimeRange}\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where HOST_s in ({Host}) or '*' in ({Host})\r\n| summarize [\"Allocation limit\"]=avg(MEMORY_ALLOCATION_LIMIT_d/1024) , [\"Resident memory\"]=avg(MEMORY_RESIDENT_d/1024) , [\"Memory size\"]=avg(MEMORY_SIZE_d/1024) , [\"Total resident memory\"]=avg(MEMORY_TOTAL_RESIDENT_d/1024) , [\"Memory used\"]=avg(MEMORY_USED_d/1024) by HOST_s, bin(TimeGenerated, {Granularity})\r\n| union isfuzzy=true nodata |where HOST_s <> \"N\\\\A\"", + "size": 0, + "aggregation": 3, + "title": "Memory used (GB)", + "color": "turquoise", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "HOST_s", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "AllocationLimitGB", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "LoadHistory_MemoryGB" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST_s:string, [\"Network in\"]:real, [\"Network out\"]:real)\r\n[\r\n\"N\\\\A\",0,0\r\n];\r\nSapHana_LoadHistory_CL\r\n| where TimeGenerated {TimeRange}\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where HOST_s in ({Host}) or '*' in ({Host})\r\n|where NETWORK_IN_d >= 0 and NETWORK_OUT_d >= 0\r\n| summarize [\"Network in\"]=avg(NETWORK_IN_d), [\"Network out\"]=avg(NETWORK_OUT_d) by HOST_s, bin(TimeGenerated, {Granularity}) \r\n| union isfuzzy=true nodata |where HOST_s <> \"N\\\\A\"", + "size": 0, + "aggregation": 3, + "title": "Network In/Out (MB/s)", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "categoricalbar" + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "LoadHistory_Network" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST_s:string, avgDisk:real)\r\n[\r\n\"N\\\\A\",0\r\n];\r\nSapHana_LoadHistory_CL| where TimeGenerated {TimeRange}\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where HOST_s in ({Host}) or '*' in ({Host})\r\n| summarize avgDisk=avg(DISK_USED_d) by HOST_s , bin(TimeGenerated, {Granularity})\r\n| union isfuzzy=true nodata |where HOST_s <> \"N\\\\A\"", + "size": 0, + "title": "Disk used (GB)", + "color": "turquoise", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "chartSettings": { + "ySettings": { + "min": 0 + } + } + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowForecast", + "comparison": "isNotEqualTo", + "value": "1" + }, + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "ShowForecast", + "comparison": "isNotEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "LoadHistory_DiskActual" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST_s:string, TimeGenerated:dynamic,avgDiskUsed:dynamic,DiskUsed_Forecast:dynamic)\r\n[\r\n\"N\\\\A\", \"[\\\"2019-09-01T00:00:00Z\\\",\\\"2019-09-02T00:00:00Z\\\"]\",\"[0,0,0,0]\",\"[0,0,0,0]\"\r\n];\r\nlet startDate = startofday(ago(7d)); // go back in time nn days\r\nlet endDate = now(); // what is the date now\r\nlet projectTo = now()+7d; // project forward nn days\r\nlet projectForward = 7; // must be same as projectTo value\r\nSapHana_LoadHistory_CL\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where HOST_s in ({Host}) or '*' in ({Host})\r\n|where TimeGenerated {TimeRange}//> ago(7d)\r\n| make-series avgDiskUsed=avg(DISK_USED_d) default=0 on TimeGenerated in range({TimeRange:start},projectTo, {TimeRange:grain}) by HOST_s\r\n| extend DiskUsed_Forecast = series_decompose_forecast(avgDiskUsed, projectForward*24)\r\n| union isfuzzy=true nodata |where HOST_s <> \"N\\\\A\"", + "size": 0, + "title": "Disk (GB) - Actual vs. Forecast", + "color": "turquoise", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "scatterchart", + "chartSettings": { + "ySettings": { + "min": 0 + } + } + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowForecast", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "1" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "ShowForecast", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "LoadHistory_DiskForecast" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "4ae6453c-91b4-4ab6-a3c8-2e110279df09", + "version": "KqlParameterItem/1.0", + "name": "AnomalyDetectionRange", + "label": "Detection time period", + "type": 4, + "value": { + "durationMs": 259200000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "2" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "Anomaly_Parameters" + }, + { + "type": 1, + "content": { + "json": "Anomaly detection uses built in machine learning capabilities to find the **baseline** , **daily patterns** in CPU / Memory usage and extracts **anomalous** points. Minimum 2 days of data should be collected by SAP Monitor for cheking the daily patterns." + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "Anomaly_IntroLabel" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST_s:string, TimeGenerated:dynamic,avgCPU:dynamic,anomalies:dynamic)\r\n[\r\n\"N\\\\A\", \"[\\\"2019-09-01T00:00:00Z\\\",\\\"2019-09-02T00:00:00Z\\\"]\",\"[0,0,0,0]\",\"[0,0,0,0]\"\r\n];\r\nlet bucketsize=case(datetime_diff('day',{AnomalyDetectionRange:end},{AnomalyDetectionRange:start}) > 29 , 4h,datetime_diff('day',{AnomalyDetectionRange:end},{AnomalyDetectionRange:start}) > 6 , 1h ,30m);\r\nlet seasonalitybins=case(datetime_diff('day',{AnomalyDetectionRange:end},{AnomalyDetectionRange:start}) > 29 , 42,datetime_diff('day',{AnomalyDetectionRange:end},{AnomalyDetectionRange:start}) > 6 , 24 ,48);// for daily seasonality pattern\r\nSapHana_LoadHistory_CL\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where TimeGenerated {AnomalyDetectionRange}\r\n| make-series [\"Actual CPU (%)\"]=avg(CPU_d) default=0 on TimeGenerated in range({AnomalyDetectionRange:start},now(), bucketsize) by HOST_s\r\n| extend (flag, [\"Anomaly score\"], [\"Calculated baseline\"]) = series_decompose_anomalies([\"Actual CPU (%)\"],1.5,seasonalitybins)\r\n| project-away flag\r\n| union isfuzzy=true nodata | where HOST_s <> \"N\\\\A\"", + "size": 0, + "aggregation": 3, + "title": "CPU Anomalies", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart", + "chartSettings": { + "ySettings": { + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "2" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "Anomalies_CPU" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let nodata = datatable(HOST_s:string, TimeGenerated:dynamic,avgMEM:dynamic,anomalies:dynamic)\r\n[\r\n\"N\\\\A\", \"[\\\"2019-09-01T00:00:00Z\\\",\\\"2019-09-02T00:00:00Z\\\"]\",\"[0,0,0,0]\",\"[0,0,0,0]\"\r\n];\r\nlet bucketsize=case(datetime_diff('day',{AnomalyDetectionRange:end},{AnomalyDetectionRange:start}) > 29 , 4h,datetime_diff('day',{AnomalyDetectionRange:end},{AnomalyDetectionRange:start}) > 6 , 1h ,30m);\r\nlet seasonalitybins=case(datetime_diff('day',{AnomalyDetectionRange:end},{AnomalyDetectionRange:start}) > 29 , 42,datetime_diff('day',{AnomalyDetectionRange:end},{AnomalyDetectionRange:start}) > 6 , 24 ,48);// for daily seasonality pattern\r\nSapHana_LoadHistory_CL\r\n| extend p = columnifexists(\"PROVIDER_INSTANCE_s\", \"*\")\r\n| where p == \"*\" or p in ({Provider}) or \"*\" in ({Provider})\r\n| where TimeGenerated {AnomalyDetectionRange}\r\n| make-series [\"Actual memory (GB)\"]=avg(MEMORY_USED_d/MEMORY_SIZE_d)*100 default=0 on TimeGenerated in range({AnomalyDetectionRange:start},now(), bucketsize) by HOST_s\r\n| extend (flag, [\"Anomaly score\"], [\"Calculated baseline\"]) = series_decompose_anomalies([\"Actual memory (GB)\"],1.5,seasonalitybins)\r\n| project-away flag\r\n| union isfuzzy=true nodata | where HOST_s <> \"N\\\\A\"", + "size": 0, + "aggregation": 3, + "title": "Memory Anomalies", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart", + "chartSettings": { + "ySettings": { + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "2" + }, + { + "parameterName": "testDataExist", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "Anomalies_Memory" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/SapMonitor/Workbooks/SapHanaInfrastructure/settings.json b/SapMonitor/Workbooks/SapHanaInfrastructure/settings.json new file mode 100644 index 0000000..0c0aef7 --- /dev/null +++ b/SapMonitor/Workbooks/SapHanaInfrastructure/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "SAP HANA Infrastructure", + "author": "Microsoft", + "galleries": [{ "type": "workbook", "resourceType": "Microsoft.HanaOnAzure/sapMonitors", "order": 100 }] +} diff --git a/SapMonitor/Workbooks/categoryResources.json b/SapMonitor/Workbooks/categoryResources.json new file mode 100644 index 0000000..cdc8f1e --- /dev/null +++ b/SapMonitor/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"SAP Monitor", "description": "Provides insights on infrastructure metrics of SAP Landscapes", "order": 100} +} diff --git a/SqlDatabase/Alerts/README b/SqlDatabase/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/SqlDatabase/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/SqlDatabase/Queries/README b/SqlDatabase/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/SqlDatabase/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/SqlDatabase/Workbooks/SQL Database Metrics/SQL Database Metrics.workbook b/SqlDatabase/Workbooks/SQL Database Metrics/SQL Database Metrics.workbook new file mode 100644 index 0000000..4fb460a --- /dev/null +++ b/SqlDatabase/Workbooks/SQL Database Metrics/SQL Database Metrics.workbook @@ -0,0 +1,560 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# SQL Database Metrics" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "981ebe98-58f7-4fb1-8a85-10d6e346a8db", + "version": "KqlParameterItem/1.0", + "name": "Database", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.sql/servers/databases": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ], + "selectedAdditionalResourceOptions": [ + "value::3" + ] + }, + "value": [] + }, + { + "id": "06a766a0-2bca-4a0e-a700-bfff80767480", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 86400000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resourcegroup/resourcegroups" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### DTU Percentage" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "### Database Size Percentage" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T21:23:17.376Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--dtu_consumption_percent", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T21:23:17.389Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--storage_percent", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "[Database Transaction Units or DTUs](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-service-tiers#what-are-database-transaction-units-dtus) are a bundled measure of compute, storage, and IO resources. When your workload exceeds the amount of any of these resources, your throughput is throttled - resulting in slower performance and timeouts. *DTU Percentage* is the ratio of DTU used to the alloted quota. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Database size percentage* is the ratio of the currently used storage to the alloted quota." + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "### CPU Percentage" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "### DATA IO Percentage" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T21:23:17.414Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--cpu_percent", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T21:23:17.431Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--physical_data_read_percent", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*CPU percentage* is the ratio of CPU used to the alloted quota." + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Data IO percentage* is the ratio of Data IO used to the alloted quota." + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "### Log IO Percentage" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T21:23:17.458Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--log_write_percent", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Log IO percentage* of Log IO used to the alloted quota" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "### Sessions Percentage" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "### Successful Connections" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T21:23:17.498Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--sessions_percent", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T21:23:17.506Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--connection_successful", + "aggregation": 1, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "Average sessions percentage." + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "Total number of successful connections." + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "### Failed Connections" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "### Blocked By Firewall" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T21:23:17.526Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--connection_failed", + "aggregation": 1, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T21:23:17.608Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--blocked_by_firewall", + "aggregation": 1, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "Total number of failed connections." + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "Total number of requests blocked by firewall." + }, + "conditionalVisibility": null, + "halfWidth": true + } + ] +} \ No newline at end of file diff --git a/SqlDatabase/Workbooks/SQL Database Metrics/settings.json b/SqlDatabase/Workbooks/SQL Database Metrics/settings.json new file mode 100644 index 0000000..d13611e --- /dev/null +++ b/SqlDatabase/Workbooks/SQL Database Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"SQL Database Metrics", + "author": "Microsoft", + "galleries": [ + { "type": "performance-sqlserverdatabases", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 100 }, + { "type": "failure-sqlserverdatabases", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 100 } + ] +} \ No newline at end of file diff --git a/SqlDatabase/Workbooks/SQL Database Resource Limits/SQL Database Resource Limits.workbook b/SqlDatabase/Workbooks/SQL Database Resource Limits/SQL Database Resource Limits.workbook new file mode 100644 index 0000000..c8a2509 --- /dev/null +++ b/SqlDatabase/Workbooks/SQL Database Resource Limits/SQL Database Resource Limits.workbook @@ -0,0 +1,398 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# SQL Database Resource Limits" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "981ebe98-58f7-4fb1-8a85-10d6e346a8db", + "version": "KqlParameterItem/1.0", + "name": "Database", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.sql/servers/databases": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ], + "selectedAdditionalResourceOptions": [ + "value::3" + ] + }, + "value": [] + }, + { + "id": "06a766a0-2bca-4a0e-a700-bfff80767480", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 86400000, + "createdTime": "2018-07-12T23:27:16.832Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resourcegroup/resourcegroups" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Compute\nWhen database compute utilization (measured by DTUs and eDTUs, or vCores) becomes high, query latency increases and can even time out. Under these conditions, queries may be queued by the service and are provided resources for execution as resource become free. " + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### DTU Percentage" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "### CPU Percentage" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T22:01:30.731Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--dtu_consumption_percent", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T22:01:30.739Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--cpu_percent", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "When encountering high compute utilization, mitigation options include:\n\n* Increasing the performance level of the database or elastic pool to provide the database with more compute resources. See [Scale single database resources](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-single-database-scale) and [Scale elastic pool resources](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-elastic-pool-scale).\n* Optimizing queries to reduce the resource utilization of each query. For more information, see [Query Tuning/Hinting](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-performance-guidance#query-tuning-and-hinting)." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Storage\nWhen database space used reaches the max size limit, database inserts and updates that increase the data size fail and clients receive an [error message](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-develop-error-messages). Database SELECTS and DELETES continue to succeed." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### Database Size Percentage" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "### Total Database Size" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T22:01:30.771Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--storage_percent", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T22:01:30.779Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--storage", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "When encountering high space utilization, mitigation options include:\n\n* Increasing the max size of the database or elastic pool, or add more storage. See [Scale single database resources](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-single-database-scale) and [Scale elastic pool resources](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-elastic-pool-scale).\n* If the database is in an elastic pool, then alternatively the database can be moved outside of the pool so that its storage space is not shared with other databases." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Sessions and workers\nThe maximum number of sessions and workers are determined by the service tier and performance level (DTUs and eDTUs). New requests are rejected when session or worker limits are reached, and clients receive an error message. While the number of connections available can be controlled by the application, the number of concurrent workers is often harder to estimate and control. This is especially true during peak load periods when database resource limits are reached and workers pile up due to longer running queries." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### Sessions Percentage" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "### Workers Percentage" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T22:01:30.807Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--sessions_percent", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbook459ff374-8839-49fb-9d33-faa8570ac2f3", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-17T22:01:30.818Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "Database", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases--workers_percent", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "When encountering high session or worker utilization, mitigation options include:\n* Increasing the service tier or performance level of the database or elastic pool. See [Scale single database resources](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-single-database-scale) and [Scale elastic pool resources](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-elastic-pool-scale).\n* Optimizing queries to reduce the resource utilization of each query if the cause of increased worker utilization is due to contention for compute resources. For more information, see [Query Tuning/Hinting](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-performance-guidance#query-tuning-and-hinting)." + }, + "conditionalVisibility": null, + "halfWidth": false + } + ] +} \ No newline at end of file diff --git a/SqlDatabase/Workbooks/SQL Database Resource Limits/settings.json b/SqlDatabase/Workbooks/SQL Database Resource Limits/settings.json new file mode 100644 index 0000000..00c64b6 --- /dev/null +++ b/SqlDatabase/Workbooks/SQL Database Resource Limits/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"SQL Database Resource Limits", + "author": "Microsoft", + "galleries": [ + { "type": "failure-sqlserverdatabases", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 } + ] +} \ No newline at end of file diff --git a/SqlDatabase/Workbooks/categoryResources.json b/SqlDatabase/Workbooks/categoryResources.json new file mode 100644 index 0000000..4bc2d62 --- /dev/null +++ b/SqlDatabase/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Investigate", "description": "Look for common issues with your databases", "order": 200} +} \ No newline at end of file diff --git a/Storage-Failure-Investigations/Alerts/README b/Storage-Failure-Investigations/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Storage-Failure-Investigations/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Storage-Failure-Investigations/Queries/README b/Storage-Failure-Investigations/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Storage-Failure-Investigations/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Storage-Failure-Investigations/Workbooks/Transaction Failures/Transaction Failures.workbook b/Storage-Failure-Investigations/Workbooks/Transaction Failures/Transaction Failures.workbook new file mode 100644 index 0000000..a2b5f4a --- /dev/null +++ b/Storage-Failure-Investigations/Workbooks/Transaction Failures/Transaction Failures.workbook @@ -0,0 +1,229 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Investigating Transaction Failures" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "34ea9bf4-837f-48e4-b3fd-ade518019950", + "version": "KqlParameterItem/1.0", + "name": "StorageAccount", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": null, + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::1" + ], + "selectedAdditionalResourceOptions": [ + "value::1" + ] + }, + "value": [ + "value::1" + ] + }, + { + "id": "031e0cf8-ad0d-4328-8a4e-cec21dd90dc8", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-06-26T21:41:37.864Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-06-26T21:41:37.864Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-06-26T21:41:37.866Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-06-26T21:41:37.866Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resourcegroup/resourcegroups" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Transactions by Response Type" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 86400000, + "endTime": null, + "createdTime": "2018-07-12T23:05:28.336Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccount", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Transactions", + "aggregation": 1, + "chartType": 2, + "splitBy": "ResponseType", + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "*Transactions* - the number of requests made to a storage service. This number includes successful and failed requests, as well as requests that produced errors. \n\n*Response type* - the transaction response type. The available values include: \n\n* __ServerOtherError__: All other server-side errors except described ones\n* __ServerBusyError__: Authenticated request that returned an HTTP 503 status code.\n* __ServerTimeoutError__: Timed-out authenticated request that returned an HTTP 500 status code. The timeout occurred due to a server error.\n* __AuthorizationError__: Authenticated request that failed due to unauthorized access of data or an authorization failure.\n* __NetworkError__: Authenticated request that failed due to network errors. Most commonly occurs when a client prematurely closes a connection before timeout expiration.\n* __ClientThrottlingError__: Client-side throttling error.\n* __ClientTimeoutError__: Timed-out authenticated request that returned an HTTP 500 status code. If the client's network timeout or the request timeout is set to a lower value than expected by the storage service, it is an expected timeout. Otherwise, it is reported as a ServerTimeoutError.\n* __ClientOtherError__: All other client-side errors except described ones.\n* __Success__: Successful request\n\nThe following resources are useful for understanding storage-related status and error codes:\n\n* [Common REST API Error Codes](https://docs.microsoft.com/en-us/rest/api/storageservices/Common-REST-API-Error-Codes?redirectedfrom=MSDN).\n* [Blob Service Error Codes](https://docs.microsoft.com/en-us/rest/api/storageservices/Blob-Service-Error-Codes?redirectedfrom=MSDN).\n* [Queue Service Error Codes](https://docs.microsoft.com/en-us/rest/api/storageservices/Queue-Service-Error-Codes?redirectedfrom=MSDN).\n* [Table Service Error Codes](https://docs.microsoft.com/en-us/rest/api/storageservices/Table-Service-Error-Codes?redirectedfrom=MSDN).\n* [File Service Error Codes](https://docs.microsoft.com/en-us/rest/api/storageservices/File-Service-Error-Codes?redirectedfrom=MSDN).\n\n\n" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Common Issues" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### The client is receiving HTTP 403 (Forbidden) messages\nIf your client application is throwing HTTP 403 (Forbidden) errors, a likely cause is that the client is using an expired Shared Access Signature (SAS) when it sends a storage request (although other possible causes include clock skew, invalid keys, and empty headers). If an expired SAS key is the cause, you will not see any entries in the server-side Storage Logging log data.\n\nIf the issue is related to SAS tokens, you should investigate why the SAS token is expiring before the client sends the token to the server:\n* Typically, you should not set a start time when you create a SAS for a client to use immediately. If there are small clock differences between the host generating the SAS using the current time and the storage service, then it is possible for the storage service to receive a SAS that is not yet valid.\n* Do not set a very short expiry time on a SAS. Again, small clock differences between the host generating the SAS and the storage service can lead to a SAS apparently expiring earlier than anticipated.\n* Does the version parameter in the SAS key (for example sv=2015-04-05) match the version of the Storage Client Library you are using? We recommend that you always use the latest version of the Storage Client Library.\n* If you regenerate your storage access keys, any existing SAS tokens may be invalidated. This issue may arise if you generate SAS tokens with a long expiry time for client applications to cache.\n* If you are using the Storage Client Library to generate SAS tokens, then it is easy to build a valid token. However, if you are using the Storage REST API and constructing the SAS tokens by hand, see Delegating Access with a Shared Access Signature." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### The client is receiving HTTP 404 (Not found) messages\nIf the client application receives an HTTP 404 (Not found) message from the server, this implies that the object the client was attempting to use (such as an entity, table, blob, container, or queue) does not exist in the storage service. There are a number of possible reasons for this, such as:\n\n* [The client or another process previously deleted the object](https://docs.microsoft.com/en-us/azure/storage/common/storage-monitoring-diagnosing-troubleshooting?toc=%2fazure%2fstorage%2fqueues%2ftoc.json#client-previously-deleted-the-object)\n* [A Shared Access Signature (SAS) authorization issue](https://docs.microsoft.com/en-us/azure/storage/common/storage-monitoring-diagnosing-troubleshooting?toc=%2fazure%2fstorage%2fqueues%2ftoc.json#SAS-authorization-issue)\n* [Client-side JavaScript code does not have permission to access the object](https://docs.microsoft.com/en-us/azure/storage/common/storage-monitoring-diagnosing-troubleshooting?toc=%2fazure%2fstorage%2fqueues%2ftoc.json#JavaScript-code-does-not-have-permission)\n* [Network failure](https://docs.microsoft.com/en-us/azure/storage/common/storage-monitoring-diagnosing-troubleshooting?toc=%2fazure%2fstorage%2fqueues%2ftoc.json#network-failure)" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### The client is receiving HTTP 409 (Conflict) messages\nThe common cause of this error is a client application deleting and then immediately recreating a storage unit using the same name. When a client deletes blob containers, tables, or queues there is a brief period before the name becomes available again.\n\nThe client application should use unique container names whenever it creates new containers if the delete/recreate pattern is common." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### Troubleshooting guidence\nMore information to diagnose and solves issues can be found in this [document](https://docs.microsoft.com/en-us/azure/storage/common/storage-monitoring-diagnosing-troubleshooting?toc=%2fazure%2fstorage%2fqueues%2ftoc.json#troubleshooting-guidance)" + }, + "conditionalVisibility": null, + "halfWidth": false + } + ] +} \ No newline at end of file diff --git a/Storage-Failure-Investigations/Workbooks/Transaction Failures/settings.json b/Storage-Failure-Investigations/Workbooks/Transaction Failures/settings.json new file mode 100644 index 0000000..f634cf8 --- /dev/null +++ b/Storage-Failure-Investigations/Workbooks/Transaction Failures/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Transaction Failures", + "author": "Microsoft", + "galleries": [{ "type": "failure-storage", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 100 }] +} \ No newline at end of file diff --git a/Storage-Failure-Investigations/Workbooks/categoryResources.json b/Storage-Failure-Investigations/Workbooks/categoryResources.json new file mode 100644 index 0000000..4b82b9d --- /dev/null +++ b/Storage-Failure-Investigations/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Investigate", "description": "", "order": 200} +} \ No newline at end of file diff --git a/Storage-Performance/Alerts/README b/Storage-Performance/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Storage-Performance/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Storage-Performance/Queries/README b/Storage-Performance/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Storage-Performance/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Blob Storage Classic Metrics/Blob Storage Classic Metrics.workbook b/Storage-Performance/Workbooks/Blob Storage Classic Metrics/Blob Storage Classic Metrics.workbook new file mode 100644 index 0000000..3a76228 --- /dev/null +++ b/Storage-Performance/Workbooks/Blob Storage Classic Metrics/Blob Storage Classic Metrics.workbook @@ -0,0 +1,528 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Blob Storage (Classic) Metrics" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "99846120-1f35-44fc-ad8a-6f69f7261a62", + "version": "KqlParameterItem/1.0", + "name": "StorageResources", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.classicstorage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + }, + "value": [ + "value::3" + ] + }, + { + "id": "1ef46e50-5030-43fe-8c94-7e0564f4ae5f", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ] + } + } + ], + "resourceType": "microsoft.resources/resourcegroups" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Object Count" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Capacity" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T18:37:23.963Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/blob", + "metric": "microsoft.classicstorage/services/blob--ObjectCount", + "aggregation": 8, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T18:37:23.973Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/blob", + "metric": "microsoft.classicstorage/services/blob--Capacity", + "aggregation": 8, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Object count* is the number of committed and uncommitted blobs in the storage account’s Blob service." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Capacity* is the amount of storage used by the storage account’s Blob service, in bytes." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Total Requests" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Availability" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T18:37:23.990Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/blob", + "metric": "microsoft.classicstorage/services/blob--TotalRequests", + "aggregation": 1, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T18:37:24.001Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/blob", + "metric": "microsoft.classicstorage/services/blob--Availability", + "aggregation": 4, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Total Requests* is the number of requests made to a storage service or the specified API operation. This number includes successful and failed requests, as well as requests which produced errors." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Availability* is the percentage of availability for the storage service or the specified API operation. Availability is calculated by taking the TotalBillableRequests value and dividing it by the number of applicable requests, including those that produced unexpected errors. All unexpected errors result in reduced availability for the storage service or the specified API operation. " + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Total Ingress" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Total Egress" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T18:37:24.054Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/blob", + "metric": "microsoft.classicstorage/services/blob--TotalIngress", + "aggregation": 1, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T18:37:24.062Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/blob", + "metric": "microsoft.classicstorage/services/blob--TotalEgress", + "aggregation": 1, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Total ingress* is the amount of ingress data, in bytes. This number includes ingress from an external client into Azure Storage as well as ingress within Azure." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Total egress* is the amount of egress data, in bytes. This number includes egress from an external client into Azure Storage as well as egress within Azure. As a result, this number does not reflect billable egress." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Average E2E Latency" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Average Server Latency" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T18:37:24.020Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/blob", + "metric": "microsoft.classicstorage/services/blob--AverageE2ELatency", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T18:37:24.028Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/blob", + "metric": "microsoft.classicstorage/services/blob--AverageServerLatency", + "aggregation": 4, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Average E2E latency* is the average end-to-end latency of successful requests made to a storage service or the specified API operation, in milliseconds. This value includes the required processing time within Azure Storage to read the request, send the response, and receive acknowledgment of the response." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Average server latency* is the average latency used by Azure Storage to process a successful request, in milliseconds. This value does not include the network latency specified in AverageE2ELatency." + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Blob Storage Classic Metrics/settings.json b/Storage-Performance/Workbooks/Blob Storage Classic Metrics/settings.json new file mode 100644 index 0000000..76f6cc0 --- /dev/null +++ b/Storage-Performance/Workbooks/Blob Storage Classic Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Blobs", + "author": "Microsoft", + "galleries": [ + { "type": "performance-storageclassic", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 }, + { "type": "failure-storageclassic", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Blob Storage Metrics/Blob Storage Metrics.workbook b/Storage-Performance/Workbooks/Blob Storage Metrics/Blob Storage Metrics.workbook new file mode 100644 index 0000000..0ddeb83 --- /dev/null +++ b/Storage-Performance/Workbooks/Blob Storage Metrics/Blob Storage Metrics.workbook @@ -0,0 +1,558 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Blob Storage Metrics" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "34ea9bf4-837f-48e4-b3fd-ade518019950", + "version": "KqlParameterItem/1.0", + "name": "StorageResources", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::3" + ], + "selectedAdditionalResourceOptions": [ + "value::3" + ] + }, + "value": [] + }, + { + "id": "031e0cf8-ad0d-4328-8a4e-cec21dd90dc8", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-06-26T21:41:37.864Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-06-26T21:41:37.864Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-06-26T21:41:37.866Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-06-26T21:41:37.866Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resourcegroup/resourcegroups" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Blob Count" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Blob Capacity" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:41:27.123Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCount", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:41:27.133Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Blob count* - the number of blob objects stored in the storage account. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Blob capacity* - the total of Blob storage used in the storage account. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Transactions" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Availability" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:41:27.157Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-Transactions", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:41:27.181Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-Availability", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Transactions* - the number of requests made to the storage service or the specified API operation. This number includes successful and failed requests, as well as requests that produced errors. \n" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Availability* - the percentage of availability for the storage service or the specified API operation. Availability is calculated by taking the total billable requests value and dividing it by the number of applicable requests, including those requests that produced unexpected errors. All unexpected errors result in reduced availability for the storage service or the specified API operation. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Ingress" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Egress" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:41:27.203Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-Ingress", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:41:27.214Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-Egress", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Ingress* - the amount of ingress data. This number includes ingress from an external client into Azure Storage as well as ingress within Azure. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Egress* - the amount of egress data. This number includes egress from an external client into Azure Storage as well as egress within Azure. As a result, this number does not reflect billable egress. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Success E2E Latency" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Success Server Latency" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:41:27.244Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-SuccessE2ELatency", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:41:27.251Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Transaction-SuccessServerLatency", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "*Success E2E Latency* - the average end-to-end latency of successful requests made to a storage service or the specified API operation. This value includes the required processing time within Azure Storage to read the request, send the response, and receive acknowledgment of the response. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Success Server Latency* - the average time used to process a successful request by Azure Storage. This value does not include the network latency specified in SuccessE2ELatency. " + }, + "conditionalVisibility": null, + "halfWidth": true + } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Blob Storage Metrics/settings.json b/Storage-Performance/Workbooks/Blob Storage Metrics/settings.json new file mode 100644 index 0000000..3d403ff --- /dev/null +++ b/Storage-Performance/Workbooks/Blob Storage Metrics/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Blobs", + "author": "Microsoft", + "galleries": [{ "type": "performance-storage", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 }] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/File Storage Classic Metrics/File Storage Classic Metrics.workbook b/Storage-Performance/Workbooks/File Storage Classic Metrics/File Storage Classic Metrics.workbook new file mode 100644 index 0000000..64f015c --- /dev/null +++ b/Storage-Performance/Workbooks/File Storage Classic Metrics/File Storage Classic Metrics.workbook @@ -0,0 +1,428 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# File Storage (Classic) Metrics" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "99846120-1f35-44fc-ad8a-6f69f7261a62", + "version": "KqlParameterItem/1.0", + "name": "StorageResources", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + "value::3" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.classicstorage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + } + }, + { + "id": "1ef46e50-5030-43fe-8c94-7e0564f4ae5f", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ] + } + } + ], + "resourceType": "microsoft.resources/resourcegroups" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Total Requests" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Availability" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-24T20:30:21.032Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/file", + "metric": "microsoft.classicstorage/services/file--TotalRequests", + "aggregation": 1, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-24T20:30:21.041Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/file", + "metric": "microsoft.classicstorage/services/file--Availability", + "aggregation": 4, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Total Requests* is the number of requests made to a storage service or the specified API operation. This number includes successful and failed requests, as well as requests which produced errors." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Availability* is the percentage of availability for the storage service or the specified API operation. Availability is calculated by taking the TotalBillableRequests value and dividing it by the number of applicable requests, including those that produced unexpected errors. All unexpected errors result in reduced availability for the storage service or the specified API operation. " + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Total Ingress" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Total Egress" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-24T20:30:21.059Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/file", + "metric": "microsoft.classicstorage/services/file--TotalIngress", + "aggregation": 1, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-24T20:30:21.070Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/file", + "metric": "microsoft.classicstorage/services/file--TotalEgress", + "aggregation": 1, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Total ingress* is the amount of ingress data, in bytes. This number includes ingress from an external client into Azure Storage as well as ingress within Azure." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Total egress* is the amount of egress data, in bytes. This number includes egress from an external client into Azure Storage as well as egress within Azure. As a result, this number does not reflect billable egress." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Average E2E Latency" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Average Server Latency" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-24T20:30:21.085Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/file", + "metric": "microsoft.classicstorage/services/file--AverageE2ELatency", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-24T20:30:21.091Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/file", + "metric": "microsoft.classicstorage/services/file--AverageServerLatency", + "aggregation": 4, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Average E2E latency* is the average end-to-end latency of successful requests made to a storage service or the specified API operation, in milliseconds. This value includes the required processing time within Azure Storage to read the request, send the response, and receive acknowledgment of the response." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Average server latency* is the average latency used by Azure Storage to process a successful request, in milliseconds. This value does not include the network latency specified in AverageE2ELatency." + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/File Storage Classic Metrics/settings.json b/Storage-Performance/Workbooks/File Storage Classic Metrics/settings.json new file mode 100644 index 0000000..13947b2 --- /dev/null +++ b/Storage-Performance/Workbooks/File Storage Classic Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Files", + "author": "Microsoft", + "galleries": [ + { "type": "performance-storageclassic", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 }, + { "type": "failure-storageclassic", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/File Storage Metrics/File Storage Metrics.workbook b/Storage-Performance/Workbooks/File Storage Metrics/File Storage Metrics.workbook new file mode 100644 index 0000000..80a4643 --- /dev/null +++ b/Storage-Performance/Workbooks/File Storage Metrics/File Storage Metrics.workbook @@ -0,0 +1,556 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# File Storage Metrics" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "34ea9bf4-837f-48e4-b3fd-ade518019950", + "version": "KqlParameterItem/1.0", + "name": "StorageResources", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::3" + ], + "selectedAdditionalResourceOptions": [ + "value::3" + ] + }, + "value": [] + }, + { + "id": "031e0cf8-ad0d-4328-8a4e-cec21dd90dc8", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-06-26T21:41:37.864Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-06-26T21:41:37.864Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-06-26T21:41:37.866Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-06-26T21:41:37.866Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resourcegroup/resourcegroups" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## File Count" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## File Capacity" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:51:19.915Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCount", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:51:19.927Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*File count* - the number of files in the storage account. \n" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*File capacity* - the amount of File storage used by the storage account. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Transactions" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Availability" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:51:20.011Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-Transactions", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:51:20.160Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-Availability", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Transactions* - the number of requests made to the storage service or the specified API operation. This number includes successful and failed requests, as well as requests that produced errors. \n" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Availability* - the percentage of availability for the storage service or the specified API operation. Availability is calculated by taking the total billable requests value and dividing it by the number of applicable requests, including those requests that produced unexpected errors. All unexpected errors result in reduced availability for the storage service or the specified API operation. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Ingress" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Egress" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:51:20.184Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-Ingress", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:51:20.192Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-Egress", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Ingress* - the amount of ingress data. This number includes ingress from an external client into Azure Storage as well as ingress within Azure. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Egress* - the amount of egress data. This number includes egress from an external client into Azure Storage as well as egress within Azure. As a result, this number does not reflect billable egress. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Success E2E Latency" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Success Server Latency" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:51:20.219Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-SuccessE2ELatency", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:51:20.227Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Transaction-SuccessServerLatency", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "*Success E2E Latency* - the average end-to-end latency of successful requests made to a storage service or the specified API operation. This value includes the required processing time within Azure Storage to read the request, send the response, and receive acknowledgment of the response. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Success Server Latency* - the average time used to process a successful request by Azure Storage. This value does not include the network latency specified in SuccessE2ELatency. " + }, + "conditionalVisibility": null, + "halfWidth": true + } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/File Storage Metrics/settings.json b/Storage-Performance/Workbooks/File Storage Metrics/settings.json new file mode 100644 index 0000000..9aa400e --- /dev/null +++ b/Storage-Performance/Workbooks/File Storage Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Files", + "author": "Microsoft", + "galleries": [ + { "type": "performance-storage", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 400 }, + { "type": "failure-storage", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 400 } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Queue Storage Classic Metrics/Queue Storage Classic Metrics.workbook b/Storage-Performance/Workbooks/Queue Storage Classic Metrics/Queue Storage Classic Metrics.workbook new file mode 100644 index 0000000..e3048f7 --- /dev/null +++ b/Storage-Performance/Workbooks/Queue Storage Classic Metrics/Queue Storage Classic Metrics.workbook @@ -0,0 +1,428 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Queue Storage (Classic) Metrics" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "99846120-1f35-44fc-ad8a-6f69f7261a62", + "version": "KqlParameterItem/1.0", + "name": "StorageResources", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.classicstorage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + }, + "value": [ + "value::3" + ] + }, + { + "id": "1ef46e50-5030-43fe-8c94-7e0564f4ae5f", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ] + } + } + ], + "resourceType": "microsoft.resources/resourcegroups" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Total Requests" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Availability" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-24T20:38:26.811Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/queue", + "metric": "microsoft.classicstorage/services/queue--TotalRequests", + "aggregation": 1, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-24T20:38:26.820Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/queue", + "metric": "microsoft.classicstorage/services/queue--Availability", + "aggregation": 4, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Total Requests* is the number of requests made to a storage service or the specified API operation. This number includes successful and failed requests, as well as requests which produced errors." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Availability* is the percentage of availability for the storage service or the specified API operation. Availability is calculated by taking the TotalBillableRequests value and dividing it by the number of applicable requests, including those that produced unexpected errors. All unexpected errors result in reduced availability for the storage service or the specified API operation. " + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Total Ingress" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Total Egress" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-24T20:38:26.839Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/queue", + "metric": "microsoft.classicstorage/services/queue--TotalIngress", + "aggregation": 1, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-24T20:38:26.846Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/queue", + "metric": "microsoft.classicstorage/services/queue--TotalEgress", + "aggregation": 1, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Total ingress* is the amount of ingress data, in bytes. This number includes ingress from an external client into Azure Storage as well as ingress within Azure." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Total egress* is the amount of egress data, in bytes. This number includes egress from an external client into Azure Storage as well as egress within Azure. As a result, this number does not reflect billable egress." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Average E2E Latency" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Average Server Latency" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-24T20:38:26.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/queue", + "metric": "microsoft.classicstorage/services/queue--AverageE2ELatency", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-24T20:38:26.872Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/queue", + "metric": "microsoft.classicstorage/services/queue--AverageServerLatency", + "aggregation": 4, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Average E2E latency* is the average end-to-end latency of successful requests made to a storage service or the specified API operation, in milliseconds. This value includes the required processing time within Azure Storage to read the request, send the response, and receive acknowledgment of the response." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Average server latency* is the average latency used by Azure Storage to process a successful request, in milliseconds. This value does not include the network latency specified in AverageE2ELatency." + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Queue Storage Classic Metrics/settings.json b/Storage-Performance/Workbooks/Queue Storage Classic Metrics/settings.json new file mode 100644 index 0000000..d3da5e0 --- /dev/null +++ b/Storage-Performance/Workbooks/Queue Storage Classic Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Queues", + "author": "Microsoft", + "galleries": [ + { "type": "performance-storageclassic", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 }, + { "type": "failure-storageclassic", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Queue Storage Metrics/Queue Storage Metrics.workbook b/Storage-Performance/Workbooks/Queue Storage Metrics/Queue Storage Metrics.workbook new file mode 100644 index 0000000..8d493d5 --- /dev/null +++ b/Storage-Performance/Workbooks/Queue Storage Metrics/Queue Storage Metrics.workbook @@ -0,0 +1,556 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Query Storage Metrics" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "34ea9bf4-837f-48e4-b3fd-ade518019950", + "version": "KqlParameterItem/1.0", + "name": "StorageResources", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::3" + ], + "selectedAdditionalResourceOptions": [ + "value::3" + ] + }, + "value": [] + }, + { + "id": "031e0cf8-ad0d-4328-8a4e-cec21dd90dc8", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-06-26T21:41:37.864Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-06-26T21:41:37.864Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-06-26T21:41:37.866Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-06-26T21:41:37.866Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resourcegroup/resourcegroups" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Queue Count" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Queue Capacity" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:56:31.905Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCount", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:56:31.918Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Queue count* - the number of queues in the storage account. \n" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Queue capacity* - The amount of Queue storage used by the storage account. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Transactions" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Availability" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:56:31.950Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-Transactions", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:56:31.960Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-Availability", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Transactions* - the number of requests made to the storage service or the specified API operation. This number includes successful and failed requests, as well as requests that produced errors. \n" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Availability* - the percentage of availability for the storage service or the specified API operation. Availability is calculated by taking the total billable requests value and dividing it by the number of applicable requests, including those requests that produced unexpected errors. All unexpected errors result in reduced availability for the storage service or the specified API operation. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Ingress" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Egress" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:56:32.015Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-Ingress", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:56:32.049Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-Availability", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Ingress* - the amount of ingress data. This number includes ingress from an external client into Azure Storage as well as ingress within Azure. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Egress* - the amount of egress data. This number includes egress from an external client into Azure Storage as well as egress within Azure. As a result, this number does not reflect billable egress. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Success E2E Latency" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Success Server Latency" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:56:32.214Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-SuccessE2ELatency", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:56:32.234Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Transaction-SuccessServerLatency", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "*Success E2E Latency* - the average end-to-end latency of successful requests made to a storage service or the specified API operation. This value includes the required processing time within Azure Storage to read the request, send the response, and receive acknowledgment of the response. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Success Server Latency* - the average time used to process a successful request by Azure Storage. This value does not include the network latency specified in SuccessE2ELatency. " + }, + "conditionalVisibility": null, + "halfWidth": true + } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Queue Storage Metrics/settings.json b/Storage-Performance/Workbooks/Queue Storage Metrics/settings.json new file mode 100644 index 0000000..ec186fe --- /dev/null +++ b/Storage-Performance/Workbooks/Queue Storage Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Queues", + "author": "Microsoft", + "galleries": [ + { "type": "performance-storage", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 500 }, + { "type": "failure-storage", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 500 } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Storage Account Metrics/Storage Account Metrics.workbook b/Storage-Performance/Workbooks/Storage Account Metrics/Storage Account Metrics.workbook new file mode 100644 index 0000000..782246c --- /dev/null +++ b/Storage-Performance/Workbooks/Storage Account Metrics/Storage Account Metrics.workbook @@ -0,0 +1,526 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Storage Account Metrics" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "34ea9bf4-837f-48e4-b3fd-ade518019950", + "version": "KqlParameterItem/1.0", + "name": "StorageResources", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::3" + ], + "selectedAdditionalResourceOptions": [ + "value::3" + ] + }, + "value": [] + }, + { + "id": "031e0cf8-ad0d-4328-8a4e-cec21dd90dc8", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-06-26T21:41:37.864Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-06-26T21:41:37.864Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-06-26T21:41:37.866Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-06-26T21:41:37.866Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resourcegroup/resourcegroups" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Used Capacity" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:33:56.492Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Capacity-UsedCapacity", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Used capacity* - the amount of storage used by the storage account. For standard storage accounts, it's the sum of capacity used by blob, table, file, and queue. For premium storage accounts and Blob storage accounts, it is the same as BlobCapacity. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Transactions" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Availability" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:33:56.518Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Transactions", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:33:56.532Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Availability", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Transactions* - the number of requests made to the storage service. This number includes successful and failed requests, as well as requests that produced errors. \n" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Availability* - the percentage of availability for the storage service. Availability is calculated by taking the total billable requests value and dividing it by the number of applicable requests, including those requests that produced unexpected errors. All unexpected errors result in reduced availability for the storage service or the specified API operation. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Ingress" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Egress" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:33:56.550Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Ingress", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:33:56.561Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Egress", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Ingress* - the amount of ingress data. This number includes ingress from an external client into Azure Storage as well as ingress within Azure. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Egress* - the amount of egress data. This number includes egress from an external client into Azure Storage as well as egress within Azure. As a result, this number does not reflect billable egress. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Success E2E Latency" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Success Server Latency" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:33:56.578Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:33:56.589Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-SuccessServerLatency", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "*Success E2E Latency* - the average end-to-end latency of successful requests made to a storage service or the specified API operation. This value includes the required processing time within Azure Storage to read the request, send the response, and receive acknowledgment of the response. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Success Server Latency* - the average time used to process a successful request by Azure Storage. This value does not include the network latency specified in SuccessE2ELatency. " + }, + "conditionalVisibility": null, + "halfWidth": true + } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Storage Account Metrics/settings.json b/Storage-Performance/Workbooks/Storage Account Metrics/settings.json new file mode 100644 index 0000000..e750269 --- /dev/null +++ b/Storage-Performance/Workbooks/Storage Account Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Accounts", + "author": "Microsoft", + "galleries": [ + { "type": "performance-storage", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 100 }, + { "type": "failure-storage", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 100 } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Table Storage Classic Metrics/Table Storage Classic Metrics.workbook b/Storage-Performance/Workbooks/Table Storage Classic Metrics/Table Storage Classic Metrics.workbook new file mode 100644 index 0000000..dc577f1 --- /dev/null +++ b/Storage-Performance/Workbooks/Table Storage Classic Metrics/Table Storage Classic Metrics.workbook @@ -0,0 +1,430 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Table Storage (Classic) Metrics" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "99846120-1f35-44fc-ad8a-6f69f7261a62", + "version": "KqlParameterItem/1.0", + "name": "StorageResources", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [], + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.classicstorage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + }, + "value": [ + "value::3" + ] + }, + { + "id": "1ef46e50-5030-43fe-8c94-7e0564f4ae5f", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-22T17:44:54.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-22T17:44:54.405Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ] + } + } + ], + "resourceType": "microsoft.resources/resourcegroups" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Total Requests" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Availability" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T23:37:28.175Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/table", + "metric": "microsoft.classicstorage/services/table--TotalRequests", + "aggregation": 1, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T23:37:28.180Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/table", + "metric": "microsoft.classicstorage/services/table--Availability", + "aggregation": 4, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Total Requests* is the number of requests made to a storage service or the specified API operation. This number includes successful and failed requests, as well as requests which produced errors." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Availability* is the percentage of availability for the storage service or the specified API operation. Availability is calculated by taking the TotalBillableRequests value and dividing it by the number of applicable requests, including those that produced unexpected errors. All unexpected errors result in reduced availability for the storage service or the specified API operation. " + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Total Ingress" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Total Egress" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T23:37:28.240Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/table", + "metric": "microsoft.classicstorage/services/table--TotalIngress", + "aggregation": 1, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T23:37:28.270Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/table", + "metric": "microsoft.classicstorage/services/table--TotalEgress", + "aggregation": 1, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Total ingress* is the amount of ingress data, in bytes. This number includes ingress from an external client into Azure Storage as well as ingress within Azure." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Total egress* is the amount of egress data, in bytes. This number includes egress from an external client into Azure Storage as well as egress within Azure. As a result, this number does not reflect billable egress." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Average E2E Latency" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Average Server Latency" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook1efa2216-beb3-4350-ae7c-678c7f1705bf", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T23:37:28.199Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/table", + "metric": "microsoft.classicstorage/services/table--AverageE2ELatency", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook9cfa71e6-07a5-4b1b-9e25-f4e2be4b5da4", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-22T23:37:28.204Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classicstorage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.classicstorage/storageaccounts/services/table", + "metric": "microsoft.classicstorage/services/table--AverageServerLatency", + "aggregation": 4, + "chartType": 2, + "color": "purple" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Average E2E latency* is the average end-to-end latency of successful requests made to a storage service or the specified API operation, in milliseconds. This value includes the required processing time within Azure Storage to read the request, send the response, and receive acknowledgment of the response." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Average server latency* is the average latency used by Azure Storage to process a successful request, in milliseconds. This value does not include the network latency specified in AverageE2ELatency." + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Table Storage Classic Metrics/settings.json b/Storage-Performance/Workbooks/Table Storage Classic Metrics/settings.json new file mode 100644 index 0000000..0d6a42c --- /dev/null +++ b/Storage-Performance/Workbooks/Table Storage Classic Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Tables", + "author": "Microsoft", + "galleries": [ + { "type": "performance-storageclassic", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 }, + { "type": "failure-storageclassic", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Table Storage Metrics/Table Storage Metrics.workbook b/Storage-Performance/Workbooks/Table Storage Metrics/Table Storage Metrics.workbook new file mode 100644 index 0000000..c415ae2 --- /dev/null +++ b/Storage-Performance/Workbooks/Table Storage Metrics/Table Storage Metrics.workbook @@ -0,0 +1,556 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Table Storage Metrics" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "34ea9bf4-837f-48e4-b3fd-ade518019950", + "version": "KqlParameterItem/1.0", + "name": "StorageResources", + "type": 5, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::3" + ], + "selectedAdditionalResourceOptions": [ + "value::3" + ] + }, + "value": [] + }, + { + "id": "031e0cf8-ad0d-4328-8a4e-cec21dd90dc8", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-06-26T21:41:37.864Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-06-26T21:41:37.864Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-06-26T21:41:37.866Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-06-26T21:41:37.866Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-06-26T21:41:37.865Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resourcegroup/resourcegroups" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Table Count" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Table Capacity" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:47:23.486Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCount", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:47:23.506Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity", + "aggregation": 4, + "chartType": 2, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Table Count* - the number of tables in the storage account. \n" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Table Capacity* - the amount of Table storage used by the storage account. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Transactions" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Availability" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:47:23.594Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-Transactions", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:47:23.740Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-Availability", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Transactions* - the number of requests made to the storage service or the specified API operation. This number includes successful and failed requests, as well as requests that produced errors. \n" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Availability* - the percentage of availability for the storage service or the specified API operation. Availability is calculated by taking the total billable requests value and dividing it by the number of applicable requests, including those requests that produced unexpected errors. All unexpected errors result in reduced availability for the storage service or the specified API operation. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Ingress" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Egress" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:47:23.761Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-Ingress", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:47:23.768Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-Egress", + "aggregation": 1, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Ingress* - the amount of ingress data. This number includes ingress from an external client into Azure Storage as well as ingress within Azure. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Egress* - the amount of egress data. This number includes egress from an external client into Azure Storage as well as egress within Azure. As a result, this number does not reflect billable egress. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Success E2E Latency" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "## Success Server Latency" + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:47:23.792Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-SuccessE2ELatency", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 10, + "content": { + "chartId": "workbookeea84fcb-f288-4c8d-a901-9f0bebbb6c31", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-07-12T22:47:23.803Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageResources", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Transaction-SuccessServerLatency", + "aggregation": 4, + "chartType": 2, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "*Success E2E Latency* - the average end-to-end latency of successful requests made to a storage service or the specified API operation. This value includes the required processing time within Azure Storage to read the request, send the response, and receive acknowledgment of the response. " + }, + "conditionalVisibility": null, + "halfWidth": true + }, + { + "type": 1, + "content": { + "json": "*Success Server Latency* - the average time used to process a successful request by Azure Storage. This value does not include the network latency specified in SuccessE2ELatency. " + }, + "conditionalVisibility": null, + "halfWidth": true + } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/Table Storage Metrics/settings.json b/Storage-Performance/Workbooks/Table Storage Metrics/settings.json new file mode 100644 index 0000000..da02952 --- /dev/null +++ b/Storage-Performance/Workbooks/Table Storage Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Tables", + "author": "Microsoft", + "galleries": [ + { "type": "performance-storage", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 }, + { "type": "failure-storage", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 } + ] +} \ No newline at end of file diff --git a/Storage-Performance/Workbooks/categoryResources.json b/Storage-Performance/Workbooks/categoryResources.json new file mode 100644 index 0000000..da23f62 --- /dev/null +++ b/Storage-Performance/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"See key storage performance metrics", "description": "", "order": 100} +} \ No newline at end of file diff --git a/Storage/Alerts/README b/Storage/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Storage/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Storage/Queries/README b/Storage/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Storage/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Storage/Workbooks/Overview/Overview.workbook b/Storage/Workbooks/Overview/Overview.workbook new file mode 100644 index 0000000..c3f6315 --- /dev/null +++ b/Storage/Workbooks/Overview/Overview.workbook @@ -0,0 +1,775 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All subscriptions with Storage accounts", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.storage/storageaccounts'\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", + "version": "KqlParameterItem/1.0", + "name": "StorageAccounts", + "label": "Storage accounts", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.storage/storageaccounts'\n| order by name asc\n| extend Rank = row_number()\n| project value = id, label = id, selected = Rank <= 5", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.storage/storageaccounts": true + }, + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "value": { + "durationMs": 14400000 + }, + "label": "Time Range" + }, + { + "id": "9b48988f-dcd2-48cc-b233-5999ed32149f", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "where type == 'microsoft.storage/storageaccounts' \n| summarize Selected = countif(id in ({StorageAccounts:value})), Total = count()\n| extend Selected = iff(Selected > 200, 200, Selected)\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "070b2474-4e01-478d-a7fa-6c20ad8ea1ad", + "version": "KqlParameterItem/1.0", + "name": "ResourceName", + "type": 1, + "isRequired": true, + "value": "Storage account", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'Storage account'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "Storage account" + } + } + ] + }, + { + "id": "c6c32b32-6eb4-44d5-9cad-156d5d50ec3e", + "version": "KqlParameterItem/1.0", + "name": "ResourceImageUrl", + "type": 1, + "description": "used as a parameter for No Subcriptions workbook template", + "isHiddenWhenLocked": true + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 1", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "community-Workbooks/Common/noSubscriptions", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isEqualTo", + "value": "" + }, + "name": "No Subscriptions group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "{Message}\r\n_Storage accounts_" + }, + "name": "text - 3", + "styleSettings": { + "margin": "15px 0 10px 10px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Capacity", + "subTarget": "Capacity" + } + ] + }, + "name": "Navigation links", + "styleSettings": { + "margin": "10px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "### Overview section" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "text - 4" + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{StorageAccounts}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccounts", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Transactions", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency", + "aggregation": 4 + }, + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-SuccessServerLatency", + "aggregation": 4 + }, + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Transaction-Transactions", + "aggregation": 1, + "splitBy": "ResponseType", + "splitBySortOrder": -1, + "splitByLimit": 4, + "columnName": "Errors" + } + ], + "resourceLimit": 200, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "insights", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-Transactions$|Transactions$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-Transactions Timeline$|Transactions Timeline$", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency$|microsoft.storage/storageaccounts-Transaction-SuccessServerLatency$|E2E Latency$|Server Latency$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "linkTarget": "WorkbookTemplate", + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Performance", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.storage/storageaccounts" + } + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency Timeline$|E2E Latency Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Transaction-SuccessServerLatency Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Success/Errors", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "success/Errors", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": ".*\\/Errors", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "gray", + "linkTarget": "WorkbookTemplate", + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Failures", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.storage/storageaccounts" + } + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Server Latency Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.storage/storageaccounts-Transaction-Transactions$|Transactions$_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "Name", + "label": "" + }, + { + "columnId": "microsoft.storage/storageaccounts-Transaction-Transactions", + "label": "Transactions" + }, + { + "columnId": "microsoft.storage/storageaccounts-Transaction-Transactions Timeline", + "label": "Transactions Timeline" + }, + { + "columnId": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency", + "label": "E2E Latency" + }, + { + "columnId": "microsoft.storage/storageaccounts-Transaction-SuccessE2ELatency Timeline", + "label": "E2E Latency Timeline" + }, + { + "columnId": "microsoft.storage/storageaccounts-Transaction-SuccessServerLatency", + "label": "Server Latency" + }, + { + "columnId": "microsoft.storage/storageaccounts-Transaction-SuccessServerLatency Timeline", + "label": "Server Latency Timeline" + }, + { + "columnId": "Success/Errors" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.storage/storageaccounts-Transaction-Transactions$|Transactions$_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "showPin": true, + "name": "storage account metrics", + "styleSettings": { + "margin": "0 10px 0 10px" + } + }, + { + "type": 1, + "content": { + "json": "## Capacity section" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "text - 6" + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 3, + "chartType": 0, + "resourceIds": [ + "{StorageAccounts}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.storage/storageaccounts", + "resourceParameter": "StorageAccounts", + "metrics": [ + { + "namespace": "microsoft.storage/storageaccounts", + "metric": "microsoft.storage/storageaccounts-Capacity-UsedCapacity", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts/blobservices", + "metric": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts/fileservices", + "metric": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts/queueservices", + "metric": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.storage/storageaccounts/tableservices", + "metric": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity", + "aggregation": 4, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "insights", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Capacity-UsedCapacity$|microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity$|microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity$|microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity$|microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity$", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "linkTarget": "WorkbookTemplate", + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Individual Storage/Capacity", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.storage/storageaccounts" + } + }, + "numberFormat": { + "unit": 36, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts-Capacity-UsedCapacity Timeline$|Account used capacity Timeline$", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity Timeline$|Blob capacity Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity Timeline$|File capacity Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity Timeline$|Queue capacity Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity Timeline$|Table capacity Timeline$", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.storage/storageaccounts-Capacity-UsedCapacity$|microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity$|microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity$|microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity$|microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity$_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Subscription", + "label": "Subscription" + }, + { + "columnId": "Name" + }, + { + "columnId": "microsoft.storage/storageaccounts-Capacity-UsedCapacity", + "label": "Account used capacity" + }, + { + "columnId": "microsoft.storage/storageaccounts-Capacity-UsedCapacity Timeline", + "label": "Account used capacity timeline" + }, + { + "columnId": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity", + "label": "Blob capacity" + }, + { + "columnId": "microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity Timeline", + "label": "Blob capacity Timeline" + }, + { + "columnId": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity", + "label": "File capacity" + }, + { + "columnId": "microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity Timeline", + "label": "File capacity Timeline" + }, + { + "columnId": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity", + "label": "Queue capacity" + }, + { + "columnId": "microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity Timeline", + "label": "Queue capacity Timeline" + }, + { + "columnId": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity", + "label": "Table capacity" + }, + { + "columnId": "microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity Timeline", + "label": "Table capacity Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.storage/storageaccounts-Capacity-UsedCapacity$|microsoft.storage/storageaccounts/blobservices-Capacity-BlobCapacity$|microsoft.storage/storageaccounts/fileservices-Capacity-FileCapacity$|microsoft.storage/storageaccounts/queueservices-Capacity-QueueCapacity$|microsoft.storage/storageaccounts/tableservices-Capacity-TableCapacity$_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Capacity" + }, + "showPin": true, + "name": "storage account capacity metrics", + "styleSettings": { + "margin": "0 10px 0 10px" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "Subscription", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "Storage accounts" + } + ], + "styleSettings": { + "paddingStyle": "narrow" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Storage/Workbooks/Overview/settings.json b/Storage/Workbooks/Overview/settings.json new file mode 100644 index 0000000..97caf1a --- /dev/null +++ b/Storage/Workbooks/Overview/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Storage accounts Overview", + "author": "Microsoft", + "galleries": [{ "type": "storage-insights", "resourceType": "Azure Monitor", "order": 100 }, { "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorInsights", "order": 100 }] +} \ No newline at end of file diff --git a/Storage/Workbooks/categoryResources.json b/Storage/Workbooks/categoryResources.json new file mode 100644 index 0000000..e5a489b --- /dev/null +++ b/Storage/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Storage Insights", "description": "Provides insights for your storage accounts", "order": 100} +} \ No newline at end of file diff --git a/ResourceTypes/StreamAnalytics/All-logs-with-level-error.txt b/StreamAnalytics/Queries/Getting started/General/All-logs-with-level-error.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/All-logs-with-level-error.txt rename to StreamAnalytics/Queries/Getting started/General/All-logs-with-level-error.txt diff --git a/ResourceTypes/StreamAnalytics/List-all-administrative-operations.txt b/StreamAnalytics/Queries/Getting started/General/List-all-administrative-operations.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/List-all-administrative-operations.txt rename to StreamAnalytics/Queries/Getting started/General/List-all-administrative-operations.txt diff --git a/ResourceTypes/StreamAnalytics/Operations-that-have-Failed.txt b/StreamAnalytics/Queries/Getting started/General/Operations-that-have-Failed.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/Operations-that-have-Failed.txt rename to StreamAnalytics/Queries/Getting started/General/Operations-that-have-Failed.txt diff --git a/ResourceTypes/StreamAnalytics/Output-Throttling-logs.txt b/StreamAnalytics/Queries/Getting started/General/Output-Throttling-logs.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/Output-Throttling-logs.txt rename to StreamAnalytics/Queries/Getting started/General/Output-Throttling-logs.txt diff --git a/ResourceTypes/StreamAnalytics/Reference-data-logs.txt b/StreamAnalytics/Queries/Getting started/General/Reference-data-logs.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/Reference-data-logs.txt rename to StreamAnalytics/Queries/Getting started/General/Reference-data-logs.txt diff --git a/ResourceTypes/StreamAnalytics/Summary-of-Failed-operations-in-the-last-7-days.txt b/StreamAnalytics/Queries/Getting started/General/Summary-of-Failed-operations-in-the-last-7-days.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/Summary-of-Failed-operations-in-the-last-7-days.txt rename to StreamAnalytics/Queries/Getting started/General/Summary-of-Failed-operations-in-the-last-7-days.txt diff --git a/ResourceTypes/StreamAnalytics/Summary-of-all-data-errors-in-the-last-7-days.txt b/StreamAnalytics/Queries/Getting started/General/Summary-of-all-data-errors-in-the-last-7-days.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/Summary-of-all-data-errors-in-the-last-7-days.txt rename to StreamAnalytics/Queries/Getting started/General/Summary-of-all-data-errors-in-the-last-7-days.txt diff --git a/ResourceTypes/StreamAnalytics/Summary-of-all-errors-in-the-last-7-days.txt b/StreamAnalytics/Queries/Getting started/General/Summary-of-all-errors-in-the-last-7-days.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/Summary-of-all-errors-in-the-last-7-days.txt rename to StreamAnalytics/Queries/Getting started/General/Summary-of-all-errors-in-the-last-7-days.txt diff --git a/ResourceTypes/StreamAnalytics/Transient-input-and-output-errors.txt b/StreamAnalytics/Queries/Getting started/General/Transient-input-and-output-errors.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/Transient-input-and-output-errors.txt rename to StreamAnalytics/Queries/Getting started/General/Transient-input-and-output-errors.txt diff --git a/ResourceTypes/StreamAnalytics/Events-that-arrived-early.txt b/StreamAnalytics/Queries/Getting started/Input data Errors/Events-that-arrived-early.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/Events-that-arrived-early.txt rename to StreamAnalytics/Queries/Getting started/Input data Errors/Events-that-arrived-early.txt diff --git a/ResourceTypes/StreamAnalytics/Events-that-arrived-late.txt b/StreamAnalytics/Queries/Getting started/Input data Errors/Events-that-arrived-late.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/Events-that-arrived-late.txt rename to StreamAnalytics/Queries/Getting started/Input data Errors/Events-that-arrived-late.txt diff --git a/ResourceTypes/StreamAnalytics/Events-that-arrived-out-of-order.txt b/StreamAnalytics/Queries/Getting started/Input data Errors/Events-that-arrived-out-of-order.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/Events-that-arrived-out-of-order.txt rename to StreamAnalytics/Queries/Getting started/Input data Errors/Events-that-arrived-out-of-order.txt diff --git a/ResourceTypes/StreamAnalytics/List-all-InvalidInputTimeStamp-errors.txt b/StreamAnalytics/Queries/Getting started/Input data Errors/List-all-InvalidInputTimeStamp-errors.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/List-all-InvalidInputTimeStamp-errors.txt rename to StreamAnalytics/Queries/Getting started/Input data Errors/List-all-InvalidInputTimeStamp-errors.txt diff --git a/ResourceTypes/StreamAnalytics/List-all-InvalidInputTimeStampKey-errors.txt b/StreamAnalytics/Queries/Getting started/Input data Errors/List-all-InvalidInputTimeStampKey-errors.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/List-all-InvalidInputTimeStampKey-errors.txt rename to StreamAnalytics/Queries/Getting started/Input data Errors/List-all-InvalidInputTimeStampKey-errors.txt diff --git a/ResourceTypes/StreamAnalytics/List-all-input-data-errors.txt b/StreamAnalytics/Queries/Getting started/Input data Errors/List-all-input-data-errors.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/List-all-input-data-errors.txt rename to StreamAnalytics/Queries/Getting started/Input data Errors/List-all-input-data-errors.txt diff --git a/ResourceTypes/StreamAnalytics/List-all-input-deserialization-errors.txt b/StreamAnalytics/Queries/Getting started/Input data Errors/List-all-input-deserialization-errors.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/List-all-input-deserialization-errors.txt rename to StreamAnalytics/Queries/Getting started/Input data Errors/List-all-input-deserialization-errors.txt diff --git a/ResourceTypes/StreamAnalytics/All-output-data-errors.txt b/StreamAnalytics/Queries/Getting started/Output data Errors/All-output-data-errors.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/All-output-data-errors.txt rename to StreamAnalytics/Queries/Getting started/Output data Errors/All-output-data-errors.txt diff --git a/ResourceTypes/StreamAnalytics/List-all-ColumnNameInvalid-errors.txt b/StreamAnalytics/Queries/Getting started/Output data Errors/List-all-ColumnNameInvalid-errors.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/List-all-ColumnNameInvalid-errors.txt rename to StreamAnalytics/Queries/Getting started/Output data Errors/List-all-ColumnNameInvalid-errors.txt diff --git a/ResourceTypes/StreamAnalytics/List-all-DuplicateKey-errors.txt b/StreamAnalytics/Queries/Getting started/Output data Errors/List-all-DuplicateKey-errors.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/List-all-DuplicateKey-errors.txt rename to StreamAnalytics/Queries/Getting started/Output data Errors/List-all-DuplicateKey-errors.txt diff --git a/ResourceTypes/StreamAnalytics/List-all-RecordExceededSizeLimit-errors.txt b/StreamAnalytics/Queries/Getting started/Output data Errors/List-all-RecordExceededSizeLimit-errors.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/List-all-RecordExceededSizeLimit-errors.txt rename to StreamAnalytics/Queries/Getting started/Output data Errors/List-all-RecordExceededSizeLimit-errors.txt diff --git a/ResourceTypes/StreamAnalytics/List-all-RequiredColumnMissing-errors.txt b/StreamAnalytics/Queries/Getting started/Output data Errors/List-all-RequiredColumnMissing-errors.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/List-all-RequiredColumnMissing-errors.txt rename to StreamAnalytics/Queries/Getting started/Output data Errors/List-all-RequiredColumnMissing-errors.txt diff --git a/ResourceTypes/StreamAnalytics/List-all-TypeConversionError-errors.txt b/StreamAnalytics/Queries/Getting started/Output data Errors/List-all-TypeConversionError-errors.txt similarity index 100% rename from ResourceTypes/StreamAnalytics/List-all-TypeConversionError-errors.txt rename to StreamAnalytics/Queries/Getting started/Output data Errors/List-all-TypeConversionError-errors.txt diff --git a/StreamAnalytics/Workbooks/README b/StreamAnalytics/Workbooks/README new file mode 100644 index 0000000..7b19c10 --- /dev/null +++ b/StreamAnalytics/Workbooks/README @@ -0,0 +1 @@ +Put workbooks in this folder \ No newline at end of file diff --git a/TSG-New/Alerts/README b/TSG-New/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/TSG-New/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/TSG-New/Queries/README b/TSG-New/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/TSG-New/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/TSG-New/Workbooks/New/New.workbook b/TSG-New/Workbooks/New/New.workbook new file mode 100644 index 0000000..84d546d --- /dev/null +++ b/TSG-New/Workbooks/New/New.workbook @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": false, + "items": [] +} \ No newline at end of file diff --git a/TSG-New/Workbooks/New/plus.svg b/TSG-New/Workbooks/New/plus.svg new file mode 100644 index 0000000..18d2211 --- /dev/null +++ b/TSG-New/Workbooks/New/plus.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/TSG-New/Workbooks/New/settings.json b/TSG-New/Workbooks/New/settings.json new file mode 100644 index 0000000..79a3e17 --- /dev/null +++ b/TSG-New/Workbooks/New/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"New", + "description": "Blank troubleshooting guide", + "icon": "plus.svg", + "author": "Microsoft", + "galleries": [{ "type": "tsg", "resourceType": "microsoft.insights/components", "order": 200 }] +} \ No newline at end of file diff --git a/TSG-New/Workbooks/categoryResources.json b/TSG-New/Workbooks/categoryResources.json new file mode 100644 index 0000000..0044790 --- /dev/null +++ b/TSG-New/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Create a custom troubleshooting guide for your application", "description": "", "order": 200} +} \ No newline at end of file diff --git a/TSG/Alerts/README b/TSG/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/TSG/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/TSG/Queries/README b/TSG/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/TSG/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/TSG/Workbooks/Dependency Failures TSG/Dependency Failures.workbook b/TSG/Workbooks/Dependency Failures TSG/Dependency Failures.workbook new file mode 100644 index 0000000..90394f8 --- /dev/null +++ b/TSG/Workbooks/Dependency Failures TSG/Dependency Failures.workbook @@ -0,0 +1,295 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Troubleshooting Dependency Failures\nThis troubleshooting guide helps you identify failures in your application's dependencies. " + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "eac9cbf1-6364-4f28-9c61-a9b038c035d7", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2419200000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": false + }, + "value": { + "durationMs": 86400000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + }, + { + "id": "6ab5c1cb-bad0-4d96-8e63-d439d0681c6e", + "version": "KqlParameterItem/1.0", + "name": "Dependencies", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "dependencies\n| where timestamp {TimeRange}\n| summarize Count = count(), Users = dcount(user_Id) by name\n| order by name asc\n| project v = name, t = name, s=false\n| union (datatable(v:string, t:string, s:boolean)[\n'*', 'All Dependencies', true\n])", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5e558db3-501c-4ce3-87c3-7f13a469fd54", + "version": "KqlParameterItem/1.0", + "name": "ResultCodes", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "datatable(x:string, y:string, z:boolean)[\r\n'*', 'All', true,\r\n'@', 'All 500s', false,\r\n'#', 'All 400s', false\r\n]\r\n| union (dependencies\r\n| where timestamp {TimeRange}\r\n| where success == false\r\n| summarize by resultCode\r\n| order by resultCode asc\r\n| project x = resultCode, y = resultCode, z = false)", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "84caf619-7585-48e0-a9c3-85c364aaa13b", + "version": "KqlParameterItem/1.0", + "name": "Show", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(x:string, y:string)[\r\n\"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\", 'New and Existing Failures',\r\n\"['New Failure Rate (%)']\", 'Only New Failures',\r\n\"['Existing Failure Rate (%)']\", 'Only Existing Failures',\r\n]", + "value": "['New Failure Rate (%)'], ['Existing Failure Rate (%)']" + }, + { + "id": "6f0de137-0136-48f0-b463-640de7109c05", + "version": "KqlParameterItem/1.0", + "name": "UseComparisonTimeRangeOf", + "type": 1, + "description": null, + "isRequired": true, + "query": "let t = todatetime({TimeRange:end}) - todatetime({TimeRange:start});\r\nlet w = case(t <= 1d, '7d', t <= 3d, '14d', t <= 14d, '28d', '60d');\r\nrange i from 1 to 1 step 1\r\n| project x = w", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components", + "value": "14d" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "Set the parameters above to tune your analysis set. Use the `Show` parameter above to see only existing or new failures. The comparision `UseComparisionTimeRange` parameter sets the window of time to look for existing failures. `Dependencies` and `ResultCodes` parameters allow you filter down to a smaller set of issues." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Failure Trend\nThe chart below shows the trend of dependency failures over your chosen time range. It is split by new and existing failures. " + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bigWindow = dependencies\r\n| where timestamp >= {TimeRange:start} - {UseComparisonTimeRangeOf} and timestamp <= {TimeRange:start}\r\n| where success == false\r\n| where name in ({Dependencies}) or '*' in ({Dependencies})\r\n| where resultCode in ({ResultCodes}) or '*' in ({ResultCodes}) or iff('@' in ({ResultCodes}), resultCode startswith '5', false) or iff('#' in ({ResultCodes}), resultCode startswith '4', false)\r\n| summarize by name, resultCode\r\n| summarize makelist(strcat(name, '-', resultCode), 100000);\r\nlet data = dependencies\r\n| where timestamp {TimeRange}\r\n| where name in ({Dependencies}) or '*' in ({Dependencies})\r\n| where resultCode in ({ResultCodes}) or '*' in ({ResultCodes}) or iff('@' in ({ResultCodes}), resultCode startswith '5', false) or iff('#' in ({ResultCodes}), resultCode startswith '4', false)\r\n| where success == false;\r\ndata\r\n| extend IsNew = strcat(name, '-', resultCode) !in (bigWindow)\r\n| where \"{Show}\" == \"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\" or IsNew == true\r\n| make-series Count = count() default = 0 on timestamp in range({TimeRange:start}, now(), {TimeRange:grain}) by ['Failure'] = iff(IsNew, 'New Failure', 'Existing Failure')\r\n\r\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "visualization": "barchart" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Failure Details" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "\n🔸 New Failure 🔹 Existing Failure" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bigWindow = dependencies\n| where timestamp >= {TimeRange:start} - {UseComparisonTimeRangeOf} and timestamp <= {TimeRange:start}\n| where success == false\n| where name in ({Dependencies}) or '*' in ({Dependencies})\n| where resultCode in ({ResultCodes}) or '*' in ({ResultCodes}) or iff('@' in ({ResultCodes}), resultCode startswith '5', false) or iff('#' in ({ResultCodes}), resultCode startswith '4', false)\n| summarize by name, resultCode\n| summarize makelist(strcat(name, '-', resultCode), 100000);\nlet data = dependencies\n| where timestamp {TimeRange}\n| where name in ({Dependencies}) or '*' in ({Dependencies})\n| where resultCode in ({ResultCodes}) or '*' in ({ResultCodes}) or iff('@' in ({ResultCodes}), resultCode startswith '5', false) or iff('#' in ({ResultCodes}), resultCode startswith '4', false)\n| where success == false;\ndata\n| summarize Count = count(), Users = dcount(user_Id) by name, resultCode\n| extend IsNew = strcat(name, '-', resultCode) !in (bigWindow)\n| where \"{Show}\" == \"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\" or IsNew == true\n| join kind=inner (data\n | make-series Trend = count() default = 0 on timestamp in range({TimeRange:start}, now(), {TimeRange:grain}) by name\n | project name, Trend\n ) on name\n| order by Users desc, Count desc, name asc\n| project ['Dependency Name'] = iff(IsNew, strcat('🔸 ', name), strcat('🔹 ', name)), ['Failed with Result Code'] = resultCode, ['Failures'] = Count, ['Users Affected'] = Users, ['Trend'] = Trend\n", + "showQuery": false, + "size": 0, + "aggregation": 2, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Failures", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Users Affected", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "max": null, + "palette": "greenRed" + } + } + ] + } + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Mitigation\nUse this section to list out the recovery steps for known issues. This allows sharing of information with future issue investigators. " + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Customizing your Troubleshooting Guide\n```\n1. Start editing this TSG by clicking on the 'Edit' button on the toolbar on top. \n2. Use the edit buttons on bottom-right of markdown control to update it's contents. \n3. Update the parameters to tune your analysis set.\n4. You can also update the underlying query or grid properties to personalize the analysis/view.\n5. If you want to have two sections for different performance counters, use the clone button at the bottom toolbar of a control. Use the ↑ or ↓ buttons to move the controls up or down.\n```\n" + }, + "conditionalVisibility": null, + "halfWidth": false + } + ] +} \ No newline at end of file diff --git a/TSG/Workbooks/Dependency Failures TSG/settings.json b/TSG/Workbooks/Dependency Failures TSG/settings.json new file mode 100644 index 0000000..d164dc7 --- /dev/null +++ b/TSG/Workbooks/Dependency Failures TSG/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Dependency Failures", + "author": "Microsoft", + "galleries": [{ "type": "tsg", "resourceType": "microsoft.insights/components", "order": 200 }] +} \ No newline at end of file diff --git a/TSG/Workbooks/Exceptions/Exceptions.workbook b/TSG/Workbooks/Exceptions/Exceptions.workbook new file mode 100644 index 0000000..357e815 --- /dev/null +++ b/TSG/Workbooks/Exceptions/Exceptions.workbook @@ -0,0 +1,281 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Troubleshooting Exceptions\nThis troubleshooting guide helps you analyze your application's exceptions." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "eac9cbf1-6364-4f28-9c61-a9b038c035d7", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2419200000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": false + }, + "value": { + "durationMs": 86400000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + }, + { + "id": "6ab5c1cb-bad0-4d96-8e63-d439d0681c6e", + "version": "KqlParameterItem/1.0", + "name": "Problems", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "exceptions\n| where timestamp {TimeRange}\n| summarize by problemId\n| order by problemId asc\n| project v = problemId, t = problemId, s=false\n| union (datatable(v:string, t:string, s:boolean)[\n'*', 'All Problems', true\n])", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "84caf619-7585-48e0-a9c3-85c364aaa13b", + "version": "KqlParameterItem/1.0", + "name": "Show", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(x:string, y:string)[\r\n\"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\", 'New and Existing Problems',\r\n\"['New Failure Rate (%)']\", 'Only New Problems',\r\n\"['Existing Failure Rate (%)']\", 'Only Existing Problems',\r\n]", + "value": "['New Failure Rate (%)'], ['Existing Failure Rate (%)']" + }, + { + "id": "6f0de137-0136-48f0-b463-640de7109c05", + "version": "KqlParameterItem/1.0", + "name": "UseComparisonTimeRangeOf", + "type": 1, + "description": null, + "isRequired": true, + "query": "let t = todatetime({TimeRange:end}) - todatetime({TimeRange:start});\r\nlet w = case(t <= 1d, '7d', t <= 3d, '14d', t <= 14d, '28d', '60d');\r\nrange i from 1 to 1 step 1\r\n| project x = w", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components", + "value": "14d" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "Set the parameters above to tune your analysis set. Use the `Show` parameter above to see only existing or new failures. The comparision `UseComparisionTimeRange` parameter sets the window of time to look for existing failures. A `Problem` just a combination of exception type and method at which it is thrown. Changing this parameter allows you filter down to a smaller set of issues." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Exception Trend\nThe chart below shows the trend of exceptions over your chosen time range. It is split by new and existing exceptions. " + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bigWindow = exceptions\r\n| where timestamp >= {TimeRange:start} - {UseComparisonTimeRangeOf} and timestamp <= {TimeRange:start}\r\n| where problemId in ({Problems}) or '*' in ({Problems})\r\n| summarize makelist(problemId, 100000);\r\nlet data = exceptions\r\n| where timestamp {TimeRange}\r\n| where problemId in ({Problems}) or '*' in ({Problems});\r\ndata\r\n| extend IsNew = problemId !in (bigWindow)\r\n| where \"{Show}\" == \"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\" or IsNew == true\r\n| make-series Count = count() default = 0 on timestamp in range({TimeRange:start}, now(), {TimeRange:grain}) by ['Failure'] = iff(IsNew, 'New Failure', 'Existing Failure')\r\n\r\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "visualization": "barchart" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Exception Details" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "\n🔸 New Failure 🔹 Existing Failure" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bigWindow = exceptions\n| where timestamp >= {TimeRange:start} - {UseComparisonTimeRangeOf} and timestamp <= {TimeRange:start}\n| where problemId in ({Problems}) or '*' in ({Problems})\n| summarize makelist(problemId, 100000);\nlet data = exceptions\n| where timestamp {TimeRange}\n| where problemId in ({Problems}) or '*' in ({Problems});\ndata\n| extend IsNew = problemId !in (bigWindow)\n| where \"{Show}\" == \"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\" or IsNew == true\n| summarize Count = count(), Users = dcount(user_Id) by problemId, IsNew\n| join kind=inner (data\n | make-series Trend = count() default = 0 on timestamp in range({TimeRange:start}, now(), {TimeRange:grain}) by problemId\n | project problemId, Trend\n ) on problemId\n| order by Users desc, Count desc, problemId asc\n| project ['Problem'] = iff(IsNew, strcat('🔸 ', problemId), strcat('🔹 ', problemId)), ['Exceptions'] = Count, ['Users Affected'] = Users, ['Trend'] = Trend\n", + "showQuery": false, + "size": 0, + "aggregation": 2, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Exceptions", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Users Affected", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "max": null, + "palette": "greenRed" + } + } + ] + } + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Mitigation\nUse this section to list out the recovery steps for known issues. This allows sharing of information with future issue investigators. " + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Customizing your Troubleshooting Guide\n```\n1. Start editing this TSG by clicking on the 'Edit' button on the toolbar on top. \n2. Use the edit buttons on bottom-right of markdown control to update it's contents. \n3. Update the parameters to tune your analysis set.\n4. You can also update the underlying query or grid properties to personalize the analysis/view.\n5. If you want to have two sections for different performance counters, use the clone button at the bottom toolbar of a control. Use the ↑ or ↓ buttons to move the controls up or down.\n```\n" + }, + "conditionalVisibility": null, + "halfWidth": false + } + ] +} \ No newline at end of file diff --git a/TSG/Workbooks/Exceptions/settings.json b/TSG/Workbooks/Exceptions/settings.json new file mode 100644 index 0000000..d1e3f02 --- /dev/null +++ b/TSG/Workbooks/Exceptions/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Exceptions", + "author": "Microsoft", + "galleries": [{ "type": "tsg", "resourceType": "microsoft.insights/components", "order": 300 }] +} \ No newline at end of file diff --git a/TSG/Workbooks/Performance Counter TSG/Performance Counter TSG.workbook b/TSG/Workbooks/Performance Counter TSG/Performance Counter TSG.workbook new file mode 100644 index 0000000..99d157d --- /dev/null +++ b/TSG/Workbooks/Performance Counter TSG/Performance Counter TSG.workbook @@ -0,0 +1,226 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Troubleshooting Issues Using Performance Counters" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "3cbdba7f-8b9a-4b23-a360-85e9ed7c6d21", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 900000, + "createdTime": "2018-05-16T21:34:47.842Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-05-16T21:34:47.842Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-05-16T21:34:47.842Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-05-16T21:34:47.842Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-05-16T21:34:47.843Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-05-16T21:34:47.843Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-05-16T21:34:47.843Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-05-16T21:34:47.843Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-05-16T21:34:47.843Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 14400000 + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Problem - High CPU Utilization\nConsistently high CPU utilization can performance and availability problems in your deployed application. This section will help you understand which of your servers are running hot enough to potentially affect the reliability of your application. " + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "8431cd42-ff0e-47be-a9a8-a67c65435c5b", + "version": "KqlParameterItem/1.0", + "name": "PerformanceCounter", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(value:string)[\r\n'% Processor Time Normalized', '% Processor Time', 'Available Bytes',\t\r\n'Requests In Application Queue',\t\r\n'Private Bytes', 'IO Data Bytes/sec', \r\n'Request Execution Time',\r\n'Requests/Sec'\r\n]", + "isHiddenWhenLocked": true, + "value": "% Processor Time Normalized" + }, + { + "id": "8495d118-6077-43be-bae5-fc83ac6fd1b0", + "version": "KqlParameterItem/1.0", + "name": "CriticalThreshold", + "type": 1, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "value": "90.0" + }, + { + "id": "88983de3-f6a6-4a74-a1b5-839626727928", + "version": "KqlParameterItem/1.0", + "name": "WarningThreshold", + "type": 1, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "value": "70.0" + }, + { + "id": "f4216669-0572-4e83-aa7e-613e8a7a6b20", + "version": "KqlParameterItem/1.0", + "name": "AreLowerValuesBetter", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(x:string, y:string)[\r\n'>', 'Yes',\r\n'<', 'No',\r\n]", + "isHiddenWhenLocked": true, + "value": ">" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let Data = performanceCounters\r\n| where timestamp {TimeRange}\r\n| where name == '{PerformanceCounter}'\r\n| summarize Data = avg(value) by Machine = cloud_RoleInstance;\r\nperformanceCounters\r\n| where timestamp {TimeRange}\r\n| where name == '{PerformanceCounter}'\r\n| make-series Avg = avg(value) default = 0 on timestamp in range({TimeRange:start}, now(), {TimeRange:grain}) by Machine = cloud_RoleInstance\r\n| project Machine, Avg\r\n| join kind=inner (Data) on Machine\r\n| project Status = case(Data {AreLowerValuesBetter} {CriticalThreshold}, '❌ Critical', Data {AreLowerValuesBetter} {WarningThreshold}, '⚠️ Warning', '✔️ Good'), Machine, ['Average Value'] = round(Data, 2), ['Time Series'] = Avg\r\n| order by ['Average Value'] desc\r\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "noDataMessage": "Looks like this app is not collecting the specified performance counter. More info on collecting counters can be found at: https://docs.microsoft.com/en-us/azure/azure-monitor/app/performance-counters", + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Average Value", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Time Series", + "formatter": 9, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Causes\nHigh CPU utilization usually indicates that the load on your system is higher than the provisioned compute resources can handle. This may happen if the usage of your application has increased or due to a regression in the performance of the app in a deployment.\n\nOther possible reasons include: \n1. Frequent jobs or scheduled tasks on the machine, \n2. Excessive modules/plugins/extensions, \n3. Too many web apps running on the underlying compute resources, \n4. Search engine spiders and bots. " + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Solutions\nIf the CPU utilization is truly a result of increased load, then scaling the most appropriate response:\n* Scale out - to add more compute resources. If 10 VMs used to serve the application, scale it to 15 to relieve the load off the existing VMs.\n* Scale up - use higher quality of resources (upgrade from 2 core CPU to and 8-core CPU)" + }, + "conditionalVisibility": null + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/TSG/Workbooks/Performance Counter TSG/settings.json b/TSG/Workbooks/Performance Counter TSG/settings.json new file mode 100644 index 0000000..bddd907 --- /dev/null +++ b/TSG/Workbooks/Performance Counter TSG/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance Counters", + "author": "Microsoft", + "galleries": [{ "type": "tsg", "resourceType": "microsoft.insights/components", "order": 400 }] +} \ No newline at end of file diff --git a/TSG/Workbooks/Request Failures/Request Failures.workbook b/TSG/Workbooks/Request Failures/Request Failures.workbook new file mode 100644 index 0000000..622e205 --- /dev/null +++ b/TSG/Workbooks/Request Failures/Request Failures.workbook @@ -0,0 +1,295 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Troubleshooting Request Failures\nThis troubleshooting guide helps you identify failures in your application's web requests. " + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "eac9cbf1-6364-4f28-9c61-a9b038c035d7", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-06-04T19:27:14.510Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2419200000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": false + }, + "value": { + "durationMs": 86400000, + "createdTime": "2018-06-04T19:27:14.511Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + }, + { + "id": "6ab5c1cb-bad0-4d96-8e63-d439d0681c6e", + "version": "KqlParameterItem/1.0", + "name": "Requests", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "requests\n| where timestamp {TimeRange}\n| summarize Count = count(), Users = dcount(user_Id) by name\n| order by name asc\n| project v = name, t = name, s=false\n| union (datatable(v:string, t:string, s:boolean)[\n'*', 'All Requests', true\n])", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5e558db3-501c-4ce3-87c3-7f13a469fd54", + "version": "KqlParameterItem/1.0", + "name": "ResultCodes", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "datatable(x:string, y:string, z:boolean)[\r\n'*', 'All', true,\r\n'@', 'All 500s', false,\r\n'#', 'All 400s', false\r\n]\r\n| union (requests\r\n| where timestamp {TimeRange}\r\n| where success == false\r\n| summarize by resultCode\r\n| order by resultCode asc\r\n| project x = resultCode, y = resultCode, z = false)", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "84caf619-7585-48e0-a9c3-85c364aaa13b", + "version": "KqlParameterItem/1.0", + "name": "Show", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(x:string, y:string)[\r\n\"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\", 'New and Existing Failures',\r\n\"['New Failure Rate (%)']\", 'Only New Failures',\r\n\"['Existing Failure Rate (%)']\", 'Only Existing Failures',\r\n]", + "value": "['New Failure Rate (%)'], ['Existing Failure Rate (%)']" + }, + { + "id": "6f0de137-0136-48f0-b463-640de7109c05", + "version": "KqlParameterItem/1.0", + "name": "UseComparisonTimeRangeOf", + "type": 1, + "description": null, + "isRequired": true, + "query": "let t = todatetime({TimeRange:end}) - todatetime({TimeRange:start});\r\nlet w = case(t <= 1d, '7d', t <= 3d, '14d', t <= 14d, '28d', '60d');\r\nrange i from 1 to 1 step 1\r\n| project x = w", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components", + "value": "14d" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "Set the parameters above to tune your analysis set. Use the `Show` parameter above to see only existing or new failures. The comparision `UseComparisionTimeRange` parameter sets the window of time to look for existing failures. `Requests` and `ResultCodes` parameters allow you to filter down to a smaller set of issues." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Failure Trend\nThe chart below shows the trend of request failures over your chosen time range. It is split by new and existing failures. " + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bigWindow = requests\r\n| where timestamp >= {TimeRange:start} - {UseComparisonTimeRangeOf} and timestamp <= {TimeRange:start}\r\n| where success == false\r\n| where name in ({Requests}) or '*' in ({Requests})\r\n| where resultCode in ({ResultCodes}) or '*' in ({ResultCodes}) or iff('@' in ({ResultCodes}), resultCode startswith '5', false) or iff('#' in ({ResultCodes}), resultCode startswith '4', false)\r\n| summarize by name, resultCode\r\n| summarize makelist(strcat(name, '-', resultCode), 100000);\r\nlet data = requests\r\n| where timestamp {TimeRange}\r\n| where name in ({Requests}) or '*' in ({Requests})\r\n| where resultCode in ({ResultCodes}) or '*' in ({ResultCodes}) or iff('@' in ({ResultCodes}), resultCode startswith '5', false) or iff('#' in ({ResultCodes}), resultCode startswith '4', false)\r\n| where success == false;\r\ndata\r\n| extend IsNew = strcat(name, '-', resultCode) !in (bigWindow)\r\n| where \"{Show}\" == \"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\" or IsNew == true\r\n//| summarize Count = count() by bin(timestamp, {TimeRange:grain}), ['Failure'] = iff(IsNew, 'New Failure', 'Existing Failure')\r\n| make-series Count = count() default = 0 on timestamp in range({TimeRange:start}, now(), {TimeRange:grain}) by ['Failure'] = iff(IsNew, 'New Failure', 'Existing Failure')\r\n\r\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "visualization": "barchart" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Failure Details" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "\n🔸 New Failure 🔹 Existing Failure" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let bigWindow = requests\n| where timestamp >= {TimeRange:start} - {UseComparisonTimeRangeOf} and timestamp <= {TimeRange:start}\n| where success == false\n| where name in ({Requests}) or '*' in ({Requests})\n| where resultCode in ({ResultCodes}) or '*' in ({ResultCodes}) or iff('@' in ({ResultCodes}), resultCode startswith '5', false) or iff('#' in ({ResultCodes}), resultCode startswith '4', false)\n| summarize by name, resultCode\n| summarize makelist(strcat(name, '-', resultCode), 100000);\nlet data = requests\n| where timestamp {TimeRange}\n| where name in ({Requests}) or '*' in ({Requests})\n| where resultCode in ({ResultCodes}) or '*' in ({ResultCodes}) or iff('@' in ({ResultCodes}), resultCode startswith '5', false) or iff('#' in ({ResultCodes}), resultCode startswith '4', false)\n| where success == false;\ndata\n| summarize Count = count(), Users = dcount(user_Id) by name, resultCode\n| extend IsNew = strcat(name, '-', resultCode) !in (bigWindow)\n| where \"{Show}\" == \"['New Failure Rate (%)'], ['Existing Failure Rate (%)']\" or IsNew == true\n| join kind=inner (data\n | make-series Trend = count() default = 0 on timestamp in range({TimeRange:start}, now(), {TimeRange:grain}) by name\n | project name, Trend\n ) on name\n| order by Users desc, Count desc, name asc\n| project ['Request Name'] = iff(IsNew, strcat('🔸 ', name), strcat('🔹 ', name)), ['Failed with Result Code'] = resultCode, ['Failures'] = Count, ['Users Affected'] = Users, ['Trend'] = Trend\n", + "showQuery": false, + "size": 0, + "aggregation": 2, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Failures", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Users Affected", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "max": null, + "palette": "greenRed" + } + } + ] + } + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Mitigation\nUse this section to list out the recovery steps for known issues. This allows sharing of information with future issue investigators. " + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Customizing your Troubleshooting Guide\n```\n1. Start editing this TSG by clicking on the 'Edit' button on the toolbar on top. \n2. Use the edit buttons on bottom-right of markdown control to update it's contents. \n3. Update the parameters to tune your analysis set.\n4. You can also update the underlying query or grid properties to personalize the analysis/view.\n5. If you want to have two sections for different performance counters, use the clone button at the bottom toolbar of a control. Use the ↑ or ↓ buttons to move the controls up or down.\n```\n" + }, + "conditionalVisibility": null, + "halfWidth": false + } + ] +} \ No newline at end of file diff --git a/TSG/Workbooks/Request Failures/settings.json b/TSG/Workbooks/Request Failures/settings.json new file mode 100644 index 0000000..d8ab029 --- /dev/null +++ b/TSG/Workbooks/Request Failures/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Request Failures", + "author": "Microsoft", + "galleries": [{ "type": "tsg", "resourceType": "microsoft.insights/components", "order": 100 }] +} \ No newline at end of file diff --git a/TSG/Workbooks/categoryResources.json b/TSG/Workbooks/categoryResources.json new file mode 100644 index 0000000..f8360d8 --- /dev/null +++ b/TSG/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Solve common problems with your application", "description": "", "order": 100} +} \ No newline at end of file diff --git a/Usage/Alerts/README b/Usage/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Usage/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Usage/Queries/README b/Usage/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Usage/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Usage/Workbooks/Active Users/Active Users.workbook b/Usage/Workbooks/Active Users/Active Users.workbook new file mode 100644 index 0000000..0b3e08f --- /dev/null +++ b/Usage/Workbooks/Active Users/Active Users.workbook @@ -0,0 +1,289 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Active Users\n\nActive users counts how many users have used your app at least once in a previous time period. It is typically used to answer -- *How many users does your app or feature have?*. Edit the `Activities` parameter below to customize what custom events and page views qualify as active usage. \n" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "593d7ebe-107d-4823-87dd-d020d2138611", + "version": "KqlParameterItem/1.0", + "name": "Metric", + "type": 2, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\n { \"value\":\"1d\", \"label\":\"Daily Active Users\", \"selected\":false },\n { \"value\":\"7d\", \"label\":\"Weekly Active Users\", \"selected\":false },\n { \"value\":\"28d\", \"label\":\"Monthly Active Users (28d)\", \"selected\":true },\n { \"value\":\"30d\", \"label\":\"Monthly Active Users (30d)\", \"selected\":false }\n]", + "timeContextFromParameter": null + }, + { + "id": "25a6fdc1-ae28-4886-9a5c-90254deb6a3d", + "version": "KqlParameterItem/1.0", + "name": "Activities", + "type": 2, + "description": "A comma separated set of Page views or Events that are to be counted as activities. Or user '*' to include all events.", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\n| where timestamp >= ago(7d)\n| summarize count() by name\n| order by count_ desc\n| project Id=name, Title=name, Selected=false\n| union (\ndatatable(Id:string, Title:string, Selected:boolean)[\n'*', 'All Events and Page Views', true,\n'%', 'All Page Views', false,\n'#', 'All Custom Events', false\n]\n)", + "isHiddenWhenLocked": false + }, + { + "id": "79126a9c-4ec6-4719-872a-f4a9b022e8f9", + "version": "KqlParameterItem/1.0", + "name": "OtherFilters", + "type": 1, + "description": "A KQL snippet that further filters the activities. Example: | where application_Version == '1.0'", + "isRequired": false + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let start = startofday(ago({Metric}));\nunion customEvents, pageViews\n| where timestamp >= start\n| where name in ({Activities}) or '*' in ({Activities}) or ('%' in ({Activities}) and itemType == 'pageView') or ('#' in ({Activities}) and itemType == 'customEvent')\n{OtherFilters}\n| summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Views = count()\n| evaluate narrow()\n| project Title = case(Column == 'Users', 'Active Users', Column == 'Sessions', 'Unique Sessions', 'Views'), Metric = Value, SubTitle = '━━'", + "showQuery": false, + "size": 3, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Title", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "subtitleContent": { + "columnMatch": "SubTitle", + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Metric", + "formatter": 12, + "formatOptions": { + "min": 0, + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false + } + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "25e8351b-5036-4438-86dc-10eb4151e014", + "version": "KqlParameterItem/1.0", + "name": "SplitBy", + "type": 2, + "isRequired": true, + "query": "datatable(value:string, text:string)[\n'name', '📛 Activity Name',\n'cloud_RoleInstance', '🖥️ Machine',\n'client_CountryOrRegion', '📍 Country or Region',\n'client_StateOrProvince', '📍 State or Province',\n'client_City', '📍 City',\n'client_Browser', '🌐 Client Browser',\n'client_OS', '🖥️ Client Operating System',\n'client_Model', '📱 Client Model',\n'application_Version', '⚪ Application Version',\n'operation_Name', '⚪ Operation',\n]\n| extend selected = false, group = 'Standard'\n| union (union pageViews, customEvents\n| where timestamp >= ago(1d)\n| where name in ({Activities}) or '*' in ({Activities})\n| project customDimensions \n| summarize schema = buildschema(customDimensions) \n| mvexpand schema\n| extend e = extract(@'{\"(.+)\":.+}', 1, tostring(schema))\n| project text = strcat('❄️ ', e), value = strcat('customDimensions[\"', e, '\"]')\n| extend selected = false, group = 'Custom')", + "value": "name", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let start = startofday(ago({Metric}));\r\nlet events = union customEvents, pageViews\r\n| where timestamp >= start\r\n| where name in ({Activities}) or '*' in ({Activities}) or ('%' in ({Activities}) and itemType == 'pageView') or ('#' in ({Activities}) and itemType == 'customEvent')\r\n{OtherFilters}\r\n| extend Dim1 = tostring({SplitBy});\r\nlet overall = events | summarize Users = dcount(user_Id);\r\nlet allUsers = toscalar(overall);\r\nevents\r\n| summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Instances = count() by Dim1\r\n| extend DisplayDim = strcat('🔹 ', Dim1)\r\n| order by Users desc\r\n| project Dim1, DisplayDim, Users, Sessions, Instances\r\n| project ['Activities'] = DisplayDim, Values = Dim1, ['Active Users'] = Users, ['Unique Sessions'] = Sessions, ['Total Instances'] = Instances\r\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "exportFieldName": "Values", + "exportParameterName": "Filter", + "exportDefaultValue": "All events", + "showAnalytics": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Value", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Active Users", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Unique Sessions", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Total Instances", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "alwaysShowPin": true + }, + { + "type": 1, + "content": { + "json": "## Trend of Active Users\nSelect a row from the table above to see changes in active usage for that item." + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "232e6104-dba9-4c57-88ac-1962aeb15287", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 2592000000 + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + }, + "timeContextFromParameter": null + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ts = {TimeRange:end} - {TimeRange:start};\r\nlet start = startofday(ago(ts + {Metric}));\r\nunion customEvents, pageViews\r\n| where timestamp >= start\r\n| where name in ({Activities}) or '*' in ({Activities}) or ('%' in ({Activities}) and itemType == 'pageView') or ('#' in ({Activities}) and itemType == 'customEvent')\r\n{OtherFilters}\r\n| where '{Filter}' == 'All events' or '{Filter}' == '🔸 Overall' or {SplitBy} == '{Filter}'\r\n| evaluate activity_engagement(user_Id, timestamp, start, now(), 1d, {Metric})\r\n| where timestamp >= startofday(ago(ts))\r\n| project timestamp, [\"{Filter}\"] = dcount_activities_outer\r\n| render timechart ", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "showAnalytics": true, + "color": "blue", + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "areachart" + }, + "conditionalVisibility": null, + "alwaysShowPin": true + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Usage/Workbooks/Active Users/settings.json b/Usage/Workbooks/Active Users/settings.json new file mode 100644 index 0000000..46ab02e --- /dev/null +++ b/Usage/Workbooks/Active Users/settings.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Active Users", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 100 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 100 + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/Analysis of Page Views/Analysis of Page Views.workbook b/Usage/Workbooks/Analysis of Page Views/Analysis of Page Views.workbook new file mode 100644 index 0000000..4b845e1 --- /dev/null +++ b/Usage/Workbooks/Analysis of Page Views/Analysis of Page Views.workbook @@ -0,0 +1,336 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Analysis of Page Views\nPage views correspond to user activity in your app. Understanding how your users interact with your pages will give you good insights into what is working in your app and what aspects need improvements. \n\nThis report will help you understand common page view behaviors like:\n* Usage\n* Time spent on page\n* Time to first interaction\n* Exit rates \n\nIf your telemetry does not include page views, then follow these [instructions](https://docs.microsoft.com/en-us/azure/application-insights/app-insights-javascript) to begin collecting -- it is relatively straightforward." + }, + "name": "Description text" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "2006c356-d32b-4f16-a22c-6a76d0e84288", + "version": "KqlParameterItem/1.0", + "name": "Pages", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let mostUsedEvent = union pageViews\n| where timestamp >= ago(7d)\n| summarize Count = count() by name\n| top 3 by Count desc\n| summarize makelist(name);\nunion pageViews\n| where timestamp >= ago(7d)\n| summarize Count = count() by name\n| extend IsSelected = iff(name in (mostUsedEvent), true, false)\n| order by Count desc\n| project v = name, t = name, IsSelected\n| union (\ndatatable(v:string, t:string, IsSelected:boolean)[\n'*', 'All Page Views', false\n]\n)" + }, + { + "id": "03ad1f6b-7d7c-4abc-8b8d-446621ad479e", + "version": "KqlParameterItem/1.0", + "name": "OtherFilters", + "type": 1, + "description": null, + "value": "" + }, + { + "id": "815b8c50-0d4a-4374-a073-bc9394103aed", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 2, + "description": null, + "isRequired": true, + "query": "datatable(key:string, display:string) \n[ \n\"1h\", \"Last Hour\", \n\"1d\", \"Last 24 hours\", \n\"2d\", \"Last 48 hours\", \n\"3d\", \"Last 3 days\", \n\"7d\", \"Last 7 days\", \n\"14d\", \"Last 14 days\", \n\"30d\", \"Last 30 days\", \n\"60d\", \"Last 60 days\", \n\"90d\", \"Last 90 days\"\n] ", + "value": "30d" + }, + { + "id": "4548f4fe-0130-42c9-b796-385cd12ccb24", + "version": "KqlParameterItem/1.0", + "name": "OptimizeCalculationsFor", + "type": 2, + "description": "Use this parameter to essentially set the number of user sessions to use in calculations (sampling). This allows you to find the right balance between performance and accuracy for your analysis. Optimize for: Performance = 10,000 sessions, Balance = 100,000 samples, Accuracy = 1,000,000 sessions", + "isRequired": true, + "query": "datatable(x:string, y:string)[\n'10000', 'Performance',\n'100000', 'Balance',\n'1000000', 'Accuracy'\n]", + "value": "100000" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "Common parameter block" + }, + { + "type": 1, + "content": { + "json": "---\n## Usage\nThis section helps you understand how the pages of your app are used -- in terms of # of users, sessions and views. " + }, + "name": "Usage section text" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\nlet allEvents = pageViews\n| where timestamp > ago(timeRange);\nlet interestingEvents = allEvents\n| where name in ({Pages}) or '*' in ({Pages}) \n{OtherFilters};\ninterestingEvents\n| summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Instances = count() by name\n| extend rank = 2, name = strcat('🔷 ', name)\n| union (interestingEvents\n | summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Instances = count()\n | extend name = '🔶 Overall', rank = 1)\n| extend jkey = 1\n| join kind = inner (allEvents \n | summarize AllUsers = dcount(user_Id), AllSessions = dcount(session_Id), AllInstances = count()\n | extend jkey = 1) on jkey \n| project ['Page Name'] = name, ['Unique Users'] = Users, ['As % of app Users'] = round(100.0 * Users / AllUsers, 2),\n ['Unique Sessions'] = Sessions, ['As % of app Sessions'] = round(100.0 * Sessions / AllSessions, 2),\n ['Total Page Views'] = Instances , ['As % of app Page Views'] = round(100.0 * Instances / AllInstances, 2), rank\n| order by rank asc, ['Unique Users'] desc\n| project-away rank", + "size": 1, + "showAnalytics": true, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Unique Users", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Unique Sessions", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + }, + { + "columnMatch": "Total Page Views", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "yellow" + } + } + ], + "filter": true + } + }, + "showPin": true, + "name": "Usage grid" + }, + { + "type": 1, + "content": { + "json": "- The `As % of App Users/Sessions/Views` columns compare the usage of the selected page view with that of the whole app.\n" + }, + "name": "Usage footer text" + }, + { + "type": 1, + "content": { + "json": "---\n## Time Spent on Page\nThis report helps you understand the time spent by customers in your pages. Longer time spent pages usually indicates good engagement and is generally the desired behavior." + }, + "name": "Time spent on page text" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "0411936a-4cb9-44dd-946d-b449ce3b284e", + "version": "KqlParameterItem/1.0", + "name": "IgnoreDurationsOver", + "type": 1, + "description": "Use this parameter to filter our page views that took more time that is possible (for example left open in a non-active tab). The default is 1 hour. ", + "isRequired": true, + "query": "datatable(x:string)[ '3600s' ]" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "Time spent on page parameter block" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\nlet samples = {OptimizeCalculationsFor};\nlet pageDurationThreshold = {IgnoreDurationsOver};\nlet allEvents = union pageViews\n| where timestamp > ago(timeRange);\nlet allInterestingEvents = allEvents\n| where name in ({Pages}) or '*' in ({Pages}) \n{OtherFilters};\nlet sampledSessions = materialize(allInterestingEvents\n| summarize by session_Id\n| sample samples\n| summarize makelist(session_Id, samples));\nlet data = allInterestingEvents\n| where session_Id in (sampledSessions)\n| project session_Id, timestamp, name\n| join kind= inner (allEvents\n | where session_Id in (sampledSessions)\n | project session_Id, timestamp\n ) on session_Id \n| project session_Id, TimeDiff = timestamp - timestamp1, name, timestamp\n| where TimeDiff > 0s and TimeDiff <= pageDurationThreshold\n| summarize SecondsSpentOnPage = min(TimeDiff) / 1s by session_Id, name, timestamp;\ndata\n| summarize Instances = count(), (Median, p75, p90) = percentiles(SecondsSpentOnPage, 50, 75, 90), Mean = avg(SecondsSpentOnPage) by name\n| extend rank = 2, name = strcat('🔷 ', name)\n| union (data\n | summarize Instances = count(), (Median, p75, p90) = percentiles(SecondsSpentOnPage, 50, 75, 90), Mean = avg(SecondsSpentOnPage)\n | extend name = '🔶 Overall', rank = 1)\n| order by rank asc, Median desc\n| project-away rank\n| project ['Page Name'] = name, ['Sampled Page Views'] = Instances, ['Median (seconds)'] = round(Median, 1), ['75th Percentile (seconds)'] = round(p75, 1), ['90th Percentile (seconds)'] = round(p90, 1), ['Mean (seconds)'] = round(Mean, 1)", + "size": 1, + "showAnalytics": true, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Sampled Page Views", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Median (seconds)", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "yellow" + } + }, + { + "columnMatch": "90th Percentile (seconds)", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + } + ], + "filter": true + } + }, + "showPin": true, + "name": "Time spent on page grid" + }, + { + "type": 1, + "content": { + "json": "- The calculations may use sampling based on the `OptimizeCalculationsFor` parameter. \n- Time Spent on Page does not consider exit pages (last page of the session) in this calculations. The `Sampled Page Views` column may be fewer than the sampling count of {OptimizeCalculationsFor} because of this.\n" + }, + "name": "Time spent on page footer" + }, + { + "type": 1, + "content": { + "json": "---\n## Time to First Interaction\nThis report helps you understand the time taken by customers to first interact with critical features of your app. It can help you uncover issues with discoverability of your features or the intuitiveness of your app's UI/flow." + }, + "name": "Time to First Interaction text" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "65e9a492-2e89-477a-a041-e99a61481c65", + "version": "KqlParameterItem/1.0", + "name": "TimeFrom", + "type": 2, + "description": "For users, the first use is calculated as the first use within the time range. It is possible that the user started using your app before the time range.", + "isRequired": true, + "query": "datatable(x:string, y:string)[\n'session_Id', 'Start of the Session',\n'user_Id', 'First use by Anonymous User ⚠️',\n'user_AuthenticatedId', 'First use by Authenticated User ⚠️',\n];", + "value": "session_Id" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "Time to First Interaction parameter block" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let samples = {OptimizeCalculationsFor};\nlet allEvents = union customEvents, pageViews\n| where timestamp > ago({TimeRange});\nlet allInterestingEvents = allEvents\n| where name in ({Pages}) or '*' in ({Pages})\n{OtherFilters};\nlet sampledSessions = materialize(allInterestingEvents\n| summarize by {TimeFrom}\n| sample samples\n| summarize makelist({TimeFrom}, samples));\nlet sessionStart = allEvents\n| where {TimeFrom} in (sampledSessions)\n| summarize Start = min(timestamp) by {TimeFrom};\nlet firstInterestingEvent = allInterestingEvents\n| where {TimeFrom} in (sampledSessions)\n| summarize Interaction = min(timestamp) by {TimeFrom}, name;\nlet segmentedFirstInteraction = firstInterestingEvent\n| join kind = inner (sessionStart) on {TimeFrom}\n| project FirstInteractionTime = Interaction - Start, name\n| summarize Sessions = count(), Mean = avg(FirstInteractionTime), (Median, p75, p90) = percentiles(FirstInteractionTime, 50, 75, 90) by name;\nsegmentedFirstInteraction\n| union (firstInterestingEvent\n| summarize Interaction = min(Interaction) by {TimeFrom}\n| join kind = inner (sessionStart) on {TimeFrom}\n| project FirstInteractionTime = Interaction - Start\n| summarize Sessions = count(), Mean = avg(FirstInteractionTime), (Median, p75, p90) = percentiles(FirstInteractionTime, 50, 75, 90)\n| extend name = '🔶 Overall', o = 0m)\n| extend Mean = round(Mean / 1m, 2), Median = round(Median / 1m, 2), p75 = round(p75 / 1m, 2), p90 = round(p90 / 1m, 2)\n| order by o asc, Median asc, Sessions desc\n| project [\"Page Name\"] = name, ['Sampled Views'] = Sessions, ['Median (in minutes)'] = Median, ['75th Percentile (in minutes)'] = p75, ['90th Percentile (in minutes)'] = p90, ['Mean (in minutes)'] = Mean\n", + "size": 1, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Sampled Views", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Median (in minutes)", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "yellow" + } + }, + { + "columnMatch": "90th Percentile (in minutes)", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + } + ] + } + }, + "name": "Time to First Interaction grid" + }, + { + "type": 1, + "content": { + "json": "- The calculation may use sampling based on the `OptimizeCalculationsFor` parameter. " + }, + "name": "Time to First Interaction footer" + }, + { + "type": 1, + "content": { + "json": "---\n## Page Exit Rates\nA page view is said to have contributed to an _exit_ when it is the last page viewed in the session. The user is presumed to have exited your app -- either by navigating to another app or closing the app/browser. \n\nA page's _exit rate_ is the percentages of views that were the last in the session. " + }, + "name": "Page Exit Rates text" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let samples = {OptimizeCalculationsFor};\nlet allEvents = pageViews\n| where timestamp > ago({TimeRange});\nlet allInterestingEvents = allEvents\n| where name in ({Pages}) or '*' in ({Pages})\n{OtherFilters};\nlet sampledSessions = materialize(allInterestingEvents\n| summarize by session_Id\n| sample samples\n| summarize makelist(session_Id, samples));\nlet bounces = allEvents\n| where session_Id in (sampledSessions)\n| summarize (timestamp, name) = argmax(timestamp, name) by session_Id;\nlet sessionsWithInterestingEvents = allInterestingEvents\n| where session_Id in (sampledSessions);\nlet allSessionData = sessionsWithInterestingEvents\n| summarize Sessions = dcount(session_Id) by name\n| union (sessionsWithInterestingEvents\n | summarize Sessions = dcount(session_Id) | extend name = 'Overall');\nlet bouncesWithInterestingEvents = bounces\n| where name in ({Pages}) or '*' in ({Pages});\nbouncesWithInterestingEvents\n| summarize BouncedSessions = dcount(session_Id) by name\n| extend rank = 2\n| union (bouncesWithInterestingEvents\n | summarize BouncedSessions = dcount(session_Id) | extend name = 'Overall', rank = 1)\n| join kind=inner\n(\n allSessionData\n)\non name\n| extend BounceRate = round(100.0 * BouncedSessions / Sessions, 2)\n| order by rank asc, BounceRate desc\n| project ['Page Name'] = iff(name == 'Overall', '🔶 Overall', strcat('🔷 ', name)), ['Sampled Sessions with Page View'] = Sessions, ['Sampled Sessions Ended after Page View'] = BouncedSessions, ['Exit Rate (%)'] = BounceRate", + "size": 1, + "showAnalytics": true, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Sampled Sessions", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Exit Rate (%)", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "red" + } + } + ], + "filter": true + } + }, + "showPin": true, + "name": "Page Exit Rates grid" + }, + { + "type": 1, + "content": { + "json": "- The calculation may use sampling based on the `OptimizeCalculationsFor` parameter. " + }, + "name": "Page Exit Rates footer" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Usage/Workbooks/Analysis of Page Views/settings.json b/Usage/Workbooks/Analysis of Page Views/settings.json new file mode 100644 index 0000000..a384936 --- /dev/null +++ b/Usage/Workbooks/Analysis of Page Views/settings.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Analysis of Page Views", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 200 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 200 + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/Authenticated User Timelines/Authenticated User Timelines.workbook b/Usage/Workbooks/Authenticated User Timelines/Authenticated User Timelines.workbook new file mode 100644 index 0000000..dc707b6 --- /dev/null +++ b/Usage/Workbooks/Authenticated User Timelines/Authenticated User Timelines.workbook @@ -0,0 +1,232 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "56bff189-54ce-4f6d-adf1-df790e73335d", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "description": null, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 3600000, + "createdTime": "2018-07-12T17:27:00.402Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-07-12T17:27:00.402Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-07-12T17:27:00.402Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-07-12T17:27:00.403Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-07-12T17:27:00.403Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2419200000, + "createdTime": "2018-07-12T17:27:00.403Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-07-12T17:27:00.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-07-12T17:27:00.404Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 86400000, + "createdTime": "2018-07-12T17:27:00.402Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + }, + { + "id": "d1288833-1dd3-49d2-8d8e-edff22b4bbdb", + "version": "KqlParameterItem/1.0", + "name": "Activities", + "type": 2, + "description": null, + "isRequired": false, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union pageViews, customEvents\r\n| where timestamp {TimeRange}\r\n| summarize Count = count() by name, itemType\r\n| order by Count desc\r\n| take 1000\r\n| order by name asc\r\n| project Name=name, Display=strcat(iff(itemType == 'customEvent', '⚡', '🌐'), ' ', name)\r\n| union (\r\ndatatable(Name:string, Display:string)['*', 'Any Custom Event or Page View'])", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components", + "value": [ + "*" + ] + }, + { + "id": "87d7958a-bfb1-4c19-a43f-3c96b6e67573", + "version": "KqlParameterItem/1.0", + "name": "Show", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(value:string, text:string)[\r\n'take 100', 'Top users',\r\n'sample 100', 'Random sampling of users'\r\n]", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components", + "value": "sample 100" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Sample Users" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union customEvents, pageViews\r\n| where timestamp {TimeRange}\r\n| where name in ({Activities}) or '*' in ({Activities})\r\n| summarize Sessions = dcount(session_Id), Activities = count() by UserId = user_AuthenticatedId\r\n| order by Sessions desc, Activities desc\r\n| project User = strcat('👤 ', UserId), Sessions, Activities, UserId\r\n| {Show}\r\n| order by Sessions desc, Activities desc\r\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "exportFieldName": "UserId", + "exportParameterName": "UserId", + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Sessions", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Activities", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + }, + { + "columnMatch": "UserId", + "formatter": 5, + "formatOptions": {} + } + ] + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "💡 *Select a user row to see all sessions for the user.*" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Their Sessions" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let monthName = (month:int) {\r\n case(\r\n month == 1, 'January',\r\n month == 2, 'February', \r\n month == 3, 'March', \r\n month == 4, 'April', \r\n month == 5, 'May', \r\n month == 6, 'June', \r\n month == 7, 'July', \r\n month == 8, 'August', \r\n month == 9, 'September', \r\n month == 10, 'October', \r\n month == 11, 'November', \r\n month == 12, 'December',\r\n ''\r\n )\r\n};\r\nunion customEvents, pageViews\r\n| where timestamp {TimeRange}\r\n| where user_AuthenticatedId == '{UserId}'\r\n| where name in ({Activities}) or '*' in ({Activities})\r\n| summarize Activities = count(), Start = min(timestamp) by SessionId = session_Id\r\n| order by Start desc\r\n| project ['Session Start'] = strcat('⌚ ', monthName(monthofyear(Start)), ' ', dayofmonth(Start), ', ', tolower(format_datetime(Start, 'h:mm tt'))), Activities, SessionId\r\n//'⌚'", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Activities", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "SessionId", + "formatter": 7, + "formatOptions": { + "linkTarget": "SessionTimeline", + "linkLabel": "Session timeline" + } + } + ] + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "💡 *Click on Session Details to see the session timeline.*" + }, + "conditionalVisibility": null + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/Authenticated User Timelines/settings.json b/Usage/Workbooks/Authenticated User Timelines/settings.json new file mode 100644 index 0000000..3f68a4f --- /dev/null +++ b/Usage/Workbooks/Authenticated User Timelines/settings.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Authenticated User Timelines", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 1000 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 1000 + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/Engaged Users/Engaged Users.workbook b/Usage/Workbooks/Engaged Users/Engaged Users.workbook new file mode 100644 index 0000000..ab43152 --- /dev/null +++ b/Usage/Workbooks/Engaged Users/Engaged Users.workbook @@ -0,0 +1,126 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Engaged Users\n---\nAn _engaged_ user is someone who has used your app a certain number of days within a time window. For instance, you could define an engaged user as a person who used feature X on at least _5_ unique days over a 30 day range. This allows you to differentiate serious users of your app from the more casual ones. \n\nUse the `Activities` parameter to choose the events that count towards engagement. The `Period`, `DaysUsed` and `CustomDaysUsed` parameters allow you to select set the engagement definitions. \n" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "fb53a45c-54cd-4583-8e1d-7e05e168ef60", + "version": "KqlParameterItem/1.0", + "name": "Activities", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\r\n| where timestamp >= ago(7d)\r\n| summarize count() by name\r\n| order by count_ desc\r\n| project Id=name, Title=name, Selected=false\r\n| union (\r\ndatatable(Id:string, Title:string, Selected:boolean)[\r\n'*', 'All Events and Page Views', true\r\n]\r\n)" + }, + { + "id": "ec53bf53-d708-4c63-b079-438039757a7c", + "version": "KqlParameterItem/1.0", + "name": "Period", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(x:string, y:string)[\r\n'7d', '7 days',\r\n'28d', '28 days',\r\n'30d', '30 days',\r\n]", + "value": "28d" + }, + { + "id": "b5e1b1b3-d133-48ca-9d40-7d6b6b32775b", + "version": "KqlParameterItem/1.0", + "name": "DaysUsed", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(x:string, y:string)[\r\n'5d', '5+ days',\r\n'2d, 7d', '2-7 days and 7+ days',\r\n'1d, 2d, 12d', '1-2 days, 2-12 days and 12+ days',\r\n]", + "value": "2d, 7d" + }, + { + "id": "b8a702da-adba-4fcf-b5a4-d2bdf4626087", + "version": "KqlParameterItem/1.0", + "name": "CustomDaysUsed", + "type": 1, + "description": null, + "isRequired": true, + "query": "datatable(x:string)[\"{DaysUsed}\"]" + }, + { + "id": "122307c6-fffe-427c-b416-272344fd64fa", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(key:string, display:string) \r\n[ \r\n\"7d\", \"Last 7 days\", \r\n\"14d\", \"Last 14 days\", \r\n\"30d\", \"Last 30 days\", \r\n\"60d\", \"Last 60 days\", \r\n\"90d\", \"Last 90 days\"\r\n] ", + "value": "30d" + } + ] + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\nlet monthDefinition = {Period};\nlet start = startofday(ago(timeRange + monthDefinition));\nlet userTypes = array_concat(dynamic([{CustomDaysUsed}]), dynamic([{Period}]));\nlet groups = range i from 1 to 1 step 1\n| extend types = userTypes\n| mvexpand types\n| extend groups = totimespan(types) \n| project groups\n| serialize rank = row_number()\n| extend jkey = 1;\nlet groupTitles = groups\n| join kind=inner (groups) on jkey\n| where rank1 - rank == 1\n| project Group = tolong(groups / 1d), OtherGroup = tolong(groups1 / 1d)\n| extend GroupName = strcat(Group, ' to ', OtherGroup - 1, ' days')\n| project-away OtherGroup;\nlet cohorts = range day from 1d to monthDefinition - 1d step 1d\n| extend types = userTypes\n| mvexpand types\n| extend types = totimespan(types) \n| where day >= types\n| summarize Group = max(types) by day\n| extend day = tolong(day / 1d), Group = tolong(Group / 1d);\nlet usage = union customEvents, pageViews\n| where timestamp >= start\n| where name in ({Activities}) or '*' in ({Activities})\n| summarize Count = max(1) by User = user_Id, UsageDay = bin(timestamp, 1d);\nrange i from 0d to timeRange step 1d\n| extend Day = startofday(now() - i)\n| extend m = range(0d, monthDefinition - 1d, 1d)\n| mvexpand m\n| extend MonthForThisDay = Day - totimespan(m)\n| project Day, MonthForThisDay\n| join kind=inner (usage | project Count, User, MonthForThisDay = UsageDay) on MonthForThisDay\n| summarize UsedDays = sum(Count) by User, Day\n| join kind=inner (cohorts | project Group, UsedDays = day) on UsedDays\n| summarize Users=count() by Day, Group\n| join kind=inner (groupTitles) on Group\n| project Day, Users, GroupName \n", + "showQuery": false, + "size": 2, + "aggregation": 5, + "showAnnotations": false, + "visualization": "barchart" + } + }, + { + "type": 1, + "content": { + "json": "## Growth Rates\n" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "d88ea1b4-f648-4084-81b8-b1149651b029", + "version": "KqlParameterItem/1.0", + "name": "Show", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(val: string, text: string)[\r\n'1d', 'Daily Growth Rate',\r\n'7d', 'Weekly Growth Rate',\r\n'28d', 'Monthly Growth Rate (28d)',\r\n'30d', 'Monthly Growth Rate (30d)',\r\n'365d', 'Annual Growth Rate',\r\n]\r\n| extend isdefault = iff(val == '{Period}', true, false)" + } + ] + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\nlet monthDefinition = {Period};\nlet start = startofday(ago(timeRange + monthDefinition));\nlet userTypes = array_concat(dynamic([{CustomDaysUsed}]), dynamic([{Period}]));\nlet groups = range i from 1 to 1 step 1\n| extend types = userTypes\n| mvexpand types\n| extend groups = totimespan(types) \n| project groups\n| serialize rank = row_number()\n| extend jkey = 1;\nlet groupTitles = groups\n| join kind=inner (groups) on jkey\n| where rank1 - rank == 1\n| project Group = tolong(groups / 1d), OtherGroup = tolong(groups1 / 1d)\n| extend GroupName = strcat(Group, ' to ', OtherGroup - 1, ' days')\n| project-away OtherGroup;\nlet cohorts = range day from 1d to monthDefinition - 1d step 1d\n| extend types = userTypes\n| mvexpand types\n| extend types = totimespan(types) \n| where day >= types\n| summarize Group = max(types) by day\n| extend day = tolong(day / 1d), Group = tolong(Group / 1d);\nlet usage = union customEvents, pageViews\n| where timestamp >= start\n| where name in ({Activities}) or '*' in ({Activities})\n| summarize Count = max(1) by User = user_Id, UsageDay = bin(timestamp, 1d);\nrange i from 0d to timeRange step 1d\n| where i == 0d or i == timeRange - 1d // -1d so that growth is computed on data for a full day\n| extend Day = startofday(now() - i)\n| extend m = range(0d, monthDefinition - 1d, 1d)\n| mvexpand m\n| extend MonthForThisDay = Day - totimespan(m)\n| project Day, MonthForThisDay\n| join kind=inner (usage | project Count, User, MonthForThisDay = UsageDay) on MonthForThisDay\n| summarize UsedDays = sum(Count) by User, Day\n| join kind=inner (cohorts | project Group, UsedDays = day) on UsedDays\n| summarize Users=count() by Day, Group\n| join kind=inner (groupTitles) on Group\n| project Day, Users, GroupName \n| summarize (LastDay, LastDayUsers) = argmax(Day, Users), (FirstDay, FirstDayUsers) = argmin(Day, Users) by GroupName\n| extend SimpleGrowth = 100.0 * (LastDayUsers - FirstDayUsers) / (FirstDayUsers * (1.0 * (LastDay - FirstDay) / {Show}))\n| extend CompoundGrowth = 100.0 * (pow(1.0 * LastDayUsers / FirstDayUsers, 1.0 / ((LastDay - FirstDay) / {Show})) - 1)\n| project [\"Engagement Group\"] = GroupName, [\"Users at the Begining\"] = FirstDayUsers, [\"Users at the End\"] = LastDayUsers, [\"# of Periods\"] = round((LastDay - FirstDay) / {Period}, 1), [\"Growth Rate (%)\"] = round(SimpleGrowth, 2), [\"Compounded Growth Rate (%)\"] = round(CompoundGrowth, 2)", + "showQuery": false, + "size": 2, + "aggregation": 5, + "showAnnotations": false, + "visualization": "table" + } + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/Engaged Users/settings.json b/Usage/Workbooks/Engaged Users/settings.json new file mode 100644 index 0000000..4f97190 --- /dev/null +++ b/Usage/Workbooks/Engaged Users/settings.json @@ -0,0 +1,18 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Engaged Users", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 400 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 400 + } + + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/New, Returning and Churned Users/New, Returning and Churned Users.workbook b/Usage/Workbooks/New, Returning and Churned Users/New, Returning and Churned Users.workbook new file mode 100644 index 0000000..f28a2e8 --- /dev/null +++ b/Usage/Workbooks/New, Returning and Churned Users/New, Returning and Churned Users.workbook @@ -0,0 +1,158 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# New, Returning and Churned Users\n\nHow well does your app keep users coming back? Understanding your app's churn -- when people use your app, but then don't come back -- is key to growing usage of your app. This workbook analyzes:\n- Active usage of your app\n- How many users churned since the previous period\n- The growth opportunity presented by retaining more of these users." + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "b3d5a360-d38d-458e-bb47-832d9f5be0e7", + "version": "KqlParameterItem/1.0", + "name": "Metric", + "type": 2, + "description": "Defines the number of days in a month. Use 30d for a more traditional representation of a month. Use 28d to prevent weekly ups/downs due to weekends.", + "isRequired": true, + "multiSelect": null, + "query": "datatable(key: string, display: string)[\r\n'1d', 'Daily Active Users',\r\n'7d', 'Weekly Active Users',\r\n'28d', 'Monthly Active Users (28d)',\r\n'30d', 'Monthly Active Users (30d)',\r\n]", + "value": "28d" + }, + { + "id": "a909d4b8-0e7f-4234-b716-8ffb02c480cc", + "version": "KqlParameterItem/1.0", + "name": "Activities", + "type": 2, + "description": "A comma seperated list of activities to count (e.g. 'EventA', 'EventB', 'PageViewC'). Use '*' if you want to include all events and page views.", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\n| where timestamp >= ago(7d)\n| summarize count() by name\n| order by count_ desc\n| project Id=name, Title=name, Selected=false\n| union (\ndatatable(Id:string, Title:string, Selected:boolean)[\n'*', 'All Events and Page Views', true\n]\n)" + }, + { + "name": "OtherFilters", + "description": "Other filters to use", + "id": "f5554bff-7f79-444a-8073-5f9592474a0c", + "type": 1 + }, + { + "id": "e047acc1-8ea3-49da-afe8-d6bf36afc61e", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 2, + "description": "Time range for analysis", + "isRequired": true, + "multiSelect": null, + "query": "datatable(key:string, display:string) \r\n[ \r\n\"7d\", \"Last 7 days\", \r\n\"14d\", \"Last 14 days\", \r\n\"30d\", \"Last 30 days\", \r\n\"60d\", \"Last 60 days\", \r\n\"90d\", \"Last 90 days\"\r\n] ", + "value": "30d" + } + ] + } + }, + { + "type": 1, + "content": { + "json": "## Active Users" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\nlet monthDefinition = {Metric};\nlet hlls = union customEvents, pageViews\n| where timestamp >= startofmonth(now() - timeRange - 2 * monthDefinition)\n| where name in ({Activities}) or '*' in ({Activities})\n{OtherFilters}\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\n| project DaysToMerge = timestamp, Hlls;\nlet churnSeriesWithHllsToInclude = materialize(range d from 0d to timeRange step 1d\n| extend Day = startofday(now() - d)\n| extend R = range(0d, monthDefinition - 1d, 1d)\n| mvexpand R\n| extend ThisMonth = Day - totimespan(R)\n| extend LastMonth = Day - monthDefinition - totimespan(R)\n| project Day, ThisMonth, LastMonth);\nchurnSeriesWithHllsToInclude\n| extend DaysToMerge = ThisMonth\n| join kind= inner (hlls) on DaysToMerge \n| project Day, ThisMonthHlls = Hlls\n| union (\nchurnSeriesWithHllsToInclude\n| extend DaysToMerge = LastMonth\n| join kind= inner (hlls) on DaysToMerge\n| project Day, LastMonthHlls = Hlls)\n| summarize ThisMonth = hll_merge(ThisMonthHlls), LastMonth = hll_merge(LastMonthHlls) by Day\n| evaluate dcount_intersect(ThisMonth, LastMonth)\n| extend NewUsers = s0 - s1\n| extend ChurnedUsers = -1 * (dcount_hll(LastMonth) - s1) // Last Months Users - Returning Users\n| project Day, [\"Active Users\"] = s1 + NewUsers, [\"Returning Users\"] = s1, [\"Lost Users\"] = ChurnedUsers, [\"New Users\"] = NewUsers\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "timechart" + } + }, + { + "type": 1, + "content": { + "json": "| Metric | Definition |\n| ----- |: ----- |: ----- |\n| Active users | Count of how many people used your app at least once this period. Active Users = Returning users + New users. |\n| Returning users | Count of how many people used your app at least once this period and the previous period. |\n| New users | Count of how many people used your app at least once in the last period, but did not use it the previous period. |\n| Lost users | Count of how many people used your app the previous period but not this period. |" + } + }, + { + "type": 1, + "content": { + "json": "## Usage Growth\nThis chart shows you the trend of the {Period} growth rates of your app. This allows you to analyze how your New, Returning, Lost and Overall users growth rates change over time -- for instance see if growth is accelerating, decelerating or holding steady. \n\nThe metrics at the bottow show the current growth rate. The `Active Users` series shows the overall usage growth rate." + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\nlet monthDefinition = {Metric};\nlet hlls = union customEvents, pageViews\n| where timestamp >= startofmonth(now() - 2 * timeRange - 2 * monthDefinition)\n| where name in ({Activities}) or '*' in ({Activities})\n{OtherFilters}\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\n| project DaysToMerge = timestamp, Hlls;\nlet churnSeriesWithHllsToInclude = materialize(range d from 0d to 2 * timeRange step 1d\n| extend Day = startofday(now() - d)\n| extend R = range(0d, monthDefinition - 1d, 1d)\n| mvexpand R\n| extend ThisMonth = Day - totimespan(R)\n| extend LastMonth = Day - monthDefinition - totimespan(R)\n| project Day, ThisMonth, LastMonth);\nlet activeUsers = churnSeriesWithHllsToInclude\n| extend DaysToMerge = ThisMonth\n| join kind= inner (hlls) on DaysToMerge \n| project Day, ThisMonthHlls = Hlls\n| union (\nchurnSeriesWithHllsToInclude\n| extend DaysToMerge = LastMonth\n| join kind= inner (hlls) on DaysToMerge\n| project Day, LastMonthHlls = Hlls)\n| summarize ThisMonth = hll_merge(ThisMonthHlls), LastMonth = hll_merge(LastMonthHlls) by Day\n| evaluate dcount_intersect(ThisMonth, LastMonth)\n| extend NewUsers = s0 - s1\n| extend ChurnedUsers = -1 * (dcount_hll(LastMonth) - s1) // Last Months Users - Returning Users\n| project Day, ActiveUsers = s1 + NewUsers, ReturningUsers = s1, ChurnedUsers, NewUsers;\nactiveUsers\n| extend LastPeriod = Day - monthDefinition\n| join kind=inner (activeUsers | project-rename LastPeriod = Day) on LastPeriod\n| project Day, [\"Active Users\"] = 100.0 * (ActiveUsers - ActiveUsers1) / ActiveUsers1, [\"Returning Users\"] = 100.0 * (ReturningUsers - ReturningUsers1) / ReturningUsers1, [\"Lost Users\"] = 100.0 * (ChurnedUsers - ChurnedUsers1) / ChurnedUsers1, [\"New Users\"] = 100.0 * (NewUsers - NewUsers1) / NewUsers1\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "timechart" + } + }, + { + "type": 1, + "content": { + "json": "## Retention Rate\nYour app's retention rate, defined as returning users as percentage of total users." + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\r\nlet monthDefinition = {Metric};\r\nlet hlls = union customEvents, pageViews\r\n| where timestamp >= startofmonth(now() - timeRange - 2 * monthDefinition)\r\n| where name in ({Activities}) or '*' in ({Activities})\r\n{OtherFilters}\r\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\r\n| project DaysToMerge = timestamp, Hlls;\r\nlet churnSeriesWithHllsToInclude = materialize(range d from 0d to (timeRange - 1d) step 1d\r\n| extend Day = startofday(now() - d)\r\n| extend R = range(0d, monthDefinition - 1d, 1d)\r\n| mvexpand R\r\n| extend ThisMonth = Day - totimespan(R)\r\n| extend LastMonth = Day - monthDefinition - totimespan(R)\r\n| project Day, ThisMonth, LastMonth);\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = ThisMonth\r\n| join kind= inner (hlls) on DaysToMerge \r\n| project Day, ThisMonthHlls = Hlls\r\n| union (\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = LastMonth\r\n| join kind= inner (hlls) on DaysToMerge\r\n| project Day, LastMonthHlls = Hlls)\r\n| summarize ThisMonth = hll_merge(ThisMonthHlls), LastMonth = hll_merge(LastMonthHlls) by Day\r\n| evaluate dcount_intersect(ThisMonth, LastMonth)\r\n| extend NewUsers = s0 - s1\r\n| extend ChurnedUsers = (dcount_hll(LastMonth) - s1) // Last Months Users - Returning Users\r\n| project Day, [\"Retention Rate\"] = iff((s1) == 0, 0.0, 100.0 * s1 / (s1 + ChurnedUsers))\r\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "linechart" + } + }, + { + "type": 1, + "content": { + "json": "## Ratio of Returning to New Users\nThis ratio indicates how much of your usage comes from existing users vs. new users. Smaller ratios indicate larger amounts of churn, with usage primarily coming from new users." + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\r\nlet monthDefinition = {Metric};\r\nlet hlls = union customEvents, pageViews\r\n| where timestamp >= startofmonth(now() - timeRange - 2 * monthDefinition)\r\n| where name in ({Activities}) or '*' in ({Activities})\r\n{OtherFilters}\r\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\r\n| project DaysToMerge = timestamp, Hlls;\r\nlet churnSeriesWithHllsToInclude = materialize(range d from 0d to (timeRange - 1d) step 1d\r\n| extend Day = startofday(now() - d)\r\n| extend R = range(0d, monthDefinition - 1d, 1d)\r\n| mvexpand R\r\n| extend ThisMonth = Day - totimespan(R)\r\n| extend LastMonth = Day - monthDefinition - totimespan(R)\r\n| project Day, ThisMonth, LastMonth);\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = ThisMonth\r\n| join kind= inner (hlls) on DaysToMerge \r\n| project Day, ThisMonthHlls = Hlls\r\n| union (\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = LastMonth\r\n| join kind= inner (hlls) on DaysToMerge\r\n| project Day, LastMonthHlls = Hlls)\r\n| summarize ThisMonth = hll_merge(ThisMonthHlls), LastMonth = hll_merge(LastMonthHlls) by Day\r\n| evaluate dcount_intersect(ThisMonth, LastMonth)\r\n| extend NewUsers = s0 - s1\r\n| extend ChurnedUsers = -1 * (dcount_hll(LastMonth) - s1) // Last Months Users - Returning Users\r\n| project Day, [\"Returning Users Ratio\"] = 1.0 * s1 / (s1 + NewUsers)", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "timechart" + } + }, + { + "type": 1, + "content": { + "json": "## Growth Opportunity\n\nShould you care about your app's churn? This chart shows the potential to grow your app's usage by reducing churn." + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRange = {TimeRange};\r\nlet monthDefinition = {Metric};\r\nlet hlls = union customEvents, pageViews\r\n| where timestamp >= startofmonth(now() - timeRange - 2 * monthDefinition)\r\n| where name in ({Activities}) or '*' in ({Activities})\r\n{OtherFilters}\r\n| summarize Hlls = hll(user_Id) by bin(timestamp, 1d)\r\n| project DaysToMerge = timestamp, Hlls;\r\nlet churnSeriesWithHllsToInclude = materialize(range d from 0d to (timeRange ) step 1d\r\n| extend Day = startofday(now() - d)\r\n| extend R = range(0d, monthDefinition - 1d, 1d)\r\n| mvexpand R\r\n| extend ThisMonth = Day - totimespan(R)\r\n| extend LastMonth = Day - monthDefinition - totimespan(R)\r\n| project Day, ThisMonth, LastMonth);\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = ThisMonth\r\n| join kind= inner (hlls) on DaysToMerge \r\n| project Day, ThisMonthHlls = Hlls\r\n| union (\r\nchurnSeriesWithHllsToInclude\r\n| extend DaysToMerge = LastMonth\r\n| join kind= inner (hlls) on DaysToMerge\r\n| project Day, LastMonthHlls = Hlls)\r\n| summarize ThisMonth = hll_merge(ThisMonthHlls), LastMonth = hll_merge(LastMonthHlls) by Day\r\n| evaluate dcount_intersect(ThisMonth, LastMonth)\r\n| extend NewUsers = s0 - s1\r\n| extend ChurnedUsers = (dcount_hll(LastMonth) - s1) // Last Months Users - Returning Users\r\n| project Day, [\"Potential Usage (includes Lost)\"] = ChurnedUsers, [\"Current Users\"] = s1 + NewUsers\r\n", + "showQuery": false, + "size": 0, + "aggregation": 5, + "showAnnotations": false, + "visualization": "areachart" + } + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/New, Returning and Churned Users/settings.json b/Usage/Workbooks/New, Returning and Churned Users/settings.json new file mode 100644 index 0000000..d3b4e8e --- /dev/null +++ b/Usage/Workbooks/New, Returning and Churned Users/settings.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "New, Returning and Churned Users", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 500 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 500 + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/Retention - N Period/Retention - N Period.workbook b/Usage/Workbooks/Retention - N Period/Retention - N Period.workbook new file mode 100644 index 0000000..c4e5add --- /dev/null +++ b/Usage/Workbooks/Retention - N Period/Retention - N Period.workbook @@ -0,0 +1,141 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# N-Period Retention\n\nN-period retention measures how many of your users come back to perform one of the `RetainingActivities` in a particular period after they perform one of the `CohortingActivities` in your app. For instance, you could be measuring the number of users who returned to use your app on the 10th day from the day they first downloaded it. Seeing the retention trend for days 1-10 will give you an indication of the stickiness of your app. \n\nN-day retention is well-suited for gaming apps, or other kinds of app where you are trying to get users to develop a daily habit." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Activity Selection\nUse these fields to set events that that correspond to interesting user activities. The `Understanding Retention Parameter` section at the bottom describes these parameters in detail." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "97ae2ae5-ec95-455b-bac2-36caf2db61db", + "version": "KqlParameterItem/1.0", + "name": "CohortingActivities", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\n| where timestamp >= ago(7d)\n| summarize count() by name\n| order by count_ desc\n| project Id=name, Title=name, Selected=false\n| union (\ndatatable(Id:string, Title:string, Selected:boolean)[\n'*', 'All Events and Page Views', true\n]\n)" + }, + { + "name": "CohortingFilters", + "id": "94bacf68-78db-4755-8a40-c2702dea4018", + "type": 1, + "value": "" + }, + { + "id": "6cb4afed-7dac-4608-892b-154f4943ddb6", + "version": "KqlParameterItem/1.0", + "name": "RetainingActivities", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\n| where timestamp >= ago(7d)\n| summarize count() by name\n| order by count_ desc\n| project Id=name, Title=name, Selected=false\n| union (\ndatatable(Id:string, Title:string, Selected:boolean)[\n'#', 'Same as cohorting activities', true,\n'*', 'All Events and Page Views', false\n]\n)" + }, + { + "id": "0cc5211a-557e-4648-9569-1236bf16559f", + "version": "KqlParameterItem/1.0", + "name": "RetainingFilters", + "type": 1, + "isRequired": false, + "query": "datatable(x:int)[ 1 ]\r\n| extend retainingFilter = iff('#' in ({RetainingActivities}), '{CohortingFilters}', '')\r\n| project retainingFilter", + "isHiddenWhenLocked": false + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Retention Parameters\nUse these fields to customize your retention settings. " + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e62098ae-ac3f-4800-8e62-3e7d9a052e56", + "version": "KqlParameterItem/1.0", + "name": "RetentionPeriod", + "type": 2, + "description": "1d: Daily, 7d: Weekly, 30/28d: Monthly", + "isRequired": true, + "multiSelect": null, + "query": "datatable(id:string, text:string)[\n'1d', 'Daily',\n'7d', 'Weekly',\n'28d', 'Monthly (28 days)', \n'30d', 'Monthly (30 days)'\n]", + "value": "7d" + }, + { + "id": "fa4b29d9-bfc1-46e3-98f1-3cba05afbea3", + "version": "KqlParameterItem/1.0", + "name": "CohortsToAnalyze", + "type": 1, + "description": "Number of cohort periods to analyze", + "isRequired": true, + "value": "6" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let periodsToAnalyze = {CohortsToAnalyze};\nlet cohortSize = {RetentionPeriod};\nlet retainingActivities = iff('#' in ({RetainingActivities}), dynamic([{CohortingActivities}]), dynamic([{RetainingActivities}]));\nlet cohortUnit = case(cohortSize == 30d or cohortSize == 28d, \"month\", cohortSize == 7d, \"week\", \"day\");\nlet timeRange = startofday(now()) - case(cohortSize == 30d or cohortSize == 28d, startofmonth(now() - periodsToAnalyze * cohortSize), cohortSize == 7d, startofweek(now() - periodsToAnalyze * cohortSize), startofday(now() - periodsToAnalyze * cohortSize));\nlet cohorts = union customEvents, pageViews\n| where timestamp > startofday(now() - timeRange)\n| where name in ({CohortingActivities}) or '*' in ({CohortingActivities})\n{CohortingFilters}\n| extend Cohort = case(cohortSize == 30d or cohortSize == 28d, startofmonth(timestamp), cohortSize == 7d, startofweek(timestamp), startofday(timestamp))\n| summarize EarliestInCohort = min(startofday(timestamp)) by user_Id, Cohort\n| summarize UsersInCohort = hll(user_Id) by EarliestInCohort, Cohort;\nlet users = union customEvents, pageViews\n| where timestamp > startofday(now() - timeRange)\n| where name in (retainingActivities) or '*' in (retainingActivities)\n{RetainingFilters}\n| summarize Users = hll(user_Id) by Day = startofday(timestamp);\nlet Retention = materialize(range i from 0d to timeRange step 1d\n| extend Day = startofday(now() - i)\n| extend RetentionRange = range(1d, timeRange, 1d)\n| mvexpand RetentionRange limit 10000\n| extend RetentionDay = Day + totimespan(RetentionRange)\n| extend RetentionWeek = toint(totimespan(RetentionRange) / cohortSize)\n| where RetentionDay <= startofday(now())\n| project Day, RetentionDay, RetentionWeek\n| join kind=inner\n(\n users\n | project UsersOnDay = Users, RetentionDay = Day\n) on RetentionDay\n| summarize UsersForRetentionWeek = hll_merge(UsersOnDay) by Day, RetentionWeek\n| join kind=inner\n(\n cohorts\n | project UsersInCohort, Cohort, Day = EarliestInCohort\n)\non Day\n| project-away Day1\n| evaluate dcount_intersect(UsersInCohort, UsersForRetentionWeek)\n| summarize RetainedUsers = sum(s1) by Cohort, RetentionWeek\n);\ncohorts\n| summarize UsersInCohort = hll_merge(UsersInCohort) by Cohort\n| project Cohort, CohortUsers = dcount_hll(UsersInCohort) \n| join kind=inner (Retention) on Cohort\n| project-away Cohort1\n| extend RetentionRate = round(100.0 * RetainedUsers / CohortUsers, 2)\n| project-away RetainedUsers \n| order by Cohort asc, RetentionWeek asc\n| serialize rank = row_number()\n| extend RetentionWeek = case(RetentionWeek == 0, strcat(\"<1 \", cohortUnit), strcat(\"+\", RetentionWeek, \" \", cohortUnit))\n| extend month = monthofyear(Cohort)\n| extend friendlyMonthName = case(month == 1, 'January', month == 2, 'February', month == 3, 'March', month == 4, 'April', month == 5, 'May', month == 6, 'June', month == 7, 'July', month == 8, 'August', month == 9, 'September', month == 10, 'October', month == 11, 'November', 'December')\n| extend dayofweek = dayofweek(Cohort)\n| extend friendlyDayOfweek = case(dayofweek == 0d, \"Sun\", dayofweek == 1d, \"Mon\", dayofweek == 2d, \"Tue\", dayofweek == 3d, \"Wed\", dayofweek == 4d, \"Thu\", dayofweek == 5d, \"Fri\", \"Sat\")\n| extend Cohort = iff(cohortSize == 1d, strcat(friendlyMonthName, ' ', dayofmonth(Cohort), ' (', friendlyDayOfweek, ')'), strcat(friendlyMonthName, ' ', dayofmonth(Cohort)))\n| project-away month, friendlyMonthName, dayofweek, friendlyDayOfweek\n| order by rank asc\n| project Cohort, ['Users'] = CohortUsers, RetentionWeek, RetentionRate\n| evaluate pivot(RetentionWeek, sum(RetentionRate))", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Understanding Retention Parameters\n| Parameter | Used for |\n| ----- | ----- |\n| Retention Period | The period to use in retention calculation. Can be Daily, Weekly or Monthly |\n| Cohorts To Analyze | The number of cohorts to analyze. This corresponds to the N in N-period retention |\n| Cohorting Activities | The activities that selects a cohort of users. Example: Users who used event *Read Product Review* (cohorting activity). |\n| Retaining Activities | The activities that indicates retention of a cohorted user selected above. Example: Users who used event *Read Product Review* (cohorting activity) and returned to use *Purchase Product* (retaining activity). |\n| Cohorting/Retaining Filters | An analytics query snippet to further filter the cohorting activity. Example: *| where application_Version = '1.0'* |\n" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "## Related Workbook Templates\n* Retention - Bracket\n* Retention - Unbounded\n* Cohort Analysis" + }, + "conditionalVisibility": null, + "halfWidth": false + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/Retention - N Period/settings.json b/Usage/Workbooks/Retention - N Period/settings.json new file mode 100644 index 0000000..c421e0f --- /dev/null +++ b/Usage/Workbooks/Retention - N Period/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "N-Period Retention", + "author": "Microsoft", + "galleries": [] +} \ No newline at end of file diff --git a/Usage/Workbooks/Segmented Funnel/Segmented Funnel.workbook b/Usage/Workbooks/Segmented Funnel/Segmented Funnel.workbook new file mode 100644 index 0000000..2e16172 --- /dev/null +++ b/Usage/Workbooks/Segmented Funnel/Segmented Funnel.workbook @@ -0,0 +1,183 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "## Segmented Funnel\n---\nFunnels are an effective tool in calculating conversions rates of specific user behaviors in your app. For instance, it could measure the rate at which users who come to your app perform an interesting event -- like make a purchase from within your app.\n\nSegmenting a funnel allows the analysis of conversion rates across an interesting dimension -- say across countries, app versions or device type. This allows you to identify potential conversions issues like:\n* Conversion in Canada is 10% lower than in the United States, or \n* Not many users seem to be purchasing on Android devices.\n\nUse this report to create analyze conversion rates across a _standard_ or _custom_ dimension of your choice." + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "6ce4c5c1-5098-4b1a-82b4-6073f3a75b5e", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(key:string, display:string) \r\n[ \r\n\">= ago(1d)\", \"Last 24 hours\", \r\n\">= ago(2d)\", \"Last 48 hours\", \r\n\">= ago(7d)\", \"Last 7 days\", \r\n\">= ago(14d)\", \"Last 14 days\", \r\n\">= ago(30d)\", \"Last 30 days\", \r\n\">= ago(90d)\", \"Last 90 days\", \r\n\"between(ago(14d)..ago(7d))\", \"Previous Week\", \r\n\"between(ago(60d)..ago(30d))\", \"Previous Month\", \r\n] ", + "value": ">= ago(1d)" + }, + { + "id": "77a13f3c-932e-4ef1-ad81-ce9de620588d", + "version": "KqlParameterItem/1.0", + "name": "ConversionScope", + "type": 2, + "description": "Select the scope for your conversion calculations. In the Session scope, both the top and bottom activities need to happen in the same session to count towards conversion. For both User scopes, the user is allowed to have done both activities in different sessions.", + "isRequired": true, + "multiSelect": null, + "query": "datatable(key:string, display:string)\n[\n\"user_Id\", \"Anonymous Users\", \n\"user_AuthenticatedId\", \"Authenticated Users\",\"session_Id\", \"Sessions\",\n]", + "value": "session_Id" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### Set the Top of the Funnel" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "4c766401-680d-477b-a1a2-27b3cc54f4aa", + "version": "KqlParameterItem/1.0", + "name": "TopStep", + "type": 2, + "description": "Select the activities that form the top of your funnel.", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\r\n| where timestamp >= ago(7d)\r\n| summarize count() by name\r\n| order by count_ desc\r\n| project Id=name, Title=name, Selected=false\r\n| union (\r\ndatatable(Id:string, Title:string, Selected:boolean)[\r\n'*', 'All Events and Page Views', true\r\n]\r\n)" + }, + { + "id": "d459a38a-f60c-43d1-8ed4-16197bbda3fb", + "version": "KqlParameterItem/1.0", + "name": "TopFilters", + "type": 1, + "description": "An analytics query snippet to further filter the top step. Example: | where application_Version = '1.0'", + "isRequired": false + }, + { + "id": "eefc5a11-0078-47a0-8d41-019ea7476306", + "version": "KqlParameterItem/1.0", + "name": "SegmentBy", + "type": 2, + "description": null, + "isRequired": true, + "multiSelect": null, + "query": "datatable(value:string, text:string)[\r\n'itemType', '❌ None',\r\n'name', '📛 Activity',\r\n'cloud_RoleInstance', '🖥️ Machine',\r\n'client_CountryOrRegion', '📍 Country or Region',\r\n'client_StateOrProvince', '📍 State or Province',\r\n'client_City', '📍 City',\r\n'client_Browser', '🌐 Client Browser',\r\n'client_OS', '️️🖥️ Client Operating System',\r\n'client_Model', '📱 Client Model',\r\n'application_Version', '⚪ Application Version',\r\n'operation_Name', '⚪ Operation',\r\n]\r\n| union (union pageViews, customEvents\r\n| where timestamp >= ago(1d)\r\n| where name in ({TopStep}) or '*' in ({TopStep})\r\n| project customDimensions \r\n| summarize schema = buildschema(customDimensions) \r\n| mvexpand schema\r\n| extend e = extract(@'{\"(.+)\":.+}', 1, tostring(schema))\r\n| project text = strcat('❄️ ', e), value = strcat('customDimensions[\"', e, '\"]'))", + "value": "client_CountryOrRegion" + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "### Set the Bottom of the Funnel" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "6362855e-7d02-437d-964e-b526259323dc", + "version": "KqlParameterItem/1.0", + "name": "BottomStep", + "type": 2, + "description": "Select the activities that form the bottom of your funnel", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\r\n| where timestamp >= ago(7d)\r\n| summarize count() by name\r\n| order by count_ desc\r\n| project Id=name, Title=name, Selected=false\r\n| union (\r\ndatatable(Id:string, Title:string, Selected:boolean)[\r\n'*', 'All Events and Page Views', true\r\n]\r\n)" + }, + { + "id": "86f23e20-64e4-44fe-80ba-74b0080ba276", + "version": "KqlParameterItem/1.0", + "name": "BottomFilters", + "type": 1, + "description": "An analytics query snippet to further filter the bottom step. Example: | where application_Version = '1.0'", + "isRequired": false + } + ] + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 1, + "content": { + "json": "# Funnels" + }, + "conditionalVisibility": null, + "halfWidth": false + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = union customEvents, pageViews\n| where timestamp {TimeRange};\nlet topUsers = data\n| where name in ({TopStep}) or '*' in ({TopStep})\n{TopFilters}\n| extend Dim1 = iff('{SegmentBy}' == 'itemType', 'Overall', {SegmentBy}) // reusing itemType to indicate no segmentation\n| summarize Min = min(timestamp) by {ConversionScope}, Dim1;\nlet bottomUsers = data\n| where name in ({BottomStep}) or '*' in ({BottomStep})\n{BottomFilters}\n| summarize Max = max(timestamp) by {ConversionScope};\nlet funnel = topUsers\n| join kind=inner (bottomUsers) on {ConversionScope}\n| where Max >= Min\n| summarize Bottom = dcount({ConversionScope}) by Dim1;\nlet funnelTop = topUsers\n| summarize Top=dcount({ConversionScope}) by Dim1\n| order by Top desc;\nlet multiFunnel = funnel\n| join kind=inner (funnelTop) on Dim1\n| project Dim1, Top, Bottom, Conversion = round(100.0 * Bottom / Top, 2)\n| extend Relevance = iff(Conversion == 0, pow(Top, 1.6), Top * 100 / Conversion);\nmultiFunnel\n| order by Relevance desc\n| project ['Segments'] = Dim1, [\"All Users\"] = Top, [\"Converted Users\"] = Bottom, [\"Conversion Rate (%)\"] = Conversion\n\n\n\n", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "gridSettings": { + "formatters": [ + { + "columnMatch": "All Users|Converted Users", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": null, + "palette": "blue" + } + }, + { + "columnMatch": "Conversion Rate (%)", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "red" + } + } + ] + } + }, + "conditionalVisibility": null, + "halfWidth": false + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/Segmented Funnel/settings.json b/Usage/Workbooks/Segmented Funnel/settings.json new file mode 100644 index 0000000..8afd941 --- /dev/null +++ b/Usage/Workbooks/Segmented Funnel/settings.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Segmented Funnel", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 900 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 900 + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/Usage Calendar/Usage Calendar.workbook b/Usage/Workbooks/Usage Calendar/Usage Calendar.workbook new file mode 100644 index 0000000..af554bc --- /dev/null +++ b/Usage/Workbooks/Usage Calendar/Usage Calendar.workbook @@ -0,0 +1,168 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Usage Calendar\nThis report helps you understand the usage patterns of your application through the days of the week. It should help you identify patterns like:\n* My app is primarly used on weekdays and has almost no activity over the weekend, or\n* Overall activity has increased week over week, and especially on Mondays.\n\nUse the parameters below to select the app activities you are interested in, the analysis time window, and the metric you wish to analyze (count of users, sessions, events)." + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "0a333341-3965-4d73-abec-85d9af5d30cf", + "version": "KqlParameterItem/1.0", + "name": "Activities", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\n| where timestamp >= ago(1d)\n| summarize Count = count() by name\n| order by Count desc\n| project name, label = name, selected = false\n| union (datatable(name:string, label:string, selected:boolean)[\n'*', 'All Events and Page Views', true,\n'#', 'All Page Views', false,\n'&', 'All Events', false\n])", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "abed64a1-3333-40ed-ad17-34dd66e33895", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 2592000000, + "createdTime": "2018-08-22T03:49:07.015Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-08-22T03:49:07.015Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2018-08-22T03:49:07.015Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "value": { + "durationMs": 2592000000, + "createdTime": "2018-08-22T03:49:07.015Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + }, + { + "id": "e42f01af-de79-45f1-a30a-8d41894a6ac7", + "version": "KqlParameterItem/1.0", + "name": "Metric", + "type": 2, + "isRequired": true, + "multiSelect": null, + "query": "datatable(value:string, label:string, selected:boolean)[\n'Metric = dcount(user_Id)', 'Unique Users', true,\n'Metric = dcount(session_Id)', 'Unique Sessions', false,\n'Metric = count()', 'Event Count', false\n]", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "ce93f5c0-cb7c-4d3a-9361-c0ba735b40f6", + "version": "KqlParameterItem/1.0", + "name": "ExcludeWeekends", + "type": 2, + "isRequired": true, + "multiSelect": null, + "isHiddenWhenLocked": false, + "jsonData": "[\"Yes\", \"No\"]", + "value": "No" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Usage\nShows your app usage measured by the `Metric` parameter chosen above." + }, + "conditionalVisibility": null, + "customWidth": "65" + }, + { + "type": 1, + "content": { + "json": "## Calendar\nA basic calendar to use as reference in your analysis." + }, + "conditionalVisibility": null, + "customWidth": "35" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let start = startofweek({TimeRange:start});\nunion customEvents, pageViews\n| where timestamp >= start\n| where name in ({Activities}) or ('*' in ({Activities})) or ('#' in ({Activities}) and itemType == 'pageView') or ('&' in ({Activities}) and itemType == 'customEvent')\n| make-series {Metric} default=0 on timestamp in range(start, endofweek({TimeRange:end}), 1d)\n| mvexpand timestamp to typeof(datetime), Metric to typeof(long)\n| extend WeekDay = dayofweek(timestamp), Week = toint((timestamp - start) / 7d) \n| where '{ExcludeWeekends}' == 'No' or (WeekDay != 0d and WeekDay != 6d)\n| extend WeekDay = case(WeekDay == 0d, 'Sun', WeekDay == 1d, 'Mon', WeekDay == 2d, 'Tue', WeekDay == 3d, 'Wed', WeekDay == 4d, 'Thu', WeekDay == 5d, 'Fri', 'Sat')\n| order by timestamp asc\n| project-away timestamp\n| evaluate pivot(WeekDay, sum(Metric))\n| project-away Week ", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "gridSettings": { + "formatters": [ + { + "columnMatch": ".*", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null, + "customWidth": "65" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let start = startofweek({TimeRange:start});\nrange i from 0d to 366d step 1d\n| extend timestamp = startofday(now() - i)\n| make-series Max = max(1) default=0 on timestamp in range(start, endofweek({TimeRange:end}), 1d)\n| mvexpand timestamp to typeof(datetime), Max\n| extend WeekDay = dayofweek(timestamp), Week = toint((timestamp - start) / 7d), Day = dayofmonth(timestamp)\n| where '{ExcludeWeekends}' == 'No' or (WeekDay != 0d and WeekDay != 6d)\n| extend WeekDay = case(WeekDay == 0d, 'Sun', WeekDay == 1d, 'Mon', WeekDay == 2d, 'Tue', WeekDay == 3d, 'Wed', WeekDay == 4d, 'Thu', WeekDay == 5d, 'Fri', 'Sat')\n| order by timestamp asc\n| project-away timestamp, Max\n| evaluate pivot(WeekDay, sum(Day))\n| project-away Week ", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null, + "customWidth": "35" + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/Usage Calendar/settings.json b/Usage/Workbooks/Usage Calendar/settings.json new file mode 100644 index 0000000..fb6a8ae --- /dev/null +++ b/Usage/Workbooks/Usage Calendar/settings.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Usage Calendar", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 600 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 600 + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/Usage by hours of the day/Usage by hours of the day.workbook b/Usage/Workbooks/Usage by hours of the day/Usage by hours of the day.workbook new file mode 100644 index 0000000..11401d8 --- /dev/null +++ b/Usage/Workbooks/Usage by hours of the day/Usage by hours of the day.workbook @@ -0,0 +1,143 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Usage through the day\nThis report helps you understand the usage patterns of your application through the hours of a day. It should help you identify patterns like:\n\n* My app is primarly on weekdays in the evenings between 6pm and 11pm\n* On weekends, usage is spread evenly through the day.\n\nUse the parameters below to select the app activities you are interested in, the analysis time window, and the metric you wish to analyze (count of users, sessions, events)." + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "0a333341-3965-4d73-abec-85d9af5d30cf", + "version": "KqlParameterItem/1.0", + "name": "Activities", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union customEvents, pageViews\n| where timestamp >= ago(1d)\n| summarize Count = count() by name\n| order by Count desc\n| project name, label = name, selected = false\n| union (datatable(name:string, label:string, selected:boolean)[\n'*', 'All Events and Page Views', true,\n'#', 'All Page Views', false,\n'&', 'All Events', false\n])", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "abed64a1-3333-40ed-ad17-34dd66e33895", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 604800000, + "createdTime": "2018-08-22T04:57:17.254Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-08-22T04:57:17.254Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-08-22T04:57:17.254Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-08-22T04:57:17.254Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": false + }, + "value": { + "durationMs": 1209600000, + "createdTime": "2018-08-22T04:57:17.254Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + }, + { + "id": "e42f01af-de79-45f1-a30a-8d41894a6ac7", + "version": "KqlParameterItem/1.0", + "name": "Metric", + "type": 2, + "isRequired": true, + "multiSelect": null, + "query": "datatable(value:string, label:string, selected:boolean)[\n'Metric = dcount(user_Id)', 'Unique Users', true,\n'Metric = dcount(session_Id)', 'Unique Sessions', false,\n'Metric = count()', 'Event Count', false\n]", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5cddc86e-909f-412e-b122-91347c02235e", + "version": "KqlParameterItem/1.0", + "name": "ExcludeWeekends", + "type": 2, + "isRequired": true, + "multiSelect": null, + "isHiddenWhenLocked": false, + "jsonData": "[\"Yes\", \"No\"]", + "value": "No" + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let start = startofday({TimeRange:start});\nunion customEvents, pageViews\n| where timestamp >= start\n| where name in ({Activities}) or ('*' in ({Activities})) or ('#' in ({Activities}) and itemType == 'pageView') or ('&' in ({Activities}) and itemType == 'customEvent')\n| summarize {Metric} by bin(timestamp, 2h)\n| extend Hour = hourofday(timestamp), WeekDay = dayofweek(timestamp)\n| where '{ExcludeWeekends}' == 'No' or (WeekDay != 0d and WeekDay != 6d)\n| extend HourDisplay = case(Hour == 0, '12am', Hour < 12, strcat(Hour, 'am'), Hour == 12, '12pm', strcat(Hour - 12, 'pm'))\n| extend Day = strcat(monthofyear(timestamp), '/', dayofmonth(timestamp), ' - ', case(WeekDay == 0d, 'Sun', WeekDay == 1d, 'Mon', WeekDay == 2d, 'Tue', WeekDay == 3d, 'Wed', WeekDay == 4d, 'Thu', WeekDay == 5d, 'Fri', 'Sat'))\n| order by Hour asc\n| extend Day1 = bin(timestamp, 1d)\n| project-away timestamp, WeekDay, Hour\n| serialize\n| evaluate pivot(HourDisplay, sum(Metric))\n| order by Day1 asc\n| project-away Day1\n", + "showQuery": false, + "size": 2, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.insights/components", + "gridSettings": { + "formatters": [ + { + "columnMatch": "m", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "green" + } + } + ] + } + }, + "conditionalVisibility": null + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/Usage by hours of the day/settings.json b/Usage/Workbooks/Usage by hours of the day/settings.json new file mode 100644 index 0000000..80f0cd3 --- /dev/null +++ b/Usage/Workbooks/Usage by hours of the day/settings.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Usage by hours of the day", + "author": "Microsoft", + "galleries": [ + { + "type": "workbook", + "resourceType": "microsoft.insights/components", + "order": 700 + }, + { + "type": "usage", + "resourceType": "microsoft.insights/components", + "order": 700 + } + ] +} \ No newline at end of file diff --git a/Usage/Workbooks/categoryResources.json b/Usage/Workbooks/categoryResources.json new file mode 100644 index 0000000..49b020f --- /dev/null +++ b/Usage/Workbooks/categoryResources.json @@ -0,0 +1,5 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Usage", "description": "", "order": 400}, + "es-es": {"name":"Uso", "description": "", "order": 400} +} \ No newline at end of file diff --git a/UsageMetrics/Alerts/README b/UsageMetrics/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/UsageMetrics/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/UsageMetrics/Queries/README b/UsageMetrics/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/UsageMetrics/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/UsageMetrics/Workbooks/Usage - Events/Usage - Events.workbook b/UsageMetrics/Workbooks/Usage - Events/Usage - Events.workbook new file mode 100644 index 0000000..ea2a68f --- /dev/null +++ b/UsageMetrics/Workbooks/Usage - Events/Usage - Events.workbook @@ -0,0 +1,1806 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "503cdbaf-aef3-4a02-93fd-45140e5d8ec8", + "version": "KqlParameterItem/1.0", + "name": "componentId", + "type": 1, + "description": "componentId for tiles link", + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "37b05d6c-ab7c-4190-94d8-4973fcf06c49", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "During", + "type": 4, + "description": "Choose the time range for this report.", + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 3600000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "ff00e059-7ba9-4dfa-a926-8288cf30fc05", + "version": "KqlParameterItem/1.0", + "name": "UsersList", + "label": "Show occurrences for", + "type": 2, + "description": "A cohort filter can be set at edit mode that is a collection of users, sessions, or operations that are matched by a set of filters specified in the definition of the cohort. When a cohort is used in this report, the result will be the intersection of users, sessions, or operations matched by the cohort and users, sessions, or operations matched by the rest of the query in this report.", + "isRequired": true, + "query": "datatable(value: string, label: string, group:string, selected:string) ['user_Id', 'All Users', '', 'true']", + "value": "user_Id", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "f3983330-899b-4e6e-995e-d4c7feefd699", + "version": "KqlParameterItem/1.0", + "name": "requestsCount", + "type": 1, + "query": "union requests\r\n| where timestamp {TimeRange}\r\n| count\r\n", + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5f3f81d8-c4fb-40f1-8496-199a2da27852", + "version": "KqlParameterItem/1.0", + "name": "pageViewsCount", + "type": 1, + "query": "union pageViews\r\n | where timestamp {TimeRange}\r\n | count\r\n", + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "0afb0089-98e9-479c-b12e-a982870ce6be", + "version": "KqlParameterItem/1.0", + "name": "Whoused", + "label": "Who used", + "type": 2, + "description": "Choose which custom events, requests and page views the users should have sent for this report.", + "isRequired": true, + "query": "let defaultValue = iff('{pageViewsCount}' == '', 'customEvents','pageViews,customEvents');\r\ndatatable(value: string, label: string) ['pageViews,customEvents,requests', 'Any Custom Events, Request or Page View', 'pageViews,customEvents', 'Any Custom Events or Page View', 'requests,customEvents', 'Any Custom Events or Request','requests,pageViews','Any Request or Page View','customEvents','Any Custom Event','pageViews', 'Any Page View', 'requests', 'Any Request']\r\n| where '{requestsCount}' != '' or value !contains 'requests'\r\n| where '{pageViewsCount}' != '' or value !contains 'pageViews'\r\n| extend selected = iif(value == defaultValue, 'true', '')", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "fd41f402-40ca-4dc5-bd29-38ec93f9d521", + "version": "KqlParameterItem/1.0", + "name": "UserEvent", + "label": "Events", + "type": 2, + "description": " Choose multiple events, requests and page views, the report will show users who did at least one of the events, requests or page views, not necessarily all of the selected events, requests and page views.", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union {Whoused}\r\n | where timestamp {TimeRange}\r\n | project name, group = case(itemType == 'pageView', 'Page Views', itemType == 'customEvent', 'Custom Events', 'Requests')\r\n | summarize count() by group, name\r\n | project value=name, label=name, group, selected=''\r\n //| union showCohort\r\n | extend value = replace(@\"\\\\'\", @\"'\\1\",value)\r\n | order by group asc, label asc", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*", + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "e4152b00-9f31-4ac2-b1c9-2f0964513368", + "version": "KqlParameterItem/1.0", + "name": "usageStandardDimension", + "type": 1, + "description": "Query Standard dimension ", + "isRequired": true, + "query": "let dimensionList = datatable(ColumnName:string, label:string)[\r\n\t'application_Version', 'Application version',\r\n\t'user_AuthenticatedId', 'Authenticated or anonymous traffic',\r\n\t'client_Browser', 'Browser version', \r\n\t'client_City', 'City',\r\n 'client_CountryOrRegion', 'Country or region', \r\n\t'cloud_RoleInstance', 'Cloud role instance', \r\n\t'cloud_RoleName', 'Cloud role name',\r\n\t'client_Model', 'Device model', \r\n 'client_OS', 'Operating system',\r\n\t'client_Type', 'Device type',\r\n\t'isSynthetic', 'Is real user traffic',\r\n 'name', 'Name', \r\n\t'operation_Name', 'Operation name',\r\n\t'performanceBucket', 'Performance',\r\n 'resultCode', 'Result code',\r\n 'responseCode', 'Response code',\r\n\t'tostring(parseurl(url)[\"Host\"])', 'URL host', \r\n\t'tostring(parseurl(url)[\"Path\"])', 'URL path',\r\n\t'operation_SyntheticSource', 'Source of synthetic traffic',\r\n\t'client_CountryOrRegion', 'State or province', \r\n\t'success', 'Successful request',\r\n 'type','Telemetry type'\r\n\t] | order by label asc;\r\nunion {Whoused}\r\n | where timestamp {TimeRange}\r\n | getschema \r\n | where ColumnType == \"string\"\r\n | summarize count() by ColumnName\r\n | join kind = inner dimensionList on ColumnName\r\n | project ColumnName, label\r\n | order by label asc\r\n | project data = strcat(\"'\", ColumnName,\"','\",label,\"','Standard Properties'\")", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "b6db195f-a819-45ff-8eed-bae7c09ab135", + "version": "KqlParameterItem/1.0", + "name": "getCustomDimensions", + "type": 1, + "description": "The query is resued by ByValue, SplityBy and Properties dropdown", + "isRequired": true, + "query": "union {Whoused}\r\n | where timestamp {TimeRange}\r\n | project column_ifexists(\"customDimensions\",'')\r\n | evaluate bag_unpack(column_ifexists(\"customDimensions\",''))\r\n | getschema \r\n | where ColumnType == 'string'\r\n | summarize count() by ColumnName \r\n | project value =strcat(\"customDimensions[\\\"\", ColumnName, \"\\\"]\"), label =ColumnName, group='Custom Properties'\r\n | order by label asc\r\n | project data = strcat(\"'\", value,\"','\",label,\"','\",group,\"'\")", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "8b11feda-c3d4-4fb6-93d4-92321ccabd9d", + "version": "KqlParameterItem/1.0", + "name": "formattedCustomDimensions", + "type": 1, + "isRequired": true, + "value": "[]", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (getCustomDimensions is empty ), result = '[]'", + "criteriaContext": { + "leftOperand": "getCustomDimensions", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "[]" + } + }, + { + "condition": "if (getCustomDimensions starts with '['), result = getCustomDimensions", + "criteriaContext": { + "leftOperand": "getCustomDimensions", + "operator": "startsWith", + "rightValType": "static", + "rightVal": "[", + "resultValType": "param", + "resultVal": "getCustomDimensions" + } + }, + { + "condition": "else result = '[{getCustomDimensions}]'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "[{getCustomDimensions}]" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "8cd9003c-8e76-4d21-8b22-b7a11197f42f", + "version": "KqlParameterItem/1.0", + "name": "ByValue", + "label": "By value x-axis", + "type": 2, + "description": "Choose a time grain or property to create x-axis for users.", + "isRequired": true, + "query": "let grainList = datatable(value:string, label:string, seconds:string, group: string, selected: string)[\r\n'3m', '3 minutes', '3600', 'Time Range', 'true',\r\n\t'1h', '1 hour', '86400', 'Time Range', 'true',\r\n\t'2h', '2 hours', '172800', 'Time Range', 'true',\r\n\t'3h', '3 hours', '259200', 'Time Range', 'true',\r\n\t'1d', '1 day', '604800', 'Time Range', 'true',\r\n\t'12h', '12 hours', '604800', 'Time Range', '',\r\n\t'1d', '1 day', '1209600', 'Time Range', 'true',\r\n\t'1d', '1 day', '2592000', 'Time Range', 'true',\r\n\t'7d', '7 days', '2592000', 'Time Range', '',\r\n\t'1d', '1 day', '5184000', 'Time Range', 'true',\r\n\t'7d', '7 days', '5184000', 'Time Range', '',\r\n\t'1d', '1 day', '7776000', 'Time Range', 'true',\r\n\t'7d', '7 days', '7776000', 'Time Range', ''\r\n\t];\r\n let timeTable = grainList\r\n | where seconds == '{TimeRange:seconds}'\r\n | project value, label, group, selected;\r\nlet customDimension = datatable(value:string, label:string, group: string){formattedCustomDimensions};let dimensionList = datatable(value:string, label:string, group: string) {usageStandardDimension};\r\ntimeTable\r\n | union //showCohort,\r\n dimensionList, customDimension\r\n | project value, label, group, selected", + "value": "1h", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "cf1d4683-4853-4302-9c6e-4ea1925dfc5f", + "version": "KqlParameterItem/1.0", + "name": "isByCohort", + "type": 1, + "description": "Is x-axis created by cohort or not?", + "query": "let query = '{ByValue}';\r\n print parse_json(query).isCohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "033f9e3f-5198-4709-94d7-254b824c9669", + "version": "KqlParameterItem/1.0", + "name": "isTimeRange", + "type": 1, + "description": "Is x-axis created by time bins or not?", + "isRequired": true, + "value": "true", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (isByCohort == 'true'), result = 'false'", + "criteriaContext": { + "leftOperand": "isByCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "true", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "if (ByValue regex '[1,2,3,7,12][m|h|d]'), result = 'true'", + "criteriaContext": { + "leftOperand": "ByValue", + "operator": "regex", + "rightValType": "static", + "rightVal": "[1,2,3,7,12][m|h|d]", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "condition": "else result = 'false'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "47faf500-a03f-4600-bb6d-973d248fe874", + "version": "KqlParameterItem/1.0", + "name": "UsageSplitBy", + "label": "Split by", + "type": 2, + "description": "Choose a property lets you segment by users.", + "isRequired": true, + "query": "let customDimension = datatable(value:string, label:string, group: string){formattedCustomDimensions}; \r\nlet PropertyList = union (datatable(value:string, label:string, group: string){usageStandardDimension}), customDimension\r\n | extend timerange= '{TimeRange}'\r\n | where '{isTimeRange}' == 'true'\r\n | project value, label, group, selected ='';\r\ndatatable(value:string, label:string, group: string, selected: string)[\r\n\t'', 'unset', '', 'true'] \r\n | union //showCohort,\r\n PropertyList", + "value": "", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "d9f3a9e9-dbc8-43bd-8f91-46cafa82250e", + "version": "KqlParameterItem/1.0", + "name": "IsSplitCohort", + "type": 1, + "description": "Check if SplitBy selection is a cohrt", + "query": "let query = '{UsageSplitBy}';\r\n print parse_json(query).isCohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "6aa9fe7f-8c73-4871-8b9f-c15014832721", + "version": "KqlParameterItem/1.0", + "name": "barChartMode", + "type": 1, + "description": "Get bar Chart mode", + "isRequired": true, + "query": "print iff('{UsageSplitBy}' == '' and '{isTimeRange}' == 'true', 'TimeBar', iff('{UsageSplitBy}' == '' and '{isTimeRange}' == 'false', 'ByValueBar', 'SplitBar'))", + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - mainSelections" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5632ed58-6194-40d9-a714-73c23cdba54d", + "version": "KqlParameterItem/1.0", + "name": "customFilters", + "label": "Filters", + "type": 1, + "description": "Add filters. Example: | where client_City == \"Seattle\" | where client_OS contains \"Windows\" ", + "typeSettings": { + "multiLineText": true, + "editorLanguage": "kql" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "e33eefc9-12e4-46ba-8a2b-5df923480f9d", + "version": "KqlParameterItem/1.0", + "name": "filters", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = customFilters", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "customFilters" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 8" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "bc878678-8cbc-4c1c-b6be-0c2fd8604fb8", + "version": "KqlParameterItem/1.0", + "name": "cohortUsersQuery", + "type": 1, + "description": "Extract query in cohort json from UsersList dropdown ", + "query": "let query = '{UsersList}';\r\n print parse_json(query).cohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "705011ae-3a87-4f26-885d-d4d9545b29f4", + "version": "KqlParameterItem/1.0", + "name": "isBelongCohort", + "type": 1, + "description": "Extract IsBelong property in cohort json from UsersList dropdown ", + "query": "let query = '{UsersList}';\r\n print parse_json(query).isBelong", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "706e8b54-1ac7-4243-ab36-f9d67343e025", + "version": "KqlParameterItem/1.0", + "name": "mainTableQuery", + "type": 1, + "description": "mainTable Query", + "isRequired": true, + "value": "mainTable", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (isBelongCohort == 'true'), result = '(){{cohortUsersQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | join kind=inner (mainTable | extend hashedUserId = hash(user_Id)) on hashedUserId}'", + "criteriaContext": { + "leftOperand": "isBelongCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "true", + "resultValType": "static", + "resultVal": "(){{cohortUsersQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | join kind=inner (mainTable | extend hashedUserId = hash(user_Id)) on hashedUserId}" + } + }, + { + "condition": "if (isBelongCohort == 'false'), result = '(){{cohortUsersQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | join kind=rightanti (mainTable | extend hashedUserId = hash(user_Id)) on hashedUserId}'", + "criteriaContext": { + "leftOperand": "isBelongCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "false", + "resultValType": "static", + "resultVal": "(){{cohortUsersQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | join kind=rightanti (mainTable | extend hashedUserId = hash(user_Id)) on hashedUserId}" + } + }, + { + "condition": "else result = 'mainTable'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "mainTable" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "77ab1a31-79d2-4431-b131-59b8631d1fdd", + "version": "KqlParameterItem/1.0", + "name": "byCohortQuery", + "type": 1, + "description": "Extract query in cohort json from ByValue dropdown", + "query": "let query = '{ByValue}';\r\n print parse_json(query).cohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "9aa04628-19d5-43b7-9190-e10d3d067c08", + "version": "KqlParameterItem/1.0", + "name": "byTableQuery", + "type": 1, + "description": "By query segement ", + "value": "() {byTable | extend dimension = 1h | extend dimension = iif(isempty(dimension), \"\", dimension)}", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (isByCohort == 'true'), result = '() {{byCohortQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | extend byColumn = \"Cohort Users\" | join kind=rightouter (byTable | extend hashedUserId = hash(user_Id)) on hashedUserId | extend dimension = byColumn | extend dimension = iif(isempty(dimension), \"Others\", \"Cohort\")}'", + "criteriaContext": { + "leftOperand": "isByCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "true", + "resultValType": "static", + "resultVal": "() {{byCohortQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | extend byColumn = \"Cohort Users\" | join kind=rightouter (byTable | extend hashedUserId = hash(user_Id)) on hashedUserId | extend dimension = byColumn | extend dimension = iif(isempty(dimension), \"Others\", \"Cohort\")}" + } + }, + { + "condition": "else result = '() {byTable | extend dimension = {ByValue} | extend dimension = iif(isempty(dimension), \"\", dimension)}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "() {byTable | extend dimension = {ByValue} | extend dimension = iif(isempty(dimension), \"\", dimension)}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "463cf64c-ceec-4831-b4a1-d72953670eee", + "version": "KqlParameterItem/1.0", + "name": "splitbyLabel", + "type": 1, + "value": "unset", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{UsageSplitBy:label}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{UsageSplitBy:label}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "9645e737-0b9c-437f-94d7-cf27c2151639", + "version": "KqlParameterItem/1.0", + "name": "splitCohortQuery", + "type": 1, + "description": "Extract query in cohort json from SplitBy dropdown", + "query": "let query = '{UsageSplitBy}';\r\n print parse_json(query).cohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "d4a9bee5-e949-4c51-82f6-f074b03c5dae", + "version": "KqlParameterItem/1.0", + "name": "splitTableQuery", + "type": 1, + "description": "Split query segement", + "value": "() {queryTable | extend dimension = | extend dimension = iif(isempty(dimension), \"\", dimension)}", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (IsSplitCohort == 'true'), result = '() {{splitCohortQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | extend splitColumn = \"Cohort Users\" | join kind=rightouter (queryTable | extend hashedUserId = hash(user_Id)) on hashedUserId | extend dimension = splitColumn | extend dimension = iif(isempty(dimension), \"Others\", \"{splitbyLabel:escape} \")}'", + "criteriaContext": { + "leftOperand": "IsSplitCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "true", + "resultValType": "static", + "resultVal": "() {{splitCohortQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | extend splitColumn = \"Cohort Users\" | join kind=rightouter (queryTable | extend hashedUserId = hash(user_Id)) on hashedUserId | extend dimension = splitColumn | extend dimension = iif(isempty(dimension), \"Others\", \"{splitbyLabel:escape} \")}" + } + }, + { + "condition": "else result = '() {queryTable | extend dimension = {UsageSplitBy} | extend dimension = iif(isempty(dimension), \"\", dimension)}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "() {queryTable | extend dimension = {UsageSplitBy} | extend dimension = iif(isempty(dimension), \"\", dimension)}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "f949bcae-483d-4356-a3c4-3e43652ffbf8", + "version": "KqlParameterItem/1.0", + "name": "cohortEventsQuery", + "type": 1, + "description": "Extract cohort queries from UserEvent dropdown", + "query": "let table = print {UserEvent}\r\n| evaluate narrow()\r\n| where Value startswith\"{\\\"cohort\\\":\"\r\n| project name = \"cohorts\", Cohorts = strcat(\"(\",parse_json(Value).cohort, \" | summarize makeset(name)\");\r\ntable\r\n| summarize cohorts = make_list(Cohorts) by tostring(name)\r\n| project cohorts= replace(@'\\[', @'union \\1', tostring(cohorts))\r\n| project cohorts= replace(@'name\\)\"', @'name)) \\1', cohorts)\r\n| project cohorts= replace(@'\"', @'\\1', cohorts)\r\n| project cohorts= replace(@'\\]', @'\\1', cohorts)\r\n", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "f04476f6-28f6-4d71-b39f-950a6c37c747", + "version": "KqlParameterItem/1.0", + "name": "userEventsQuery", + "type": 1, + "description": "Extract event queries from UserEvent dropdown", + "query": "print {UserEvent}\r\n| evaluate narrow()\r\n| where Value !startswith\"{\\\"cohort\\\":\"\r\n| summarize events = make_list(Value) by tostring(Row)\r\n| project events= replace(@'\\[', @'\\1', tostring(events))\r\n| project events= replace(@'\\]', @'\\1', events) | project events= replace(@\"'\", @\"\\\\'\\1\", events)", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "8738ce5d-ad4e-46f0-8b54-98dd29b3bd7c", + "version": "KqlParameterItem/1.0", + "name": "getCohortEventsQuery", + "type": 1, + "description": "Merge cohort queries ", + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (UserEvent == ''*''), result = 'print '''", + "criteriaContext": { + "leftOperand": "UserEvent", + "operator": "==", + "rightValType": "static", + "rightVal": "'*'", + "resultValType": "static", + "resultVal": "print ''" + } + }, + { + "condition": "if (cohortEventsQuery is empty ), result = '{cohortEventsQuery}'", + "criteriaContext": { + "leftOperand": "cohortEventsQuery", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{cohortEventsQuery}" + } + }, + { + "condition": "else result = ' {cohortEventsQuery} | project cohortEvents= replace(@'\\[', @'\\1', tostring(set_name)) | project cohortEvents= replace(@'\\]', @'\\1', cohortEvents)'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": " {cohortEventsQuery} | project cohortEvents= replace(@'\\[', @'\\1', tostring(set_name)) | project cohortEvents= replace(@'\\]', @'\\1', cohortEvents)" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "40bc31ca-6b81-4352-909f-c89f99709f0d", + "version": "KqlParameterItem/1.0", + "name": "processCohortEvents1", + "type": 1, + "description": "Get cohort query results", + "query": "{getCohortEventsQuery}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "c2550954-dd71-4f65-ae6e-e5e0b08db15e", + "version": "KqlParameterItem/1.0", + "name": "processCohortEvents2", + "type": 1, + "description": "Merge cohort query results", + "query": "print cohorts= '{processCohortEvents1}' \n | project cohorts= replace(@'\\[', @'\\1', tostring(cohorts))\n | project cohorts= replace(@'\\]', @'\\1', cohorts)\n", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5f624496-5eaf-4c14-a16f-6dbb85128e63", + "version": "KqlParameterItem/1.0", + "name": "userEventsList", + "type": 1, + "description": "Merge cohort and user Events", + "isRequired": true, + "query": "let userEvents = '{userEventsQuery}';\r\nlet cohortEvents = '{processCohortEvents2}';\r\nlet userEventsString = iff(strlen(userEvents)>0 and strlen(cohortEvents)>0, strcat(userEvents, ','), userEvents);\r\nprint strcat(userEventsString, cohortEvents)", + "value": "\"*\"", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "7c3949b0-f3f7-40ce-a51d-e3ca186ce57f", + "version": "KqlParameterItem/1.0", + "name": "barChartQuery", + "type": 1, + "isRequired": true, + "value": "let grain = 1h; let mainTable = union pageViews,customEvents | where timestamp > ago(1d) | where iif('*' in (\"*\"), 1==1, name in (\"*\")); let resultTable = mainTable; resultTable | summarize Events = count() by bin(timestamp, grain) | order by timestamp asc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (barChartMode == 'TimeBar'), result = 'let grain = iff({isTimeRange}, {ByValue}, 1h); let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let resultTable = {mainTableQuery}; resultTable | summarize Events = count() by bin(timestamp, grain) | order by timestamp asc'", + "criteriaContext": { + "leftOperand": "barChartMode", + "operator": "==", + "rightValType": "static", + "rightVal": "TimeBar", + "resultValType": "static", + "resultVal": "let grain = iff({isTimeRange}, {ByValue}, 1h); let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let resultTable = {mainTableQuery}; resultTable | summarize Events = count() by bin(timestamp, grain) | order by timestamp asc" + } + }, + { + "condition": "if (barChartMode == 'ByValueBar'), result = 'let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let byTable = {mainTableQuery}; let queryTable = {byTableQuery}; let byCohortTable = queryTable | project dimension, timestamp; let topSegments = byCohortTable | summarize Events = count() by dimension | top 10 by Events | summarize makelist(dimension); let topEventMetrics = byCohortTable | where dimension in (topSegments); let otherEventUsers = byCohortTable | where dimension !in (topSegments) | extend dimension = \"Other\"; otherEventUsers | union topEventMetrics | summarize Events = count() by dimension | order by dimension asc'", + "criteriaContext": { + "leftOperand": "barChartMode", + "operator": "==", + "rightValType": "static", + "rightVal": "ByValueBar", + "resultValType": "static", + "resultVal": "let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let byTable = {mainTableQuery}; let queryTable = {byTableQuery}; let byCohortTable = queryTable | project dimension, timestamp; let topSegments = byCohortTable | summarize Events = count() by dimension | top 10 by Events | summarize makelist(dimension); let topEventMetrics = byCohortTable | where dimension in (topSegments); let otherEventUsers = byCohortTable | where dimension !in (topSegments) | extend dimension = \"Other\"; otherEventUsers | union topEventMetrics | summarize Events = count() by dimension | order by dimension asc" + } + }, + { + "condition": "else result = 'let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let queryTable = {mainTableQuery}; let splitTable = {splitTableQuery}; let cohortedTable = splitTable | summarize events_Counts = count() by bin(timestamp, {ByValue}), dimension; let topSegments = cohortedTable | summarize sumDimension = sum(events_Counts) by dimension | project dimension, sumDimension | top 5 by sumDimension desc nulls last | summarize makelist(dimension); cohortedTable | extend dimension = iff(dimension in (topSegments), dimension, \"Other\")'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let queryTable = {mainTableQuery}; let splitTable = {splitTableQuery}; let cohortedTable = splitTable | summarize events_Counts = count() by bin(timestamp, {ByValue}), dimension; let topSegments = cohortedTable | summarize sumDimension = sum(events_Counts) by dimension | project dimension, sumDimension | top 5 by sumDimension desc nulls last | summarize makelist(dimension); cohortedTable | extend dimension = iff(dimension in (topSegments), dimension, \"Other\")" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - querySegments" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\n | where timestamp {TimeRange}\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let resultTable = {mainTableQuery};\n resultTable\n| summarize Events = dcount(itemId)\n| evaluate narrow()\n| project Column, Value = toreal(Value)\n| project Column = 'events', Value", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "formatter": 1, + "formatOptions": {} + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + }, + "rightContent": { + "columnMatch": "Column", + "formatter": 8, + "formatOptions": {} + }, + "showBorder": false, + "size": "full" + } + }, + "customWidth": "90", + "name": "query - headTile", + "styleSettings": { + "maxWidth": "calc(100% - 180px)" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "b769f9e7-0fbf-44cf-bc09-ad82f941c961", + "version": "KqlParameterItem/1.0", + "name": "ChartType", + "label": "Chart Type", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[{ \"value\": \"barChart\", \"label\": \"Bar chart\", \"selected\":true }, { \"value\": \"lineChart\", \"label\": \"Line chart\"}, { \"value\": \"areaChart\", \"label\": \"Area chart\"}]\r\n", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "d2fb9d29-b3dd-4feb-affa-fb90208632fa", + "version": "KqlParameterItem/1.0", + "name": "chartTypeValue", + "type": 1, + "isRequired": true, + "value": "barChart", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (isTimeRange == 'false'), result = 'barChart'", + "criteriaContext": { + "leftOperand": "isTimeRange", + "operator": "==", + "rightValType": "static", + "rightVal": "false", + "resultValType": "static", + "resultVal": "barChart" + } + }, + { + "condition": "else result = ChartType", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "ChartType" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "formVertical", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "isTimeRange", + "comparison": "isEqualTo", + "value": "true" + }, + "customWidth": "20", + "name": "parameters - chartType", + "styleSettings": { + "maxWidth": "180px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{barChartQuery}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "barchart" + }, + "conditionalVisibility": { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "barChart" + }, + "showPin": true, + "name": "query - barChart", + "styleSettings": { + "progressStyle": "squares" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{barChartQuery}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "linechart" + }, + "conditionalVisibilities": [ + { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "lineChart" + }, + { + "parameterName": "isTimeRange", + "comparison": "isEqualTo", + "value": "true" + } + ], + "conditionalVisibility": { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "lineChart" + }, + "showPin": true, + "name": "query - lineChart", + "styleSettings": { + "progressStyle": "squares" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{barChartQuery}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "areachart" + }, + "conditionalVisibilities": [ + { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "areaChart" + }, + { + "parameterName": "isTimeRange", + "comparison": "isEqualTo", + "value": "true" + } + ], + "conditionalVisibility": { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "areaChart" + }, + "showPin": true, + "name": "query - areaChart", + "styleSettings": { + "progressStyle": "squares" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "loadType": "explicit", + "loadButtonText": "View More Insights", + "items": [ + { + "type": 1, + "content": { + "json": "#### {TimeRange}" + }, + "name": "text - timeRange1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters};\r\n let resultTable = {mainTableQuery};\r\n resultTable\r\n | summarize USERS = dcount(user_Id), SESSIONS = dcount(session_Id)\r\n | evaluate narrow()\r\n | project Column, Value, id = case(Column =='SESSIONS', 'community-Workbooks/UsageMetrics/Usage - Sessions','community-Workbooks/UsageMetrics/Usage - Users'), UsageViewType = case(Column =='SESSIONS', 'Sessions', 'Users')", + "size": 3, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Column", + "formatter": 1, + "formatOptions": { + "linkTarget": "OpenBlade", + "bladeOpenContext": { + "bladeName": "UsageWorkbookViewerBlade", + "extensionName": "AppInsightsExtension", + "bladeParameters": [ + { + "name": "ComponentId", + "source": "parameter", + "value": "componentId" + }, + { + "name": "ConfigurationId", + "source": "column", + "value": "id" + }, + { + "name": "UsageViewType", + "source": "column", + "value": "UsageViewType" + } + ] + } + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": true, + "size": "auto" + } + }, + "name": "query - usersTile" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "732d8494-7a52-426a-a963-27977fe443d0", + "version": "KqlParameterItem/1.0", + "name": "Properties", + "label": "PROPERTIES", + "type": 2, + "description": "Please select a maximum of 6 items.", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let customDimension = datatable(value:string, label:string, group: string){formattedCustomDimensions};\r\nlet dimensionList = datatable(value:string, label:string, group: string){usageStandardDimension}\r\n | order by label asc;\r\nunion dimensionList, customDimension\r\n | extend value= replace(@'\\\"', @'/:/\\1', tostring(value))\r\n | project value = strcat('{\"value\": \"',value,'\",',' \"label\": \"',label,'\"}'), label, group", + "typeSettings": { + "limitSelectTo": 6, + "additionalResourceOptions": [ + "value::3" + ], + "showDefault": false + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "value": [ + "{\"value\": \"client_CountryOrRegion\", \"label\": \"Country or region\"}", + "{\"value\": \"client_OS\", \"label\": \"Operating system\"}", + "{\"value\": \"client_Browser\", \"label\": \"Browser version\"}" + ] + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 15" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "276061c1-8556-47e1-9fe8-49e1b5f30427", + "version": "KqlParameterItem/1.0", + "name": "columnNameQuery", + "type": 1, + "value": "print '{\"value\": \"client_CountryOrRegion\", \"label\": \"Country or region\"}','{\"value\": \"client_OS\", \"label\": \"Operating system\"}','{\"value\": \"client_Browser\", \"label\": \"Browser version\"}' | evaluate narrow() | project name = parse_json(Value).value | summarize name = tostring(make_list(name)) | project name= substring(name, 1, strlen(name)-2) | project name= replace(@'\"', @'\\1', name) | project name= replace(@'/:/', @'\"', tostring(name))", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Properties is empty ), result = 'print '''", + "criteriaContext": { + "leftOperand": "Properties", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "print ''" + } + }, + { + "condition": "else result = 'print {Properties} | evaluate narrow() | project name = parse_json(Value).value | summarize name = tostring(make_list(name)) | project name= substring(name, 1, strlen(name)-2) | project name= replace(@'\"', @'\\1', name) | project name= replace(@'/:/', @'\"', tostring(name))'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "print {Properties} | evaluate narrow() | project name = parse_json(Value).value | summarize name = tostring(make_list(name)) | project name= substring(name, 1, strlen(name)-2) | project name= replace(@'\"', @'\\1', name) | project name= replace(@'/:/', @'\"', tostring(name))" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "412bb2fa-3a6a-4301-817f-c814a962be9b", + "version": "KqlParameterItem/1.0", + "name": "columnLabelQuery", + "type": 1, + "value": "print '{\"value\": \"client_CountryOrRegion\", \"label\": \"Country or region\"}','{\"value\": \"client_OS\", \"label\": \"Operating system\"}','{\"value\": \"client_Browser\", \"label\": \"Browser version\"}' | evaluate narrow() | project label = parse_json(Value).label, Row | summarize label = make_list(label) by tostring(Row) | project label= replace(@'\\[', @'\\1', tostring(label)) | project label= replace(@'\\]', @'\\1', label) | project label= replace(@'\"', @'\\1', label)", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Properties is empty ), result = 'print '''", + "criteriaContext": { + "leftOperand": "Properties", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "print ''" + } + }, + { + "condition": "else result = 'print {Properties} | evaluate narrow() | project label = parse_json(Value).label, Row | summarize label = make_list(label) by tostring(Row) | project label= replace(@'\\[', @'\\1', tostring(label)) | project label= replace(@'\\]', @'\\1', label) | project label= replace(@'\"', @'\\1', label)'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "print {Properties} | evaluate narrow() | project label = parse_json(Value).label, Row | summarize label = make_list(label) by tostring(Row) | project label= replace(@'\\[', @'\\1', tostring(label)) | project label= replace(@'\\]', @'\\1', label) | project label= replace(@'\"', @'\\1', label)" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "bce9a188-8ca9-4dbd-8932-e8bd8de1275c", + "version": "KqlParameterItem/1.0", + "name": "selectedProperties", + "type": 1, + "query": "{columnNameQuery}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "33aa8135-eecc-43d0-ab23-53c73d1e817d", + "version": "KqlParameterItem/1.0", + "name": "labelOfSelectedProperties", + "type": 1, + "query": "{columnLabelQuery}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "737850dd-0480-45d4-81b6-23922fb596d6", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn1", + "type": 1, + "description": "Column name for first property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[0];\r\n print iff(isempty(value), '', value)", + "value": "client_CountryOrRegion", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "da94f8c8-21d9-4626-94ab-4676e1fb1561", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn2", + "type": 1, + "description": "Column name for second property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[1];\r\n print iff(isempty(value), '', value)", + "value": "client_OS", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "2769f12c-16c9-43b2-8262-5bcf88fbc309", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn3", + "type": 1, + "description": "Column name for third property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[2];\r\n print iff(isempty(value), '', value)", + "value": "client_Browser", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "30cc6cfa-dd0e-482d-8124-e752ac406141", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn4", + "type": 1, + "description": "Column name for four property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[3];\r\n print iff(isempty(value), '', value)", + "value": "", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "900a04cf-59bd-48f0-ba3e-82b1e8688907", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn5", + "type": 1, + "description": "Column name for fifth property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[4];\r\n print iff(isempty(value), '', value)", + "value": "", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "391fb4a3-340b-4a78-a311-b400cb967115", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn6", + "type": 1, + "description": "Column name for sixth property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[5];\r\n print iff(isempty(value), '', value)", + "value": "", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "407dabfe-31be-4cc4-84ae-8f1db8fa18a5", + "version": "KqlParameterItem/1.0", + "name": "column1Name", + "type": 1, + "description": "Column name for first property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[0]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "b1a720e5-688e-4141-a82f-6c813cb9baeb", + "version": "KqlParameterItem/1.0", + "name": "column2Name", + "type": 1, + "description": " Column name for second property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[1]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "a0b639b2-e49f-4953-8fa3-16e7381792b7", + "version": "KqlParameterItem/1.0", + "name": "column3Name", + "type": 1, + "description": "Column name for third property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[2]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "7c5ea397-c2bd-446d-8799-2f5377962cca", + "version": "KqlParameterItem/1.0", + "name": "column4Name", + "type": 1, + "description": "Column name for fourth property grid", + "query": "print split('{labelOfSelectedProperties}', ',')[3]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "9e8c075d-090b-4d36-898a-01e4ec91560f", + "version": "KqlParameterItem/1.0", + "name": "column5Name", + "type": 1, + "description": "Column name for fifth property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[4]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "15c86faa-dab0-4d51-aec8-e867b2f90bc6", + "version": "KqlParameterItem/1.0", + "name": "column6Name", + "type": 1, + "description": "Column name for sixth property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[5]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 11" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery};\r\n let cohortedTable = queryTable\r\n | extend dimension = {propertyColumn1}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll(itemId) by tostring(dimension)\r\n | extend Events = dcount_hll(hll)\r\n | order by Events desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column1Name}'] = dimension, Counts = dcount_hll(merged);\r\n cohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn1", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery};\r\n let cohortedTable = queryTable\r\n | extend dimension = {propertyColumn2}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll(itemId) by tostring(dimension)\r\n | extend Events = dcount_hll(hll)\r\n | order by Events desc\r\n | serialize rank = row_number()\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column2Name}'] = dimension, Counts = dcount_hll(merged);\r\n cohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn2", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery};\r\n let cohortedTable = queryTable\r\n | extend dimension = {propertyColumn3}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll(itemId) by tostring(dimension)\r\n | extend Events = dcount_hll(hll)\r\n | order by Events desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column3Name}'] = dimension, Counts = dcount_hll(merged);\r\n cohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn3", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery};\r\n let cohortedTable = queryTable\r\n | extend dimension = {propertyColumn4}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll(itemId) by tostring(dimension)\r\n | extend Events = dcount_hll(hll)\r\n | order by Events desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column4Name}'] = dimension, Counts = dcount_hll(merged);\r\n cohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn4", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery};\r\n let cohortedTable = queryTable\r\n | extend dimension = {propertyColumn5}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll(itemId) by tostring(dimension)\r\n | extend Events = dcount_hll(hll)\r\n | order by Events desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column5Name}'] = dimension, Counts = dcount_hll(merged);\r\n cohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn5", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery};\r\n let cohortedTable = queryTable\r\n | extend dimension = {propertyColumn6}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll(itemId) by tostring(dimension)\r\n | extend Events = dcount_hll(hll)\r\n | order by Events desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column6Name}'] = dimension, Counts = dcount_hll(merged);\r\n cohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn6", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid6" + }, + { + "type": 1, + "content": { + "json": " " + }, + "name": "text - 13", + "styleSettings": { + "margin": "20px" + } + }, + { + "type": 1, + "content": { + "json": "#### EVENT STATISTICS" + }, + "name": "text - 12" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "d80fe630-0e3e-49db-b586-0df42bd7b919", + "version": "KqlParameterItem/1.0", + "name": "FilterByName", + "label": "Filter by name", + "type": 1, + "value": "", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "customWidth": "100", + "name": "parameters - eventsFilterbox", + "styleSettings": { + "maxWidth": "170px" + } + }, + { + "type": 1, + "content": { + "json": "📄 Pageview ​ ‍ 📅 Event ​ ‍ 💬 Request" + }, + "customWidth": "30", + "name": "text - 12", + "styleSettings": { + "padding": "20px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let filterByName = '{FilterByName}';\r\nlet mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters}\r\n | where iff(isempty(filterByName), 1==1, name contains filterByName);\r\n let queryTable = {mainTableQuery}; \r\n queryTable\r\n | summarize arg_max(timestamp, itemId), Users=dcount(user_Id), Sessions = dcount(session_Id), Instances= count(), Item = any(itemId) by name, itemType\r\n| extend rank = 2\r\n | union (queryTable\r\n | summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Instances = count(), Item = any(itemId)\r\n | extend name = 'Overall', rank = 1)\r\n | extend jkey = 1\r\n | join kind = inner (queryTable \r\n | summarize AllUsers = dcount(user_Id), AllSessions = dcount(session_Id), AllInstances = count(), Item = any(itemId)\r\n | extend jkey = 1) on jkey \r\n | where iif(isempty(filterByName), 1==1, name contains filterByName)\r\n | project ['Name'] = case( itemType == 'pageView', strcat('📄 ', name), itemType == 'customEvent', strcat('📅 ', name), itemType == 'request', strcat('💬 ', name), name) , ['Users'] = Users,\r\n ['Sessions'] = Sessions,\r\n ['Count'] = Instances , rank, Item\r\n | order by rank asc, ['Users'] desc\r\n | project-away rank\r\n", + "size": 0, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "linkColumn": "Item", + "linkTarget": "CustomEventDetails", + "showIcon": false + }, + "tooltipFormat": { + "tooltip": "End-to-end transaction details" + } + }, + { + "columnMatch": "Users", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Sessions", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Count", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "Item", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 17, + "min": null, + "max": null + } + } + }, + "name": "query - EventGrid" + } + ] + }, + "name": "group - 21" + } + ] +} \ No newline at end of file diff --git a/UsageMetrics/Workbooks/Usage - Events/settings.json b/UsageMetrics/Workbooks/Usage - Events/settings.json new file mode 100644 index 0000000..db04b73 --- /dev/null +++ b/UsageMetrics/Workbooks/Usage - Events/settings.json @@ -0,0 +1,12 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Events", + "author": "Microsoft", + "galleries": [ + { + "type": "usageMetrics", + "resourceType": "microsoft.insights/components", + "order": 600 + } + ] +} \ No newline at end of file diff --git a/UsageMetrics/Workbooks/Usage - Sessions/Usage - Sessions.workbook b/UsageMetrics/Workbooks/Usage - Sessions/Usage - Sessions.workbook new file mode 100644 index 0000000..eea1eb7 --- /dev/null +++ b/UsageMetrics/Workbooks/Usage - Sessions/Usage - Sessions.workbook @@ -0,0 +1,1767 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "503cdbaf-aef3-4a02-93fd-45140e5d8ec8", + "version": "KqlParameterItem/1.0", + "name": "componentId", + "type": 1, + "description": "componentId for tiles link", + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "37b05d6c-ab7c-4190-94d8-4973fcf06c49", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "During", + "type": 4, + "description": "Choose the time range for this report.", + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 3600000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "ff00e059-7ba9-4dfa-a926-8288cf30fc05", + "version": "KqlParameterItem/1.0", + "name": "UsersList", + "label": "Show sessions for", + "type": 2, + "description": "A cohort filter can be set at edit mode that is a collection of users, sessions, or operations that are matched by a set of filters specified in the definition of the cohort. When a cohort is used in this report, the result will be the intersection of users, sessions, or operations matched by the cohort and users, sessions, or operations matched by the rest of the query in this report.", + "isRequired": true, + "query": "datatable(value: string, label: string, group:string, selected:string) ['user_Id', 'All Users', '', 'true']", + "value": "user_Id", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "f3983330-899b-4e6e-995e-d4c7feefd699", + "version": "KqlParameterItem/1.0", + "name": "requestsCount", + "type": 1, + "query": "union requests\r\n| where timestamp {TimeRange}\r\n| count\r\n", + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5f3f81d8-c4fb-40f1-8496-199a2da27852", + "version": "KqlParameterItem/1.0", + "name": "pageViewsCount", + "type": 1, + "query": "union pageViews\r\n | where timestamp {TimeRange}\r\n | count\r\n", + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "0afb0089-98e9-479c-b12e-a982870ce6be", + "version": "KqlParameterItem/1.0", + "name": "Whoused", + "label": "Who used", + "type": 2, + "description": "Choose which custom events, requests and page views the users should have sent for this report.", + "isRequired": true, + "query": "let defaultValue = iff('{pageViewsCount}' == '', 'customEvents','pageViews,customEvents');\r\ndatatable(value: string, label: string) ['pageViews,customEvents,requests', 'Any Custom Events, Request or Page View', 'pageViews,customEvents', 'Any Custom Events or Page View', 'requests,customEvents', 'Any Custom Events or Request','requests,pageViews','Any Request or Page View','customEvents','Any Custom Event','pageViews', 'Any Page View', 'requests', 'Any Request']\r\n| where '{requestsCount}' != '' or value !contains 'requests'\r\n| where '{pageViewsCount}' != '' or value !contains 'pageViews'\r\n| extend selected = iif(value == defaultValue, 'true', '')", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "fd41f402-40ca-4dc5-bd29-38ec93f9d521", + "version": "KqlParameterItem/1.0", + "name": "UserEvent", + "label": "Events", + "type": 2, + "description": " Choose multiple events, requests and page views, the report will show users who did at least one of the events, requests or page views, not necessarily all of the selected events, requests and page views.", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union {Whoused}\r\n | where timestamp {TimeRange}\r\n | project name, group = case(itemType == 'pageView', 'Page Views', itemType == 'customEvent', 'Custom Events', 'Requests')\r\n | summarize count() by group, name\r\n | project value=name, label=name, group, selected=''\r\n //| union showCohort\r\n | extend value = replace(@\"\\\\'\", @\"'\\1\",value)\r\n | order by group asc, label asc", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*", + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "e4152b00-9f31-4ac2-b1c9-2f0964513368", + "version": "KqlParameterItem/1.0", + "name": "usageStandardDimension", + "type": 1, + "description": "Query Standard dimension ", + "isRequired": true, + "query": "let dimensionList = datatable(ColumnName:string, label:string)[\r\n\t'application_Version', 'Application version',\r\n\t'user_AuthenticatedId', 'Authenticated or anonymous traffic',\r\n\t'client_Browser', 'Browser version', \r\n\t'client_City', 'City',\r\n 'client_CountryOrRegion', 'Country or region', \r\n\t'cloud_RoleInstance', 'Cloud role instance', \r\n\t'cloud_RoleName', 'Cloud role name',\r\n\t'client_Model', 'Device model', \r\n 'client_OS', 'Operating system',\r\n\t'client_Type', 'Device type',\r\n\t'isSynthetic', 'Is real user traffic',\r\n 'name', 'Name', \r\n\t'operation_Name', 'Operation name',\r\n\t'performanceBucket', 'Performance',\r\n 'resultCode', 'Result code',\r\n 'responseCode', 'Response code',\r\n\t'tostring(parseurl(url)[\"Host\"])', 'URL host', \r\n\t'tostring(parseurl(url)[\"Path\"])', 'URL path',\r\n\t'operation_SyntheticSource', 'Source of synthetic traffic',\r\n\t'client_CountryOrRegion', 'State or province', \r\n\t'success', 'Successful request',\r\n 'type','Telemetry type'\r\n\t] | order by label asc;\r\nunion {Whoused}\r\n | where timestamp {TimeRange}\r\n | getschema \r\n | where ColumnType == \"string\"\r\n | summarize count() by ColumnName\r\n | join kind = inner dimensionList on ColumnName\r\n | project ColumnName, label\r\n | order by label asc\r\n | project data = strcat(\"'\", ColumnName,\"','\",label,\"','Standard Properties'\")", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "b6db195f-a819-45ff-8eed-bae7c09ab135", + "version": "KqlParameterItem/1.0", + "name": "getCustomDimensions", + "type": 1, + "description": "The query is resued by ByValue, SplityBy and Properties dropdown", + "isRequired": true, + "query": "union {Whoused}\r\n | where timestamp {TimeRange}\r\n | project column_ifexists(\"customDimensions\",'')\r\n | evaluate bag_unpack(column_ifexists(\"customDimensions\",''))\r\n | getschema \r\n | where ColumnType == 'string'\r\n | summarize count() by ColumnName \r\n | project value =strcat(\"customDimensions[\\\"\", ColumnName, \"\\\"]\"), label =ColumnName, group='Custom Properties'\r\n | order by label asc\r\n | project data = strcat(\"'\", value,\"','\",label,\"','\",group,\"'\")", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "8b11feda-c3d4-4fb6-93d4-92321ccabd9d", + "version": "KqlParameterItem/1.0", + "name": "formattedCustomDimensions", + "type": 1, + "isRequired": true, + "value": "[]", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (getCustomDimensions is empty ), result = '[]'", + "criteriaContext": { + "leftOperand": "getCustomDimensions", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "[]" + } + }, + { + "condition": "if (getCustomDimensions starts with '['), result = getCustomDimensions", + "criteriaContext": { + "leftOperand": "getCustomDimensions", + "operator": "startsWith", + "rightValType": "static", + "rightVal": "[", + "resultValType": "param", + "resultVal": "getCustomDimensions" + } + }, + { + "condition": "else result = '[{getCustomDimensions}]'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "[{getCustomDimensions}]" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "8cd9003c-8e76-4d21-8b22-b7a11197f42f", + "version": "KqlParameterItem/1.0", + "name": "ByValue", + "label": "By value x-axis", + "type": 2, + "description": "Choose a time grain or property to create x-axis for users.", + "isRequired": true, + "query": "let grainList = datatable(value:string, label:string, seconds:string, group: string, selected: string)[\r\n'3m', '3 minutes', '3600', 'Time Range', 'true',\r\n\t'1h', '1 hour', '86400', 'Time Range', 'true',\r\n\t'2h', '2 hours', '172800', 'Time Range', 'true',\r\n\t'3h', '3 hours', '259200', 'Time Range', 'true',\r\n\t'1d', '1 day', '604800', 'Time Range', 'true',\r\n\t'12h', '12 hours', '604800', 'Time Range', '',\r\n\t'1d', '1 day', '1209600', 'Time Range', 'true',\r\n\t'1d', '1 day', '2592000', 'Time Range', 'true',\r\n\t'7d', '7 days', '2592000', 'Time Range', '',\r\n\t'1d', '1 day', '5184000', 'Time Range', 'true',\r\n\t'7d', '7 days', '5184000', 'Time Range', '',\r\n\t'1d', '1 day', '7776000', 'Time Range', 'true',\r\n\t'7d', '7 days', '7776000', 'Time Range', ''\r\n\t];\r\n let timeTable = grainList\r\n | where seconds == '{TimeRange:seconds}'\r\n | project value, label, group, selected;\r\nlet customDimension = datatable(value:string, label:string, group: string){formattedCustomDimensions};let dimensionList = datatable(value:string, label:string, group: string) {usageStandardDimension};\r\ntimeTable\r\n | union //showCohort,\r\n dimensionList, customDimension\r\n | project value, label, group, selected", + "value": "1h", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "cf1d4683-4853-4302-9c6e-4ea1925dfc5f", + "version": "KqlParameterItem/1.0", + "name": "isByCohort", + "type": 1, + "description": "Is x-axis created by cohort or not?", + "query": "let query = '{ByValue}';\r\n print parse_json(query).isCohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "033f9e3f-5198-4709-94d7-254b824c9669", + "version": "KqlParameterItem/1.0", + "name": "isTimeRange", + "type": 1, + "description": "Is x-axis created by time bins or not?", + "isRequired": true, + "value": "true", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (isByCohort == 'true'), result = 'false'", + "criteriaContext": { + "leftOperand": "isByCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "true", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "if (ByValue regex '[1,2,3,7,12][m|h|d]'), result = 'true'", + "criteriaContext": { + "leftOperand": "ByValue", + "operator": "regex", + "rightValType": "static", + "rightVal": "[1,2,3,7,12][m|h|d]", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "condition": "else result = 'false'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "47faf500-a03f-4600-bb6d-973d248fe874", + "version": "KqlParameterItem/1.0", + "name": "UsageSplitBy", + "label": "Split by", + "type": 2, + "description": "Choose a property lets you segment by users.", + "isRequired": true, + "query": "let customDimension = datatable(value:string, label:string, group: string){formattedCustomDimensions}; \r\nlet PropertyList = union (datatable(value:string, label:string, group: string){usageStandardDimension}), customDimension\r\n | extend timerange= '{TimeRange}'\r\n | where '{isTimeRange}' == 'true'\r\n | project value, label, group, selected ='';\r\ndatatable(value:string, label:string, group: string, selected: string)[\r\n\t'', 'unset', '', 'true'] \r\n | union //showCohort,\r\n PropertyList", + "value": "", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "d9f3a9e9-dbc8-43bd-8f91-46cafa82250e", + "version": "KqlParameterItem/1.0", + "name": "IsSplitCohort", + "type": 1, + "description": "Check if SplitBy selection is a cohrt", + "query": "let query = '{UsageSplitBy}';\r\n print parse_json(query).isCohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "6aa9fe7f-8c73-4871-8b9f-c15014832721", + "version": "KqlParameterItem/1.0", + "name": "barChartMode", + "type": 1, + "description": "Get bar Chart mode", + "isRequired": true, + "query": "print iff('{UsageSplitBy}' == '' and '{isTimeRange}' == 'true', 'TimeBar', iff('{UsageSplitBy}' == '' and '{isTimeRange}' == 'false', 'ByValueBar', 'SplitBar'))", + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - mainSelections" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5632ed58-6194-40d9-a714-73c23cdba54d", + "version": "KqlParameterItem/1.0", + "name": "customFilters", + "label": "Filters", + "type": 1, + "description": "Add filters. Example: | where client_City == \"Seattle\" | where client_OS contains \"Windows\" ", + "typeSettings": { + "multiLineText": true, + "editorLanguage": "kql" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "e33eefc9-12e4-46ba-8a2b-5df923480f9d", + "version": "KqlParameterItem/1.0", + "name": "filters", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = customFilters", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "customFilters" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 8" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "bc878678-8cbc-4c1c-b6be-0c2fd8604fb8", + "version": "KqlParameterItem/1.0", + "name": "cohortUsersQuery", + "type": 1, + "description": "Extract query in cohort json from UsersList dropdown ", + "query": "let query = '{UsersList}';\r\n print parse_json(query).cohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "705011ae-3a87-4f26-885d-d4d9545b29f4", + "version": "KqlParameterItem/1.0", + "name": "isBelongCohort", + "type": 1, + "description": "Extract IsBelong property in cohort json from UsersList dropdown ", + "query": "let query = '{UsersList}';\r\n print parse_json(query).isBelong", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "706e8b54-1ac7-4243-ab36-f9d67343e025", + "version": "KqlParameterItem/1.0", + "name": "mainTableQuery", + "type": 1, + "description": "mainTable Query", + "isRequired": true, + "value": "mainTable", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (isBelongCohort == 'true'), result = '(){{cohortUsersQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | join kind=inner (mainTable | extend hashedUserId = hash(user_Id)) on hashedUserId}'", + "criteriaContext": { + "leftOperand": "isBelongCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "true", + "resultValType": "static", + "resultVal": "(){{cohortUsersQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | join kind=inner (mainTable | extend hashedUserId = hash(user_Id)) on hashedUserId}" + } + }, + { + "condition": "if (isBelongCohort == 'false'), result = '(){{cohortUsersQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | join kind=rightanti (mainTable | extend hashedUserId = hash(user_Id)) on hashedUserId}'", + "criteriaContext": { + "leftOperand": "isBelongCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "false", + "resultValType": "static", + "resultVal": "(){{cohortUsersQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | join kind=rightanti (mainTable | extend hashedUserId = hash(user_Id)) on hashedUserId}" + } + }, + { + "condition": "else result = 'mainTable'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "mainTable" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "77ab1a31-79d2-4431-b131-59b8631d1fdd", + "version": "KqlParameterItem/1.0", + "name": "byCohortQuery", + "type": 1, + "description": "Extract query in cohort json from ByValue dropdown", + "query": "let query = '{ByValue}';\r\n print parse_json(query).cohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "9aa04628-19d5-43b7-9190-e10d3d067c08", + "version": "KqlParameterItem/1.0", + "name": "byTableQuery", + "type": 1, + "description": "By query segement ", + "value": "() {byTable | extend dimension = 1h | extend dimension = iif(isempty(dimension), \"\", dimension)}", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (isByCohort == 'true'), result = '() {{byCohortQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | extend byColumn = \"Cohort Users\" | join kind=rightouter (byTable | extend hashedUserId = hash(user_Id)) on hashedUserId | extend dimension = byColumn | extend dimension = iif(isempty(dimension), \"Others\", \"Cohort\")}'", + "criteriaContext": { + "leftOperand": "isByCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "true", + "resultValType": "static", + "resultVal": "() {{byCohortQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | extend byColumn = \"Cohort Users\" | join kind=rightouter (byTable | extend hashedUserId = hash(user_Id)) on hashedUserId | extend dimension = byColumn | extend dimension = iif(isempty(dimension), \"Others\", \"Cohort\")}" + } + }, + { + "condition": "else result = '() {byTable | extend dimension = {ByValue} | extend dimension = iif(isempty(dimension), \"\", dimension)}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "() {byTable | extend dimension = {ByValue} | extend dimension = iif(isempty(dimension), \"\", dimension)}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "463cf64c-ceec-4831-b4a1-d72953670eee", + "version": "KqlParameterItem/1.0", + "name": "splitbyLabel", + "type": 1, + "value": "unset", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{UsageSplitBy:label}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{UsageSplitBy:label}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "9645e737-0b9c-437f-94d7-cf27c2151639", + "version": "KqlParameterItem/1.0", + "name": "splitCohortQuery", + "type": 1, + "description": "Extract query in cohort json from SplitBy dropdown", + "query": "let query = '{UsageSplitBy}';\r\n print parse_json(query).cohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "d4a9bee5-e949-4c51-82f6-f074b03c5dae", + "version": "KqlParameterItem/1.0", + "name": "splitTableQuery", + "type": 1, + "description": "Split query segement", + "value": "() {queryTable | extend dimension = | extend dimension = iif(isempty(dimension), \"\", dimension)}", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (IsSplitCohort == 'true'), result = '() {{splitCohortQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | extend splitColumn = \"Cohort Users\" | join kind=rightouter (queryTable | extend hashedUserId = hash(user_Id)) on hashedUserId | extend dimension = splitColumn | extend dimension = iif(isempty(dimension), \"Others\", \"{splitbyLabel:escape} \")}'", + "criteriaContext": { + "leftOperand": "IsSplitCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "true", + "resultValType": "static", + "resultVal": "() {{splitCohortQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | extend splitColumn = \"Cohort Users\" | join kind=rightouter (queryTable | extend hashedUserId = hash(user_Id)) on hashedUserId | extend dimension = splitColumn | extend dimension = iif(isempty(dimension), \"Others\", \"{splitbyLabel:escape} \")}" + } + }, + { + "condition": "else result = '() {queryTable | extend dimension = {UsageSplitBy} | extend dimension = iif(isempty(dimension), \"\", dimension)}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "() {queryTable | extend dimension = {UsageSplitBy} | extend dimension = iif(isempty(dimension), \"\", dimension)}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "f949bcae-483d-4356-a3c4-3e43652ffbf8", + "version": "KqlParameterItem/1.0", + "name": "cohortEventsQuery", + "type": 1, + "description": "Extract cohort queries from UserEvent dropdown", + "query": "let table = print {UserEvent}\r\n| evaluate narrow()\r\n| where Value startswith\"{\\\"cohort\\\":\"\r\n| project name = \"cohorts\", Cohorts = strcat(\"(\",parse_json(Value).cohort, \" | summarize makeset(name)\");\r\ntable\r\n| summarize cohorts = make_list(Cohorts) by tostring(name)\r\n| project cohorts= replace(@'\\[', @'union \\1', tostring(cohorts))\r\n| project cohorts= replace(@'name\\)\"', @'name)) \\1', cohorts)\r\n| project cohorts= replace(@'\"', @'\\1', cohorts)\r\n| project cohorts= replace(@'\\]', @'\\1', cohorts)\r\n", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "f04476f6-28f6-4d71-b39f-950a6c37c747", + "version": "KqlParameterItem/1.0", + "name": "userEventsQuery", + "type": 1, + "description": "Extract event queries from UserEvent dropdown", + "query": "print {UserEvent}\r\n| evaluate narrow()\r\n| where Value !startswith\"{\\\"cohort\\\":\"\r\n| summarize events = make_list(Value) by tostring(Row)\r\n| project events= replace(@'\\[', @'\\1', tostring(events))\r\n| project events= replace(@'\\]', @'\\1', events) | project events= replace(@\"'\", @\"\\\\'\\1\", events)", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "8738ce5d-ad4e-46f0-8b54-98dd29b3bd7c", + "version": "KqlParameterItem/1.0", + "name": "getCohortEventsQuery", + "type": 1, + "description": "Merge cohort queries ", + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (UserEvent == ''*''), result = 'print '''", + "criteriaContext": { + "leftOperand": "UserEvent", + "operator": "==", + "rightValType": "static", + "rightVal": "'*'", + "resultValType": "static", + "resultVal": "print ''" + } + }, + { + "condition": "if (cohortEventsQuery is empty ), result = '{cohortEventsQuery}'", + "criteriaContext": { + "leftOperand": "cohortEventsQuery", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{cohortEventsQuery}" + } + }, + { + "condition": "else result = ' {cohortEventsQuery} | project cohortEvents= replace(@'\\[', @'\\1', tostring(set_name)) | project cohortEvents= replace(@'\\]', @'\\1', cohortEvents)'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": " {cohortEventsQuery} | project cohortEvents= replace(@'\\[', @'\\1', tostring(set_name)) | project cohortEvents= replace(@'\\]', @'\\1', cohortEvents)" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "40bc31ca-6b81-4352-909f-c89f99709f0d", + "version": "KqlParameterItem/1.0", + "name": "processCohortEvents1", + "type": 1, + "description": "Get cohort query results", + "query": "{getCohortEventsQuery}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "c2550954-dd71-4f65-ae6e-e5e0b08db15e", + "version": "KqlParameterItem/1.0", + "name": "processCohortEvents2", + "type": 1, + "description": "Merge cohort query results", + "query": "print cohorts= '{processCohortEvents1}' \r\n| project cohorts= replace(@'\\[', @'\\1', tostring(cohorts))\r\n| project cohorts= replace(@'\\]', @'\\1', cohorts)\r\n", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5f624496-5eaf-4c14-a16f-6dbb85128e63", + "version": "KqlParameterItem/1.0", + "name": "userEventsList", + "type": 1, + "description": "Merge cohort and user Events", + "isRequired": true, + "query": "let userEvents = '{userEventsQuery}';\r\nlet cohortEvents = '{processCohortEvents2}';\r\nlet userEventsString = iff(strlen(userEvents)>0 and strlen(cohortEvents)>0, strcat(userEvents, ','), userEvents);\r\nprint strcat(userEventsString, cohortEvents)", + "value": "\"*\"", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "7c3949b0-f3f7-40ce-a51d-e3ca186ce57f", + "version": "KqlParameterItem/1.0", + "name": "barChartQuery", + "type": 1, + "isRequired": true, + "value": "let grain = 1h; let mainTable = union pageViews,customEvents | where timestamp > ago(1d) | where iif('*' in (\"*\"), 1==1, name in (\"*\")); let resultTable = mainTable; resultTable | summarize Sessions = dcount(session_Id) by bin(timestamp, grain) | order by timestamp asc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (barChartMode == 'TimeBar'), result = 'let grain = iff({isTimeRange}, {ByValue}, 1h); let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let resultTable = {mainTableQuery}; resultTable | summarize Sessions = dcount(session_Id) by bin(timestamp, grain) | order by timestamp asc'", + "criteriaContext": { + "leftOperand": "barChartMode", + "operator": "==", + "rightValType": "static", + "rightVal": "TimeBar", + "resultValType": "static", + "resultVal": "let grain = iff({isTimeRange}, {ByValue}, 1h); let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let resultTable = {mainTableQuery}; resultTable | summarize Sessions = dcount(session_Id) by bin(timestamp, grain) | order by timestamp asc" + } + }, + { + "condition": "if (barChartMode == 'ByValueBar'), result = 'let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let byTable = {mainTableQuery}; let queryTable = {byTableQuery}; let byCohortTable = queryTable | project dimension, session_Id, timestamp; let topSegments = byCohortTable | summarize Sessions = dcount(session_Id) by dimension | top 10 by Sessions | summarize makelist(dimension); let topEventMetrics = byCohortTable | where dimension in (topSegments); let otherEventUsers = byCohortTable | where dimension !in (topSegments) | extend dimension = \"Other\"; otherEventUsers | union topEventMetrics | summarize Sessions = dcount(session_Id) by dimension | order by dimension asc'", + "criteriaContext": { + "leftOperand": "barChartMode", + "operator": "==", + "rightValType": "static", + "rightVal": "ByValueBar", + "resultValType": "static", + "resultVal": "let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let byTable = {mainTableQuery}; let queryTable = {byTableQuery}; let byCohortTable = queryTable | project dimension, session_Id, timestamp; let topSegments = byCohortTable | summarize Sessions = dcount(session_Id) by dimension | top 10 by Sessions | summarize makelist(dimension); let topEventMetrics = byCohortTable | where dimension in (topSegments); let otherEventUsers = byCohortTable | where dimension !in (topSegments) | extend dimension = \"Other\"; otherEventUsers | union topEventMetrics | summarize Sessions = dcount(session_Id) by dimension | order by dimension asc" + } + }, + { + "condition": "else result = 'let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let queryTable = {mainTableQuery}; let splitTable = {splitTableQuery}; let cohortedTable = splitTable | extend byDimension = bin(timestamp, {ByValue}) | summarize metricHll = hll(session_Id) by byDimension, dimension; let topSegments = cohortedTable | summarize mergedMetricHll = hll_merge(metricHll) by dimension | project dimension, dcount_session_Id = dcount_hll(mergedMetricHll) | top 5 by dcount_session_Id desc nulls last | summarize makelist(dimension); cohortedTable | extend dimension = iff(dimension in (topSegments), dimension, \"Other\") | project byDimension, dimension, metricHll | fork(summarize metric = hll_merge(metricHll) by dimension,byDimension | project byDimension, dimension, metric = dcount_hll(metric)) (summarize metric = hll_merge(metricHll) by dimension | project dimension, metric = dcount_hll(metric)) (summarize metric = hll_merge(metricHll) | project metric = dcount_hll(metric))'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let queryTable = {mainTableQuery}; let splitTable = {splitTableQuery}; let cohortedTable = splitTable | extend byDimension = bin(timestamp, {ByValue}) | summarize metricHll = hll(session_Id) by byDimension, dimension; let topSegments = cohortedTable | summarize mergedMetricHll = hll_merge(metricHll) by dimension | project dimension, dcount_session_Id = dcount_hll(mergedMetricHll) | top 5 by dcount_session_Id desc nulls last | summarize makelist(dimension); cohortedTable | extend dimension = iff(dimension in (topSegments), dimension, \"Other\") | project byDimension, dimension, metricHll | fork(summarize metric = hll_merge(metricHll) by dimension,byDimension | project byDimension, dimension, metric = dcount_hll(metric)) (summarize metric = hll_merge(metricHll) by dimension | project dimension, metric = dcount_hll(metric)) (summarize metric = hll_merge(metricHll) | project metric = dcount_hll(metric))" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - querySegments" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let resultTable = {mainTableQuery};\r\n resultTable\r\n| summarize Sessions = dcount(session_Id)\r\n| evaluate narrow()\r\n| project Column, Value = toreal(Value)\r\n| project Column = 'sessions', Value", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "formatter": 1, + "formatOptions": {} + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + }, + "rightContent": { + "columnMatch": "Column", + "formatter": 8, + "formatOptions": {} + }, + "showBorder": false, + "size": "full" + } + }, + "customWidth": "90", + "name": "query - headTile", + "styleSettings": { + "maxWidth": "calc(100% - 180px)" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "b769f9e7-0fbf-44cf-bc09-ad82f941c961", + "version": "KqlParameterItem/1.0", + "name": "ChartType", + "label": "Chart Type", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[{ \"value\": \"barChart\", \"label\": \"Bar chart\", \"selected\":true }, { \"value\": \"lineChart\", \"label\": \"Line chart\"}, { \"value\": \"areaChart\", \"label\": \"Area chart\"}]\r\n", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "d2fb9d29-b3dd-4feb-affa-fb90208632fa", + "version": "KqlParameterItem/1.0", + "name": "chartTypeValue", + "type": 1, + "isRequired": true, + "value": "barChart", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (isTimeRange == 'false'), result = 'barChart'", + "criteriaContext": { + "leftOperand": "isTimeRange", + "operator": "==", + "rightValType": "static", + "rightVal": "false", + "resultValType": "static", + "resultVal": "barChart" + } + }, + { + "condition": "else result = ChartType", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "ChartType" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "formVertical", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "isTimeRange", + "comparison": "isEqualTo", + "value": "true" + }, + "customWidth": "20", + "name": "parameters - chartType", + "styleSettings": { + "maxWidth": "180px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{barChartQuery}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "barchart" + }, + "conditionalVisibility": { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "barChart" + }, + "showPin": true, + "name": "query - barChart", + "styleSettings": { + "progressStyle": "squares" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{barChartQuery}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "linechart" + }, + "conditionalVisibilities": [ + { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "lineChart" + }, + { + "parameterName": "isTimeRange", + "comparison": "isEqualTo", + "value": "true" + } + ], + "conditionalVisibility": { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "lineChart" + }, + "showPin": true, + "name": "query - lineChart", + "styleSettings": { + "progressStyle": "squares" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{barChartQuery}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "areachart" + }, + "conditionalVisibilities": [ + { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "areaChart" + }, + { + "parameterName": "isTimeRange", + "comparison": "isEqualTo", + "value": "true" + } + ], + "conditionalVisibility": { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "areaChart" + }, + "showPin": true, + "name": "query - areaChart", + "styleSettings": { + "progressStyle": "squares" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "loadType": "explicit", + "loadButtonText": "View More Insights", + "items": [ + { + "type": 1, + "content": { + "json": "#### {TimeRange}" + }, + "name": "text - timeRange1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters};\r\n let resultTable = {mainTableQuery};\r\n resultTable\r\n | summarize USERS = dcount(user_Id), EVENTS = count()\r\n | evaluate narrow()\r\n | project Column, Value, id = case(Column =='USERS', 'community-Workbooks/UsageMetrics/Usage - Users', 'community-Workbooks/UsageMetrics/Usage - Events'), UsageViewType = case(Column =='USERS', 'Users', 'Events')\r\n", + "size": 3, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Column", + "formatter": 1, + "formatOptions": { + "linkTarget": "OpenBlade", + "bladeOpenContext": { + "bladeName": "UsageWorkbookViewerBlade", + "extensionName": "AppInsightsExtension", + "bladeParameters": [ + { + "name": "ComponentId", + "source": "parameter", + "value": "componentId" + }, + { + "name": "ConfigurationId", + "source": "column", + "value": "id" + }, + { + "name": "UsageViewType", + "source": "column", + "value": "UsageViewType" + } + ] + } + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": true, + "size": "auto" + } + }, + "name": "query - usersTile" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "732d8494-7a52-426a-a963-27977fe443d0", + "version": "KqlParameterItem/1.0", + "name": "Properties", + "label": "PROPERTIES", + "type": 2, + "description": "Please select a maximum of 6 items.", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let customDimension = datatable(value:string, label:string, group: string){formattedCustomDimensions};\r\nlet dimensionList = datatable(value:string, label:string, group: string){usageStandardDimension}\r\n | order by label asc;\r\nunion dimensionList, customDimension\r\n | extend value= replace(@'\\\"', @'/:/\\1', tostring(value))\r\n | project value = strcat('{\"value\": \"',value,'\",',' \"label\": \"',label,'\"}'), label, group", + "typeSettings": { + "limitSelectTo": 6, + "additionalResourceOptions": [ + "value::3" + ], + "showDefault": false + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "value": [ + "{\"value\": \"client_CountryOrRegion\", \"label\": \"Country or region\"}", + "{\"value\": \"client_OS\", \"label\": \"Operating system\"}", + "{\"value\": \"client_Browser\", \"label\": \"Browser version\"}" + ] + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 15" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "276061c1-8556-47e1-9fe8-49e1b5f30427", + "version": "KqlParameterItem/1.0", + "name": "columnNameQuery", + "type": 1, + "value": "print '{\"value\": \"client_CountryOrRegion\", \"label\": \"Country or region\"}','{\"value\": \"client_OS\", \"label\": \"Operating system\"}','{\"value\": \"client_Browser\", \"label\": \"Browser version\"}' | evaluate narrow() | project name = parse_json(Value).value | summarize name = tostring(make_list(name)) | project name= substring(name, 1, strlen(name)-2) | project name= replace(@'\\\"', @'\\1', name) | project name= replace(@'/:/', @'\"', tostring(name))", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Properties is empty ), result = 'print '''", + "criteriaContext": { + "leftOperand": "Properties", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "print ''" + } + }, + { + "condition": "else result = 'print {Properties} | evaluate narrow() | project name = parse_json(Value).value | summarize name = tostring(make_list(name)) | project name= substring(name, 1, strlen(name)-2) | project name= replace(@'\\\"', @'\\1', name) | project name= replace(@'/:/', @'\"', tostring(name))'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "print {Properties} | evaluate narrow() | project name = parse_json(Value).value | summarize name = tostring(make_list(name)) | project name= substring(name, 1, strlen(name)-2) | project name= replace(@'\\\"', @'\\1', name) | project name= replace(@'/:/', @'\"', tostring(name))" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "412bb2fa-3a6a-4301-817f-c814a962be9b", + "version": "KqlParameterItem/1.0", + "name": "columnLabelQuery", + "type": 1, + "value": "print '{\"value\": \"client_CountryOrRegion\", \"label\": \"Country or region\"}','{\"value\": \"client_OS\", \"label\": \"Operating system\"}','{\"value\": \"client_Browser\", \"label\": \"Browser version\"}' | evaluate narrow() | project label = parse_json(Value).label, Row | summarize label = make_list(label) by tostring(Row) | project label= replace(@'\\[', @'\\1', tostring(label)) | project label= replace(@'\\]', @'\\1', label) | project label= replace(@'\\\"', @'\\1', label)", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Properties is empty ), result = 'print '''", + "criteriaContext": { + "leftOperand": "Properties", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "print ''" + } + }, + { + "condition": "else result = 'print {Properties} | evaluate narrow() | project label = parse_json(Value).label, Row | summarize label = make_list(label) by tostring(Row) | project label= replace(@'\\[', @'\\1', tostring(label)) | project label= replace(@'\\]', @'\\1', label) | project label= replace(@'\\\"', @'\\1', label)'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "print {Properties} | evaluate narrow() | project label = parse_json(Value).label, Row | summarize label = make_list(label) by tostring(Row) | project label= replace(@'\\[', @'\\1', tostring(label)) | project label= replace(@'\\]', @'\\1', label) | project label= replace(@'\\\"', @'\\1', label)" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "bce9a188-8ca9-4dbd-8932-e8bd8de1275c", + "version": "KqlParameterItem/1.0", + "name": "selectedProperties", + "type": 1, + "query": "{columnNameQuery}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "33aa8135-eecc-43d0-ab23-53c73d1e817d", + "version": "KqlParameterItem/1.0", + "name": "labelOfSelectedProperties", + "type": 1, + "query": "{columnLabelQuery}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "737850dd-0480-45d4-81b6-23922fb596d6", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn1", + "type": 1, + "description": "Column name for first property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[0];\r\n print iff(isempty(value), '', value)", + "value": "client_CountryOrRegion", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "da94f8c8-21d9-4626-94ab-4676e1fb1561", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn2", + "type": 1, + "description": "Column name for second property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[1];\r\n print iff(isempty(value), '', value)", + "value": "client_OS", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "2769f12c-16c9-43b2-8262-5bcf88fbc309", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn3", + "type": 1, + "description": "Column name for third property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[2];\r\n print iff(isempty(value), '', value)", + "value": "client_Browser", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "30cc6cfa-dd0e-482d-8124-e752ac406141", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn4", + "type": 1, + "description": "Column name for four property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[3];\r\n print iff(isempty(value), '', value)", + "value": "", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "900a04cf-59bd-48f0-ba3e-82b1e8688907", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn5", + "type": 1, + "description": "Column name for fifth property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[4];\r\n print iff(isempty(value), '', value)", + "value": "", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "391fb4a3-340b-4a78-a311-b400cb967115", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn6", + "type": 1, + "description": "Column name for sixth property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[5];\r\n print iff(isempty(value), '', value)", + "value": "", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "407dabfe-31be-4cc4-84ae-8f1db8fa18a5", + "version": "KqlParameterItem/1.0", + "name": "column1Name", + "type": 1, + "description": "Column name for first property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[0]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "b1a720e5-688e-4141-a82f-6c813cb9baeb", + "version": "KqlParameterItem/1.0", + "name": "column2Name", + "type": 1, + "description": " Column name for second property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[1]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "a0b639b2-e49f-4953-8fa3-16e7381792b7", + "version": "KqlParameterItem/1.0", + "name": "column3Name", + "type": 1, + "description": "Column name for third property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[2]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "7c5ea397-c2bd-446d-8799-2f5377962cca", + "version": "KqlParameterItem/1.0", + "name": "column4Name", + "type": 1, + "description": "Column name for fourth property grid", + "query": "print split('{labelOfSelectedProperties}', ',')[3]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "9e8c075d-090b-4d36-898a-01e4ec91560f", + "version": "KqlParameterItem/1.0", + "name": "column5Name", + "type": 1, + "description": "Column name for fifth property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[4]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "15c86faa-dab0-4d51-aec8-e867b2f90bc6", + "version": "KqlParameterItem/1.0", + "name": "column6Name", + "type": 1, + "description": "Column name for sixth property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[5]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 11" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery};\r\n let cohortedTable = queryTable\r\n | extend dimension = {propertyColumn1}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll(session_Id) by tostring(dimension)\r\n | extend Sessions = dcount_hll(hll)\r\n | order by Sessions desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column1Name}'] = dimension, Counts = dcount_hll(merged);\r\n cohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn1", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery};\r\n let cohortedTable = queryTable\r\n | extend dimension = {propertyColumn2}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension) | summarize hll = hll(session_Id) by tostring(dimension)\r\n | extend Sessions = dcount_hll(hll)\r\n | order by Sessions desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column2Name}'] = dimension, Counts = dcount_hll(merged);\r\n cohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn2", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery};\r\n let cohortedTable = queryTable\r\n | extend dimension = {propertyColumn3}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll(session_Id) by tostring(dimension)\r\n | extend Sessions = dcount_hll(hll)\r\n | order by Sessions desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column3Name}'] = dimension, Counts = dcount_hll(merged);\r\n cohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn3", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery};\r\n let cohortedTable = queryTable\r\n | extend dimension = {propertyColumn4}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll(session_Id) by tostring(dimension)\r\n | extend Sessions = dcount_hll(hll)\r\n | order by Sessions desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column4Name}'] = dimension, Counts = dcount_hll(merged);\r\n cohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn4", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery};\r\n let cohortedTable = queryTable\r\n | extend dimension = {propertyColumn5}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll(session_Id) by tostring(dimension)\r\n | extend Sessions = dcount_hll(hll)\r\n | order by Sessions desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column5Name}'] = dimension, Counts = dcount_hll(merged);\r\n cohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn5", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery};\r\n let cohortedTable = queryTable\r\n | extend dimension = {propertyColumn6}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll(session_Id) by tostring(dimension)\r\n | extend Sessions = dcount_hll(hll)\r\n | order by Sessions desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column6Name}'] = dimension, Counts = dcount_hll(merged);\r\n cohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn6", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid6" + }, + { + "type": 1, + "content": { + "json": " " + }, + "name": "text - 13", + "styleSettings": { + "margin": "20px" + } + }, + { + "type": 1, + "content": { + "json": "#### ACTIVE SESSIONS" + }, + "name": "text - 12" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "d80fe630-0e3e-49db-b586-0df42bd7b919", + "version": "KqlParameterItem/1.0", + "name": "SelectSessions", + "label": "Select Sessions", + "type": 2, + "isRequired": true, + "query": "datatable(value:string, text:string)[\r\n'| sample 5', 'Show Any 5 Sessions', \r\n'| top 5 by count_', 'Show Most Active Sessions'\r\n]", + "value": "| sample 5", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - selectUsersDropdown" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\n let queryTable = {mainTableQuery}; \r\n let cohortedTable = queryTable\r\n | where isnotempty(session_Id)\r\n | summarize count() by session_Id\r\n {SelectSessions}\r\n | summarize makelist(session_Id); \r\n queryTable\r\n | where session_Id in (cohortedTable)\r\n | summarize sessionCount = dcount(session_Id),\r\n eventCount = count(),\r\n OS = makeset(client_OS), \r\n Browsers = makeset(client_Browser),\r\n any(client_City, client_CountryOrRegion)\r\n by session_Id \r\n | project Sessions = session_Id, Cities = iff(isempty(any_client_City), \"Unknown\", any_client_City), Countries = iff(isempty(any_client_CountryOrRegion), \"Unknown\", any_client_CountryOrRegion), Events = eventCount, OS=trim_start(', ', replace('\",\"', ', ', trim_end('\"]',substring(OS, 2)))), Browsers = trim_start(', ', replace('\",\"', ', ', trim_end('\"]',substring(Browsers, 2))))\r\n | project Sessions, Location = strcat(Cities, \", \", Countries), Events, NumberLabel = 'events', OS=iff(OS =='', \"Unknown\", iff(strlen(OS) > 40, strcat(substring(OS, 0, 38), '...'), OS)), Browsers = iff(Browsers =='', \"Unknown\", Browsers)\r\n | order by Events desc", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Sessions", + "formatter": 7, + "formatOptions": { + "linkColumn": "Sessions", + "linkTarget": "SessionTimeline", + "linkLabel": "View session timeline", + "linkIsContextBlade": true + } + }, + "subtitleContent": { + "columnMatch": "Location", + "formatter": 1, + "formatOptions": {}, + "tooltipFormat": { + "tooltip": "Location: {0}" + } + }, + "leftContent": { + "columnMatch": "Events", + "formatter": 12, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 4 + } + } + }, + "rightContent": { + "columnMatch": "NumberLabel", + "formatter": 2, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + }, + "tooltipFormat": {} + }, + "secondaryContent": { + "columnMatch": "OS", + "formatOptions": {}, + "tooltipFormat": { + "tooltip": "OS: {0}" + } + }, + "showBorder": true, + "size": "auto" + } + }, + "name": "query - SessionTiles" + } + ] + }, + "name": "group - 20" + } + ] +} \ No newline at end of file diff --git a/UsageMetrics/Workbooks/Usage - Sessions/settings.json b/UsageMetrics/Workbooks/Usage - Sessions/settings.json new file mode 100644 index 0000000..d6057be --- /dev/null +++ b/UsageMetrics/Workbooks/Usage - Sessions/settings.json @@ -0,0 +1,12 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Sessions", + "author": "Microsoft", + "galleries": [ + { + "type": "usageMetrics", + "resourceType": "microsoft.insights/components", + "order": 400 + } + ] +} \ No newline at end of file diff --git a/UsageMetrics/Workbooks/Usage - Users/Usage - Users.workbook b/UsageMetrics/Workbooks/Usage - Users/Usage - Users.workbook new file mode 100644 index 0000000..330170e --- /dev/null +++ b/UsageMetrics/Workbooks/Usage - Users/Usage - Users.workbook @@ -0,0 +1,2099 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "503cdbaf-aef3-4a02-93fd-45140e5d8ec8", + "version": "KqlParameterItem/1.0", + "name": "componentId", + "type": 1, + "description": "componentId for tiles link", + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "37b05d6c-ab7c-4190-94d8-4973fcf06c49", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "During", + "type": 4, + "description": "Choose the time range for this report.", + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 3600000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "ff00e059-7ba9-4dfa-a926-8288cf30fc05", + "version": "KqlParameterItem/1.0", + "name": "UsersList", + "label": "Show", + "type": 2, + "description": "A cohort filter can be set at edit mode that is a collection of users, sessions, or operations that are matched by a set of filters specified in the definition of the cohort. When a cohort is used in this report, the result will be the intersection of users, sessions, or operations matched by the cohort and users, sessions, or operations matched by the rest of the query in this report.", + "isRequired": true, + "query": "datatable(value: string, label: string, group:string, selected:string) ['user_Id', 'All Users', '', 'true', 'user_AuthenticatedId', 'Authenticated Users', '', '']", + "value": "user_Id", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "f3983330-899b-4e6e-995e-d4c7feefd699", + "version": "KqlParameterItem/1.0", + "name": "requestsCount", + "type": 1, + "query": "union requests\r\n| where timestamp {TimeRange}\r\n| count\r\n", + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5f3f81d8-c4fb-40f1-8496-199a2da27852", + "version": "KqlParameterItem/1.0", + "name": "pageViewsCount", + "type": 1, + "query": "union pageViews\r\n | where timestamp {TimeRange}\r\n | count\r\n", + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "0afb0089-98e9-479c-b12e-a982870ce6be", + "version": "KqlParameterItem/1.0", + "name": "Whoused", + "label": "Who used", + "type": 2, + "description": "Choose which custom events, requests and page views the users should have sent for this report.", + "isRequired": true, + "query": "let defaultValue = iff('{pageViewsCount}' == '', 'customEvents','pageViews,customEvents');\r\ndatatable(value: string, label: string) ['pageViews,customEvents,requests', 'Any Custom Events, Request or Page View', 'pageViews,customEvents', 'Any Custom Events or Page View', 'requests,customEvents', 'Any Custom Events or Request','requests,pageViews','Any Request or Page View','customEvents','Any Custom Event','pageViews', 'Any Page View', 'requests', 'Any Request']\r\n| where '{requestsCount}' != '' or value !contains 'requests'\r\n| where '{pageViewsCount}' != '' or value !contains 'pageViews'\r\n| extend selected = iif(value == defaultValue, 'true', '')", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "fd41f402-40ca-4dc5-bd29-38ec93f9d521", + "version": "KqlParameterItem/1.0", + "name": "UserEvent", + "label": "Events", + "type": 2, + "description": " Choose multiple events, requests and page views, the report will show users who did at least one of the events, requests or page views, not necessarily all of the selected events, requests and page views.", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "union {Whoused}\r\n | where timestamp {TimeRange}\r\n | project name, group = case(itemType == 'pageView', 'Page Views', itemType == 'customEvent', 'Custom Events', 'Requests')\r\n | summarize count() by group, name\r\n | project value=name, label=name, group, selected=''\r\n //| union showCohort\r\n | extend value = replace(@\"\\\\'\", @\"'\\1\",value)\r\n | order by group asc, label asc", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*", + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "e4152b00-9f31-4ac2-b1c9-2f0964513368", + "version": "KqlParameterItem/1.0", + "name": "usageStandardDimension", + "type": 1, + "description": "Query Standard dimension ", + "isRequired": true, + "query": "let dimensionList = datatable(ColumnName:string, label:string)[\r\n\t'application_Version', 'Application version',\r\n\t'user_AuthenticatedId', 'Authenticated or anonymous traffic',\r\n\t'client_Browser', 'Browser version', \r\n\t'client_City', 'City',\r\n 'client_CountryOrRegion', 'Country or region', \r\n\t'cloud_RoleInstance', 'Cloud role instance', \r\n\t'cloud_RoleName', 'Cloud role name',\r\n\t'client_Model', 'Device model', \r\n 'client_OS', 'Operating system',\r\n\t'client_Type', 'Device type',\r\n\t'isSynthetic', 'Is real user traffic',\r\n 'name', 'Name', \r\n\t'operation_Name', 'Operation name',\r\n\t'performanceBucket', 'Performance',\r\n 'resultCode', 'Result code',\r\n 'responseCode', 'Response code',\r\n\t'tostring(parseurl(url)[\"Host\"])', 'URL host', \r\n\t'tostring(parseurl(url)[\"Path\"])', 'URL path',\r\n\t'operation_SyntheticSource', 'Source of synthetic traffic',\r\n\t'client_CountryOrRegion', 'State or province', \r\n\t'success', 'Successful request',\r\n 'type','Telemetry type'\r\n\t] | order by label asc;\r\nunion {Whoused}\r\n | where timestamp {TimeRange}\r\n | getschema \r\n | where ColumnType == \"string\"\r\n | summarize count() by ColumnName\r\n | join kind = inner dimensionList on ColumnName\r\n | project ColumnName, label\r\n | order by label asc\r\n | project data = strcat(\"'\", ColumnName,\"','\",label,\"','Standard Properties'\")", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "b6db195f-a819-45ff-8eed-bae7c09ab135", + "version": "KqlParameterItem/1.0", + "name": "getCustomDimensions", + "type": 1, + "description": "The query is resued by ByValue, SplityBy and Properties dropdown", + "isRequired": true, + "query": "union {Whoused}\r\n | where timestamp {TimeRange}\r\n | project column_ifexists(\"customDimensions\",'')\r\n | evaluate bag_unpack(column_ifexists(\"customDimensions\",''))\r\n | getschema \r\n | where ColumnType == 'string'\r\n | summarize count() by ColumnName \r\n | project value =strcat(\"customDimensions[\\\"\", ColumnName, \"\\\"]\"), label =ColumnName, group='Custom Properties'\r\n | order by label asc\r\n | project data = strcat(\"'\", value,\"','\",label,\"','\",group,\"'\")", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "8b11feda-c3d4-4fb6-93d4-92321ccabd9d", + "version": "KqlParameterItem/1.0", + "name": "formattedCustomDimensions", + "type": 1, + "isRequired": true, + "value": "[]", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (getCustomDimensions is empty ), result = '[]'", + "criteriaContext": { + "leftOperand": "getCustomDimensions", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "[]" + } + }, + { + "condition": "if (getCustomDimensions starts with '['), result = getCustomDimensions", + "criteriaContext": { + "leftOperand": "getCustomDimensions", + "operator": "startsWith", + "rightValType": "static", + "rightVal": "[", + "resultValType": "param", + "resultVal": "getCustomDimensions" + } + }, + { + "condition": "else result = '[{getCustomDimensions}]'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "[{getCustomDimensions}]" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "8cd9003c-8e76-4d21-8b22-b7a11197f42f", + "version": "KqlParameterItem/1.0", + "name": "ByValue", + "label": "By value x-axis", + "type": 2, + "description": "Choose a time grain or property to create x-axis for users.", + "isRequired": true, + "query": "let grainList = datatable(value:string, label:string, seconds:string, group: string, selected: string)[\r\n'3m', '3 minutes', '3600', 'Time Range', 'true',\r\n\t'1h', '1 hour', '86400', 'Time Range', 'true',\r\n\t'2h', '2 hours', '172800', 'Time Range', 'true',\r\n\t'3h', '3 hours', '259200', 'Time Range', 'true',\r\n\t'1d', '1 day', '604800', 'Time Range', 'true',\r\n\t'12h', '12 hours', '604800', 'Time Range', '',\r\n\t'1d', '1 day', '1209600', 'Time Range', 'true',\r\n\t'1d', '1 day', '2592000', 'Time Range', 'true',\r\n\t'7d', '7 days', '2592000', 'Time Range', '',\r\n\t'1d', '1 day', '5184000', 'Time Range', 'true',\r\n\t'7d', '7 days', '5184000', 'Time Range', '',\r\n\t'1d', '1 day', '7776000', 'Time Range', 'true',\r\n\t'7d', '7 days', '7776000', 'Time Range', ''\r\n\t];\r\n let timeTable = grainList\r\n | where seconds == '{TimeRange:seconds}'\r\n | project value, label, group, selected;\r\nlet customDimension = datatable(value:string, label:string, group: string){formattedCustomDimensions};let dimensionList = datatable(value:string, label:string, group: string) {usageStandardDimension};\r\ntimeTable\r\n | union //showCohort,\r\n dimensionList, customDimension\r\n | project value, label, group, selected", + "value": "1h", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "cf1d4683-4853-4302-9c6e-4ea1925dfc5f", + "version": "KqlParameterItem/1.0", + "name": "isByCohort", + "type": 1, + "description": "Is x-axis created by cohort or not?", + "query": "let query = '{ByValue}';\r\nprint parse_json(query).isCohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "033f9e3f-5198-4709-94d7-254b824c9669", + "version": "KqlParameterItem/1.0", + "name": "isTimeRange", + "type": 1, + "description": "Is x-axis created by time bins or not?", + "isRequired": true, + "value": "true", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (isByCohort == 'true'), result = 'false'", + "criteriaContext": { + "leftOperand": "isByCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "true", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "if (ByValue regex '[1,2,3,7,12][m|h|d]'), result = 'true'", + "criteriaContext": { + "leftOperand": "ByValue", + "operator": "regex", + "rightValType": "static", + "rightVal": "[1,2,3,7,12][m|h|d]", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "condition": "else result = 'false'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "47faf500-a03f-4600-bb6d-973d248fe874", + "version": "KqlParameterItem/1.0", + "name": "UsageSplitBy", + "label": "Split by", + "type": 2, + "description": "Choose a property lets you segment by users.", + "isRequired": true, + "query": "let customDimension = datatable(value:string, label:string, group: string){formattedCustomDimensions}; \r\nlet PropertyList = union (datatable(value:string, label:string, group: string){usageStandardDimension}), customDimension\r\n | extend timerange= '{TimeRange}'\r\n | where '{isTimeRange}' == 'true'\r\n | project value, label, group, selected ='';\r\ndatatable(value:string, label:string, group: string, selected: string)[\r\n\t'', 'unset', '', 'true'] \r\n | union //showCohort,\r\n PropertyList", + "value": "", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "0e1ef09f-7cb3-4e34-9635-a146699330a6", + "version": "KqlParameterItem/1.0", + "name": "isGreaterOrEqual30days", + "type": 1, + "description": "Is TimeRage greater than or equal to 30 days?", + "isRequired": true, + "query": "print case({TimeRange:seconds} >= 2592000, \"true\", \"false\")", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "d9f3a9e9-dbc8-43bd-8f91-46cafa82250e", + "version": "KqlParameterItem/1.0", + "name": "IsSplitCohort", + "type": 1, + "description": "Check if SplitBy selection is a cohrt", + "query": "let query = '{UsageSplitBy}';\r\nprint parse_json(query).isCohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "6aa9fe7f-8c73-4871-8b9f-c15014832721", + "version": "KqlParameterItem/1.0", + "name": "barChartMode", + "type": 1, + "description": "Get bar Chart mode", + "isRequired": true, + "query": "print iff('{UsageSplitBy}' == '' and '{isTimeRange}' == 'true', 'TimeBar', iff('{UsageSplitBy}' == '' and '{isTimeRange}' == 'false', 'ByValueBar', 'SplitBar'))", + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - mainSelections" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5632ed58-6194-40d9-a714-73c23cdba54d", + "version": "KqlParameterItem/1.0", + "name": "customFilters", + "label": "Filters", + "type": 1, + "description": "Add filters. Example: | where client_City == \"Seattle\" | where client_OS contains \"Windows\" ", + "typeSettings": { + "multiLineText": true, + "editorLanguage": "kql" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "e33eefc9-12e4-46ba-8a2b-5df923480f9d", + "version": "KqlParameterItem/1.0", + "name": "filters", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = customFilters", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "customFilters" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 8" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "bc878678-8cbc-4c1c-b6be-0c2fd8604fb8", + "version": "KqlParameterItem/1.0", + "name": "cohortUsersQuery", + "type": 1, + "description": "Extract query in cohort json from UsersList dropdown ", + "query": "let query = '{UsersList}';\r\nprint parse_json(query).cohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "705011ae-3a87-4f26-885d-d4d9545b29f4", + "version": "KqlParameterItem/1.0", + "name": "isBelongCohort", + "type": 1, + "description": "Extract IsBelong property in cohort json from UsersList dropdown ", + "query": "let query = '{UsersList}';\r\nprint parse_json(query).isBelong", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "04a50de6-f91a-4087-b1cd-0bbf772f655d", + "version": "KqlParameterItem/1.0", + "name": "usersType", + "type": 1, + "description": "Check user type. It should be user_id if not user_Authenticated_Id", + "isRequired": true, + "value": "user_Id", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (UsersList == 'user_AuthenticatedId'), result = 'user_AuthenticatedId'", + "criteriaContext": { + "leftOperand": "UsersList", + "operator": "==", + "rightValType": "static", + "rightVal": "user_AuthenticatedId", + "resultValType": "static", + "resultVal": "user_AuthenticatedId" + } + }, + { + "condition": "else result = 'user_Id'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "user_Id" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "244f4eff-e526-4619-a1be-e11346446ff9", + "version": "KqlParameterItem/1.0", + "name": "labelOfHeadTile", + "type": 1, + "description": "Label in head tile", + "isRequired": true, + "value": "users", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (usersType == 'user_AuthenticatedId'), result = 'authenticated users'", + "criteriaContext": { + "leftOperand": "usersType", + "operator": "==", + "rightValType": "static", + "rightVal": "user_AuthenticatedId", + "resultValType": "static", + "resultVal": "authenticated users" + } + }, + { + "condition": "else result = 'users'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "users" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "706e8b54-1ac7-4243-ab36-f9d67343e025", + "version": "KqlParameterItem/1.0", + "name": "mainTableQuery", + "type": 1, + "description": "mainTable Query", + "isRequired": true, + "value": "mainTable", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (isBelongCohort == 'true'), result = '(){{cohortUsersQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | join kind=inner (mainTable | extend hashedUserId = hash(user_Id)) on hashedUserId}'", + "criteriaContext": { + "leftOperand": "isBelongCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "true", + "resultValType": "static", + "resultVal": "(){{cohortUsersQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | join kind=inner (mainTable | extend hashedUserId = hash(user_Id)) on hashedUserId}" + } + }, + { + "condition": "if (isBelongCohort == 'false'), result = '(){{cohortUsersQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | join kind=rightanti (mainTable | extend hashedUserId = hash(user_Id)) on hashedUserId}'", + "criteriaContext": { + "leftOperand": "isBelongCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "false", + "resultValType": "static", + "resultVal": "(){{cohortUsersQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | join kind=rightanti (mainTable | extend hashedUserId = hash(user_Id)) on hashedUserId}" + } + }, + { + "condition": "else result = 'mainTable'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "mainTable" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "77ab1a31-79d2-4431-b131-59b8631d1fdd", + "version": "KqlParameterItem/1.0", + "name": "byCohortQuery", + "type": 1, + "description": "Extract query in cohort json from ByValue dropdown", + "query": "let query = '{ByValue}';\r\nprint parse_json(query).cohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "9aa04628-19d5-43b7-9190-e10d3d067c08", + "version": "KqlParameterItem/1.0", + "name": "byTableQuery", + "type": 1, + "description": "By query segement ", + "value": "() {byTable | extend dimension = 1h | extend dimension = iif(isempty(dimension), \"\", dimension)}", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (isByCohort == 'true'), result = '() {{byCohortQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | extend byColumn = \"Cohort Users\" | join kind=rightouter (byTable | extend hashedUserId = hash(user_Id)) on hashedUserId | extend dimension = byColumn | extend dimension = iif(isempty(dimension), \"Others\", \"Cohort\")}'", + "criteriaContext": { + "leftOperand": "isByCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "true", + "resultValType": "static", + "resultVal": "() {{byCohortQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | extend byColumn = \"Cohort Users\" | join kind=rightouter (byTable | extend hashedUserId = hash(user_Id)) on hashedUserId | extend dimension = byColumn | extend dimension = iif(isempty(dimension), \"Others\", \"Cohort\")}" + } + }, + { + "condition": "else result = '() {byTable | extend dimension = {ByValue} | extend dimension = iif(isempty(dimension), \"\", dimension)}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "() {byTable | extend dimension = {ByValue} | extend dimension = iif(isempty(dimension), \"\", dimension)}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "463cf64c-ceec-4831-b4a1-d72953670eee", + "version": "KqlParameterItem/1.0", + "name": "splitbyLabel", + "type": 1, + "value": "unset", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{UsageSplitBy:label}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{UsageSplitBy:label}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "9645e737-0b9c-437f-94d7-cf27c2151639", + "version": "KqlParameterItem/1.0", + "name": "splitCohortQuery", + "type": 1, + "description": "Extract query in cohort json from SplitBy dropdown", + "query": "let query = '{UsageSplitBy}';\r\nprint parse_json(query).cohort", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "d4a9bee5-e949-4c51-82f6-f074b03c5dae", + "version": "KqlParameterItem/1.0", + "name": "splitTableQuery", + "type": 1, + "description": "Split query segement", + "value": "() {queryTable | extend dimension = | extend dimension = iif(isempty(dimension), \"\", dimension)}", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (IsSplitCohort == 'true'), result = '() {{splitCohortQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | extend splitColumn = \"Cohort Users\" | join kind=rightouter (queryTable | extend hashedUserId = hash(user_Id)) on hashedUserId | extend dimension = splitColumn | extend dimension = iif(isempty(dimension), \"Others\", \"{splitbyLabel:escape} \")}'", + "criteriaContext": { + "leftOperand": "IsSplitCohort", + "operator": "==", + "rightValType": "static", + "rightVal": "true", + "resultValType": "static", + "resultVal": "() {{splitCohortQuery} | extend hashedUserId = hash(user_Id) | distinct hashedUserId | extend splitColumn = \"Cohort Users\" | join kind=rightouter (queryTable | extend hashedUserId = hash(user_Id)) on hashedUserId | extend dimension = splitColumn | extend dimension = iif(isempty(dimension), \"Others\", \"{splitbyLabel:escape} \")}" + } + }, + { + "condition": "else result = '() {queryTable | extend dimension = {UsageSplitBy} | extend dimension = iif(isempty(dimension), \"\", dimension)}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "() {queryTable | extend dimension = {UsageSplitBy} | extend dimension = iif(isempty(dimension), \"\", dimension)}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "f949bcae-483d-4356-a3c4-3e43652ffbf8", + "version": "KqlParameterItem/1.0", + "name": "cohortEventsQuery", + "type": 1, + "description": "Extract cohort queries from UserEvent dropdown", + "query": "let table = print {UserEvent}\r\n| evaluate narrow()\r\n| where Value startswith\"{\\\"cohort\\\":\"\r\n| project name = \"cohorts\", Cohorts = strcat(\"(\",parse_json(Value).cohort, \" | summarize makeset(name)\");\r\ntable\r\n| summarize cohorts = make_list(Cohorts) by tostring(name)\r\n| project cohorts= replace(@'\\[', @'union \\1', tostring(cohorts))\r\n| project cohorts= replace(@'name\\)\"', @'name)) \\1', cohorts)\r\n| project cohorts= replace(@'\"', @'\\1', cohorts)\r\n| project cohorts= replace(@'\\]', @'\\1', cohorts)\r\n", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "f04476f6-28f6-4d71-b39f-950a6c37c747", + "version": "KqlParameterItem/1.0", + "name": "userEventsQuery", + "type": 1, + "description": "Extract event queries from UserEvent dropdown", + "query": "print {UserEvent}\r\n| evaluate narrow()\r\n| where Value !startswith\"{\\\"cohort\\\":\"\r\n| summarize events = make_list(Value) by tostring(Row)\r\n| project events= replace(@'\\[', @'\\1', tostring(events))\r\n| project events= replace(@'\\]', @'\\1', events) | project events= replace(@\"'\", @\"\\\\'\\1\", events)", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "8738ce5d-ad4e-46f0-8b54-98dd29b3bd7c", + "version": "KqlParameterItem/1.0", + "name": "getCohortEventsQuery", + "type": 1, + "description": "Merge cohort queries ", + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (UserEvent == ''*''), result = 'print '''", + "criteriaContext": { + "leftOperand": "UserEvent", + "operator": "==", + "rightValType": "static", + "rightVal": "'*'", + "resultValType": "static", + "resultVal": "print ''" + } + }, + { + "condition": "if (cohortEventsQuery is empty ), result = '{cohortEventsQuery}'", + "criteriaContext": { + "leftOperand": "cohortEventsQuery", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{cohortEventsQuery}" + } + }, + { + "condition": "else result = ' {cohortEventsQuery} | project cohortEvents= replace(@'\\[', @'\\1', tostring(set_name)) | project cohortEvents= replace(@'\\]', @'\\1', cohortEvents)'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": " {cohortEventsQuery} | project cohortEvents= replace(@'\\[', @'\\1', tostring(set_name)) | project cohortEvents= replace(@'\\]', @'\\1', cohortEvents)" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "40bc31ca-6b81-4352-909f-c89f99709f0d", + "version": "KqlParameterItem/1.0", + "name": "processCohortEvents1", + "type": 1, + "description": "Get cohort query results", + "query": "{getCohortEventsQuery}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "c2550954-dd71-4f65-ae6e-e5e0b08db15e", + "version": "KqlParameterItem/1.0", + "name": "processCohortEvents2", + "type": 1, + "description": "Merge cohort query results", + "query": "print cohorts= '{processCohortEvents1}' \r\n| project cohorts= replace(@'\\[', @'\\1', tostring(cohorts))\r\n| project cohorts= replace(@'\\]', @'\\1', cohorts)\r\n", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5f624496-5eaf-4c14-a16f-6dbb85128e63", + "version": "KqlParameterItem/1.0", + "name": "userEventsList", + "type": 1, + "description": "Merge cohort and user Events", + "isRequired": true, + "query": "let userEvents = '{userEventsQuery}';\r\nlet cohortEvents = '{processCohortEvents2}';\r\nlet userEventsString = iff(strlen(userEvents)>0 and strlen(cohortEvents)>0, strcat(userEvents, ','), userEvents);\r\nprint strcat(userEventsString, cohortEvents)", + "value": "\"*\"", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "7c3949b0-f3f7-40ce-a51d-e3ca186ce57f", + "version": "KqlParameterItem/1.0", + "name": "barChartQuery", + "type": 1, + "isRequired": true, + "value": "let grain = 1h; let mainTable = union pageViews,customEvents | where timestamp > ago(1d) | where iif('*' in (\"*\"), 1==1, name in (\"*\")); let resultTable = mainTable; resultTable | summarize Users = dcount(user_Id) by bin(timestamp, grain) | order by timestamp asc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (barChartMode == 'TimeBar'), result = 'let grain = iff({isTimeRange}, {ByValue}, 1h); let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let resultTable = {mainTableQuery}; resultTable | summarize Users = dcount({usersType}) by bin(timestamp, grain) | order by timestamp asc'", + "criteriaContext": { + "leftOperand": "barChartMode", + "operator": "==", + "rightValType": "static", + "rightVal": "TimeBar", + "resultValType": "static", + "resultVal": "let grain = iff({isTimeRange}, {ByValue}, 1h); let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let resultTable = {mainTableQuery}; resultTable | summarize Users = dcount({usersType}) by bin(timestamp, grain) | order by timestamp asc" + } + }, + { + "condition": "if (barChartMode == 'ByValueBar'), result = 'let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let byTable = {mainTableQuery}; let queryTable = {byTableQuery}; let byCohortTable = queryTable | project dimension, user_Id, session_Id, timestamp, user_AuthenticatedId; let topSegments = byCohortTable | summarize dcount_user_Id = dcount(user_Id) by dimension | top 10 by dcount_user_Id | summarize makelist(dimension); let topEventMetrics = byCohortTable | where dimension in (topSegments); let otherEventUsers = byCohortTable | where dimension !in (topSegments) | extend dimension = \"Other\"; otherEventUsers | union topEventMetrics | summarize Users = dcount({usersType}) by dimension | order by dimension asc'", + "criteriaContext": { + "leftOperand": "barChartMode", + "operator": "==", + "rightValType": "static", + "rightVal": "ByValueBar", + "resultValType": "static", + "resultVal": "let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let byTable = {mainTableQuery}; let queryTable = {byTableQuery}; let byCohortTable = queryTable | project dimension, user_Id, session_Id, timestamp, user_AuthenticatedId; let topSegments = byCohortTable | summarize dcount_user_Id = dcount(user_Id) by dimension | top 10 by dcount_user_Id | summarize makelist(dimension); let topEventMetrics = byCohortTable | where dimension in (topSegments); let otherEventUsers = byCohortTable | where dimension !in (topSegments) | extend dimension = \"Other\"; otherEventUsers | union topEventMetrics | summarize Users = dcount({usersType}) by dimension | order by dimension asc" + } + }, + { + "condition": "else result = 'let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let queryTable = {mainTableQuery}; let splitTable = {splitTableQuery}; let cohortedTable = splitTable | extend byDimension = bin(timestamp, {ByValue}) | summarize metricHll = hll({usersType}) by byDimension, dimension; let topSegments = cohortedTable | summarize mergedMetricHll = hll_merge(metricHll) by dimension | project dimension, dcount_user_Id = dcount_hll(mergedMetricHll) | top 5 by dcount_user_Id desc nulls last | summarize makelist(dimension); cohortedTable | extend dimension = iff(dimension in (topSegments), dimension, \"Other\") | project byDimension, dimension, metricHll | fork(summarize metric = hll_merge(metricHll) by dimension,byDimension | project byDimension, dimension, metric = dcount_hll(metric)) (summarize metric = hll_merge(metricHll) by dimension | project dimension, metric = dcount_hll(metric)) (summarize metric = hll_merge(metricHll) | project metric = dcount_hll(metric))'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let mainTable = union {Whoused} | where timestamp {TimeRange} | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList})) {filters}; let queryTable = {mainTableQuery}; let splitTable = {splitTableQuery}; let cohortedTable = splitTable | extend byDimension = bin(timestamp, {ByValue}) | summarize metricHll = hll({usersType}) by byDimension, dimension; let topSegments = cohortedTable | summarize mergedMetricHll = hll_merge(metricHll) by dimension | project dimension, dcount_user_Id = dcount_hll(mergedMetricHll) | top 5 by dcount_user_Id desc nulls last | summarize makelist(dimension); cohortedTable | extend dimension = iff(dimension in (topSegments), dimension, \"Other\") | project byDimension, dimension, metricHll | fork(summarize metric = hll_merge(metricHll) by dimension,byDimension | project byDimension, dimension, metric = dcount_hll(metric)) (summarize metric = hll_merge(metricHll) by dimension | project dimension, metric = dcount_hll(metric)) (summarize metric = hll_merge(metricHll) | project metric = dcount_hll(metric))" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - querySegments" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\nlet resultTable = {mainTableQuery};\r\nresultTable\r\n| summarize Users = dcount({usersType})\r\n| evaluate narrow()\r\n| project Column, Value = toreal(Value)\r\n| project Column = '{labelOfHeadTile}', Value", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "formatter": 1, + "formatOptions": {} + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + }, + "rightContent": { + "columnMatch": "Column", + "formatter": 8, + "formatOptions": {} + }, + "showBorder": false, + "size": "full" + } + }, + "customWidth": "90", + "name": "query - headTile", + "styleSettings": { + "maxWidth": "calc(100% - 180px)" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "b769f9e7-0fbf-44cf-bc09-ad82f941c961", + "version": "KqlParameterItem/1.0", + "name": "ChartType", + "label": "Chart Type", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[{ \"value\": \"barChart\", \"label\": \"Bar chart\", \"selected\":true }, { \"value\": \"lineChart\", \"label\": \"Line chart\"}, { \"value\": \"areaChart\", \"label\": \"Area chart\"}]\r\n", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "d2fb9d29-b3dd-4feb-affa-fb90208632fa", + "version": "KqlParameterItem/1.0", + "name": "chartTypeValue", + "type": 1, + "isRequired": true, + "value": "barChart", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (isTimeRange == 'false'), result = 'barChart'", + "criteriaContext": { + "leftOperand": "isTimeRange", + "operator": "==", + "rightValType": "static", + "rightVal": "false", + "resultValType": "static", + "resultVal": "barChart" + } + }, + { + "condition": "else result = ChartType", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "ChartType" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "formVertical", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "isTimeRange", + "comparison": "isEqualTo", + "value": "true" + }, + "customWidth": "20", + "name": "parameters - chartType", + "styleSettings": { + "maxWidth": "180px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{barChartQuery}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "barchart" + }, + "conditionalVisibility": { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "barChart" + }, + "showPin": true, + "name": "query - barChart", + "styleSettings": { + "progressStyle": "squares" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{barChartQuery}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "linechart" + }, + "conditionalVisibilities": [ + { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "lineChart" + }, + { + "parameterName": "isTimeRange", + "comparison": "isEqualTo", + "value": "true" + } + ], + "conditionalVisibility": { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "lineChart" + }, + "showPin": true, + "name": "query - lineChart", + "styleSettings": { + "progressStyle": "squares" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{barChartQuery}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "areachart" + }, + "conditionalVisibilities": [ + { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "areaChart" + }, + { + "parameterName": "isTimeRange", + "comparison": "isEqualTo", + "value": "true" + } + ], + "conditionalVisibility": { + "parameterName": "chartTypeValue", + "comparison": "isEqualTo", + "value": "areaChart" + }, + "showPin": true, + "name": "query - areaChart", + "styleSettings": { + "progressStyle": "squares" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "loadType": "explicit", + "loadButtonText": "View More Insights", + "items": [ + { + "type": 1, + "content": { + "json": "#### {TimeRange}" + }, + "name": "text - timeRange1" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "showPerformanceConfig", + "linkTarget": "parameter", + "linkLabel": "⚙️", + "subTarget": "1", + "preText": "Performance Configuration", + "style": "link" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Whoused", + "comparison": "isNotEqualTo", + "value": "customEvents" + }, + "conditionalVisibilities": [ + { + "parameterName": "Whoused", + "comparison": "isNotEqualTo", + "value": "customEvents" + }, + { + "parameterName": "showPerformanceConfig", + "comparison": "isEqualTo" + } + ], + "name": "links - performanceConfig" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "eb80af48-58d4-4272-be44-46b79c7d541b", + "version": "KqlParameterItem/1.0", + "name": "performanceTable", + "type": 1, + "isRequired": true, + "value": "pageViews", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Whoused == 'requests,pageViews'), result = 'requests,pageViews'", + "criteriaContext": { + "leftOperand": "Whoused", + "operator": "==", + "rightValType": "static", + "rightVal": "requests,pageViews", + "resultValType": "static", + "resultVal": "requests,pageViews" + } + }, + { + "condition": "if (Whoused == 'pageViews,customEvents,requests'), result = 'requests,pageViews'", + "criteriaContext": { + "leftOperand": "Whoused", + "operator": "==", + "rightValType": "static", + "rightVal": "pageViews,customEvents,requests", + "resultValType": "static", + "resultVal": "requests,pageViews" + } + }, + { + "condition": "if (Whoused contains 'requests'), result = 'requests'", + "criteriaContext": { + "leftOperand": "Whoused", + "operator": "contains", + "rightValType": "static", + "rightVal": "requests", + "resultValType": "static", + "resultVal": "requests" + } + }, + { + "condition": "else result = 'pageViews'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "pageViews" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "113dfb8f-1257-432c-aa74-84a3da0881d7", + "version": "KqlParameterItem/1.0", + "name": "queryAvgPerformance", + "type": 1, + "query": "{performanceTable}\r\n | where timestamp >= ago(14d)\r\n | summarize SumOfDuration = sum(duration), CountOfDuration = count()\r\n | project AverageDuration = round(iff(CountOfDuration == 0, 0.0, 1.0 * SumOfDuration / CountOfDuration))", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "4ee0697d-ade0-43a8-89b9-93889c478326", + "version": "KqlParameterItem/1.0", + "name": "durationThreshold", + "label": "Change apdex threshold", + "type": 1, + "description": "Apdex score is directly related to user's perception of responsiveness. By selecting a suitable million seconds threshold, you are defining the page view and request duration for which users are not impeded by application response time.", + "isRequired": true, + "value": "0", + "criteriaData": [ + { + "condition": "if (queryAvgPerformance is empty ), result = '0'", + "criteriaContext": { + "leftOperand": "queryAvgPerformance", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "0" + } + }, + { + "condition": "else result = '{queryAvgPerformance}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{queryAvgPerformance}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "Whoused", + "comparison": "isNotEqualTo", + "value": "customEvents" + }, + "conditionalVisibilities": [ + { + "parameterName": "Whoused", + "comparison": "isNotEqualTo", + "value": "customEvents" + }, + { + "parameterName": "showPerformanceConfig", + "comparison": "isEqualTo", + "value": "1" + } + ], + "name": "parameters - durationThreshold" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let threshold = {durationThreshold}; // Apdex threshold in milliseconds\r\nlet mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\nlet resultTable = {mainTableQuery};\r\nlet performanceResult = union {performanceTable}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters}\r\n | where isnotnull(duration)\r\n | summarize AverageDuration = avg(duration) by user_Id\r\n | extend UserExperience = case(AverageDuration <= threshold, 'S', AverageDuration <= 4 * threshold, 'T', 'F')\r\n | summarize Satisfied = countif(UserExperience == 'S'), Tolerating = countif(UserExperience == 'T'), Frustrated = countif(UserExperience == 'F'), Total = count()\r\n | extend ApdexScore = (Satisfied + (Tolerating / 2.0)) / Total\r\n | extend PERFORMANCE = case(\r\n ApdexScore <= 0.5, \"Unacceptable\",\r\n ApdexScore <= 0.7, \"Poor\",\r\n ApdexScore <= 0.85, \"Fair\",\r\n ApdexScore <= 0.94, \"Good\",\r\n \"Excellent\")\r\n | project PERFORMANCE, id =1;\r\nresultTable \r\n | summarize SESSIONS = dcount(session_Id), EVENTS = count(), id= 1\r\n | join performanceResult on id\r\n | project SESSIONS, EVENTS, PERFORMANCE\r\n | evaluate narrow()\r\n | project Column, Value, id = case(Column =='SESSIONS', 'community-Workbooks/UsageMetrics/Usage - Sessions', Column =='EVENTS', 'community-Workbooks/UsageMetrics/Usage - Events','Community-Workbooks/Performance/Apdex'), UsageViewType = case(Column =='SESSIONS', 'Sessions', Column =='EVENTS', 'Events','Duration'), Title = case(Column =='SESSIONS', 'Sessions', Column =='EVENTS', 'Events','Apdex')\r\n | where '{Whoused}' != \"customEvents\" or Column != \"PERFORMANCE\"", + "size": 3, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Column", + "formatter": 1, + "formatOptions": { + "linkTarget": "OpenBlade", + "workbookContext": null, + "bladeOpenContext": { + "bladeName": "UsageWorkbookViewerBlade", + "extensionName": "AppInsightsExtension", + "bladeParameters": [ + { + "name": "ComponentId", + "source": "parameter", + "value": "componentId" + }, + { + "name": "ConfigurationId", + "source": "column", + "value": "id" + }, + { + "name": "UsageViewType", + "source": "column", + "value": "UsageViewType" + }, + { + "name": "WorkbookTemplateName", + "source": "column", + "value": "Title" + } + ] + } + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Note", + "formatter": 1, + "formatOptions": {}, + "tooltipFormat": { + "tooltip": "ApdexScore <= 0.5, \"Unacceptable\", ApdexScore <= 0.7, \"Poor\", ApdexScore <= 0.85, \"Fair\", ApdexScore <= 0.94, \"Good\"," + } + }, + "showBorder": true, + "size": "auto" + } + }, + "name": "query - tiles1" + }, + { + "type": 1, + "content": { + "json": "#### Last month\r\n" + }, + "conditionalVisibility": { + "parameterName": "isGreaterOrEqual30days", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - timeRange2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": " let now = now();\r\n let previousMonthTimestamp = now - 56d;\r\n let monthTimestamp = now - 28d;\r\n let mainTable = union pageViews,customEvents\r\n | where timestamp >= previousMonthTimestamp\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\nlet queryTable = {mainTableQuery}; \r\nlet cohortedTable = queryTable\r\n | extend timestamp = timestamp - 420m;\r\nlet thisMonth = toscalar(cohortedTable\r\n | where timestamp >= monthTimestamp\r\n | summarize hll = hll({usersType}));\r\nlet lastMonth = toscalar(cohortedTable\r\n | where timestamp < monthTimestamp and timestamp >= previousMonthTimestamp\r\n | summarize hll = hll({usersType}));\r\nrange i from 1 to 1 step 1\r\n | extend ThisMonth = thisMonth, LastMonth = lastMonth\r\n | evaluate dcount_intersect(LastMonth, ThisMonth)\r\n | project Mau = dcount_hll(ThisMonth), MauLastMonth = s0, ReturningUsers = s1\r\n | extend NewUsers = Mau - ReturningUsers, LostUsers = MauLastMonth - ReturningUsers, GrowthRate = round(100.0 * (Mau - MauLastMonth) / MauLastMonth), RetentionRate = round(100.0 * ReturningUsers / MauLastMonth)\r\n | project MAU = Mau, RETENTION = iff(MauLastMonth ==0, '--', strcat(tolong(RetentionRate),'%')), GROWTH = iff(MauLastMonth ==0, '--', strcat(tolong(GrowthRate),'%'))\r\n | evaluate narrow()\r\n | project Column, Value, id = case(Column =='MAU', 'Community-Workbooks/Usage/Active Users', Column =='RETENTION', 'Community-Workbooks/Retention/Retention - N Period','Community-Workbooks/Usage/New, Returning and Churned Users')\r\n | where Value != '--'\r\n\r\n \r\n", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Column", + "formatter": 1, + "formatOptions": { + "linkColumn": "id", + "linkTarget": "WorkbookTemplate", + "showIcon": true, + "workbookContext": null + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + }, + "showBorder": true + } + }, + "conditionalVisibility": { + "parameterName": "isGreaterOrEqual30days", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - tiles2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "732d8494-7a52-426a-a963-27977fe443d0", + "version": "KqlParameterItem/1.0", + "name": "Properties", + "label": "PROPERTIES", + "type": 2, + "description": "Please select a maximum of 6 items.", + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let customDimension = datatable(value:string, label:string, group: string){formattedCustomDimensions};\r\nlet dimensionList = datatable(value:string, label:string, group: string){usageStandardDimension}\r\n | order by label asc;\r\nunion dimensionList, customDimension\r\n | extend value= replace(@'\\\"', @'/:/\\1', tostring(value))\r\n | project value = strcat('{\"value\": \"',value,'\",',' \"label\": \"',label,'\"}'), label, group", + "typeSettings": { + "limitSelectTo": 6, + "additionalResourceOptions": [ + "value::3" + ], + "showDefault": false + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components", + "value": [ + "{\"value\": \"client_CountryOrRegion\", \"label\": \"Country or region\"}", + "{\"value\": \"client_OS\", \"label\": \"Operating system\"}", + "{\"value\": \"client_Browser\", \"label\": \"Browser version\"}" + ] + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 15" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "276061c1-8556-47e1-9fe8-49e1b5f30427", + "version": "KqlParameterItem/1.0", + "name": "columnNameQuery", + "type": 1, + "value": "print '{\"value\": \"client_CountryOrRegion\", \"label\": \"Country or region\"}','{\"value\": \"client_OS\", \"label\": \"Operating system\"}','{\"value\": \"client_Browser\", \"label\": \"Browser version\"}' | evaluate narrow() | project name = parse_json(Value).value | summarize name = tostring(make_list(name)) | project name= substring(name, 1, strlen(name)-2) | project name= replace(@'\\\"', @'\\1', name) | project name= replace(@'/:/', @'\"', tostring(name))", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Properties is empty ), result = 'print '''", + "criteriaContext": { + "leftOperand": "Properties", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "print ''" + } + }, + { + "condition": "else result = 'print {Properties} | evaluate narrow() | project name = parse_json(Value).value | summarize name = tostring(make_list(name)) | project name= substring(name, 1, strlen(name)-2) | project name= replace(@'\\\"', @'\\1', name) | project name= replace(@'/:/', @'\"', tostring(name))'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "print {Properties} | evaluate narrow() | project name = parse_json(Value).value | summarize name = tostring(make_list(name)) | project name= substring(name, 1, strlen(name)-2) | project name= replace(@'\\\"', @'\\1', name) | project name= replace(@'/:/', @'\"', tostring(name))" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "412bb2fa-3a6a-4301-817f-c814a962be9b", + "version": "KqlParameterItem/1.0", + "name": "columnLabelQuery", + "type": 1, + "value": "print '{\"value\": \"client_CountryOrRegion\", \"label\": \"Country or region\"}','{\"value\": \"client_OS\", \"label\": \"Operating system\"}','{\"value\": \"client_Browser\", \"label\": \"Browser version\"}' | evaluate narrow() | project label = parse_json(Value).label, Row | summarize label = make_list(label) by tostring(Row) | project label= replace(@'\\[', @'\\1', tostring(label)) | project label= replace(@'\\]', @'\\1', label) | project label= replace(@'\\\"', @'\\1', label)", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Properties is empty ), result = 'print '''", + "criteriaContext": { + "leftOperand": "Properties", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "print ''" + } + }, + { + "condition": "else result = 'print {Properties} | evaluate narrow() | project label = parse_json(Value).label, Row | summarize label = make_list(label) by tostring(Row) | project label= replace(@'\\[', @'\\1', tostring(label)) | project label= replace(@'\\]', @'\\1', label) | project label= replace(@'\\\"', @'\\1', label)'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "print {Properties} | evaluate narrow() | project label = parse_json(Value).label, Row | summarize label = make_list(label) by tostring(Row) | project label= replace(@'\\[', @'\\1', tostring(label)) | project label= replace(@'\\]', @'\\1', label) | project label= replace(@'\\\"', @'\\1', label)" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "bce9a188-8ca9-4dbd-8932-e8bd8de1275c", + "version": "KqlParameterItem/1.0", + "name": "selectedProperties", + "type": 1, + "query": "{columnNameQuery}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "33aa8135-eecc-43d0-ab23-53c73d1e817d", + "version": "KqlParameterItem/1.0", + "name": "labelOfSelectedProperties", + "type": 1, + "query": "{columnLabelQuery}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "737850dd-0480-45d4-81b6-23922fb596d6", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn1", + "type": 1, + "description": "Column name for first property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[0];\r\nprint iff(isempty(value), '', value)", + "value": "client_CountryOrRegion", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "da94f8c8-21d9-4626-94ab-4676e1fb1561", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn2", + "type": 1, + "description": "Column name for second property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[1];\r\nprint iff(isempty(value), '', value)", + "value": "client_OS", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "2769f12c-16c9-43b2-8262-5bcf88fbc309", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn3", + "type": 1, + "description": "Column name for third property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[2];\r\nprint iff(isempty(value), '', value)", + "value": "client_Browser", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "30cc6cfa-dd0e-482d-8124-e752ac406141", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn4", + "type": 1, + "description": "Column name for four property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[3];\r\nprint iff(isempty(value), '', value)", + "value": "", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "900a04cf-59bd-48f0-ba3e-82b1e8688907", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn5", + "type": 1, + "description": "Column name for fifth property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[4];\r\nprint iff(isempty(value), '', value)", + "value": "", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "391fb4a3-340b-4a78-a311-b400cb967115", + "version": "KqlParameterItem/1.0", + "name": "propertyColumn6", + "type": 1, + "description": "Column name for sixth property grid", + "isRequired": true, + "query": "let value = split('{selectedProperties}', ',')[5];\r\nprint iff(isempty(value), '', value)", + "value": "", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "407dabfe-31be-4cc4-84ae-8f1db8fa18a5", + "version": "KqlParameterItem/1.0", + "name": "column1Name", + "type": 1, + "description": "Column name for first property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[0]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "b1a720e5-688e-4141-a82f-6c813cb9baeb", + "version": "KqlParameterItem/1.0", + "name": "column2Name", + "type": 1, + "description": " Column name for second property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[1]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "a0b639b2-e49f-4953-8fa3-16e7381792b7", + "version": "KqlParameterItem/1.0", + "name": "column3Name", + "type": 1, + "description": "Column name for third property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[2]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "7c5ea397-c2bd-446d-8799-2f5377962cca", + "version": "KqlParameterItem/1.0", + "name": "column4Name", + "type": 1, + "description": "Column name for fourth property grid", + "query": "print split('{labelOfSelectedProperties}', ',')[3]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "9e8c075d-090b-4d36-898a-01e4ec91560f", + "version": "KqlParameterItem/1.0", + "name": "column5Name", + "type": 1, + "description": "Column name for fifth property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[4]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + { + "id": "15c86faa-dab0-4d51-aec8-e867b2f90bc6", + "version": "KqlParameterItem/1.0", + "name": "column6Name", + "type": 1, + "description": "Column name for sixth property grid", + "query": "print split(\"{labelOfSelectedProperties}\", \",\")[5]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 11" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\nlet queryTable = {mainTableQuery};\r\nlet cohortedTable = queryTable\r\n | extend dimension = {propertyColumn1}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll({usersType}) by tostring(dimension)\r\n | extend Users = dcount_hll(hll)\r\n | order by Users desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column1Name}'] = dimension, Counts = dcount_hll(merged);\r\ncohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn1", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\nlet queryTable = {mainTableQuery};\r\nlet cohortedTable = queryTable\r\n | extend dimension = {propertyColumn2}\r\n | extend dimension = iif(isempty(dimension) , \"\", dimension)\r\n | summarize hll = hll({usersType}) by tostring(dimension)\r\n | extend Users = dcount_hll(hll)\r\n | order by Users desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column2Name}'] = dimension, Counts = dcount_hll(merged);\r\ncohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn2", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\nlet queryTable = {mainTableQuery};\r\nlet cohortedTable = queryTable \r\n | extend dimension = {propertyColumn3}\r\n | extend dimension = iif(isempty(dimension), \"\", dimension)\r\n | summarize hll = hll({usersType}) by tostring(dimension)\r\n | extend Browser = dcount_hll(hll)\r\n | order by Browser desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column3Name}'] = dimension, Counts = dcount_hll(merged);\r\ncohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn3", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\nlet queryTable = {mainTableQuery};\r\nlet cohortedTable = queryTable \r\n | extend dimension = {propertyColumn4}\r\n | extend dimension = iif(isempty(dimension), \"\", dimension)\r\n | summarize hll = hll({usersType}) by tostring(dimension)\r\n | extend Browser = dcount_hll(hll)\r\n | order by Browser desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column4Name}'] = dimension, Counts = dcount_hll(merged);\r\ncohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn4", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\nlet queryTable = {mainTableQuery};\r\nlet cohortedTable = queryTable \r\n | extend dimension = {propertyColumn5}\r\n | extend dimension = iif(isempty(dimension), \"\", dimension)\r\n | summarize hll = hll({usersType}) by tostring(dimension)\r\n | extend Browser = dcount_hll(hll)\r\n | order by Browser desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by dimension\r\n | project ['{column5Name}'] = dimension, Counts = dcount_hll(merged);\r\ncohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn5", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\nlet queryTable = {mainTableQuery};\r\nlet cohortedTable = queryTable \r\n | extend dimension = {propertyColumn6}\r\n | extend dimension = iif(isempty(dimension), \"\", dimension)\r\n | summarize hll = hll({usersType}) by tostring(dimension)\r\n | extend Browser = dcount_hll(hll)\r\n | order by Browser desc\r\n | serialize rank = row_number()\r\n | extend dimension = iff(rank > 5, 'Other', dimension)\r\n | summarize merged = hll_merge(hll) by tostring(dimension)\r\n | project ['{column6Name}'] = dimension, Counts = dcount_hll(merged);\r\ncohortedTable", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Counts", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "turquoise" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "customWidth": "33", + "conditionalVisibility": { + "parameterName": "propertyColumn6", + "comparison": "isNotEqualTo", + "value": "" + }, + "name": "query - propertygrid6" + }, + { + "type": 1, + "content": { + "json": " " + }, + "name": "text - 13", + "styleSettings": { + "margin": "20px" + } + }, + { + "type": 1, + "content": { + "json": "#### MEET YOUR USERS" + }, + "name": "text - 12" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "d80fe630-0e3e-49db-b586-0df42bd7b919", + "version": "KqlParameterItem/1.0", + "name": "SelectUsers", + "label": "Select Users", + "type": 2, + "isRequired": true, + "query": "datatable(value:string, text:string)[\r\n'| sample 5', 'Show Any 5 Users', \r\n'| top 5 by count_', 'Show Most Active Users'\r\n]", + "value": "| sample 5", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "doNotRunWhenHidden": true, + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - selectUsersDropdown" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mainTable = union {Whoused}\r\n | where timestamp {TimeRange}\r\n | where iif('*' in ({userEventsList}), 1==1, name in ({userEventsList}))\r\n {filters};\r\nlet queryTable = {mainTableQuery}; \r\nlet cohortedTable = queryTable\r\n | where isnotempty(user_Id)\r\n | summarize count() by user_Id\r\n {SelectUsers}\r\n | summarize makelist(user_Id);\r\nmainTable\r\n | where user_Id in (cohortedTable)\r\n | summarize sessionCount = dcount(session_Id),\r\n eventCount = count(),\r\n OS = makeset(client_OS), \r\n Browsers = makeset(client_Browser),\r\n any(client_City, client_CountryOrRegion)\r\n by user_Id \r\n | project Users = user_Id, Cities = iff(isempty(any_client_City), \"Unknown\", any_client_City), Countries = iff(isempty(any_client_CountryOrRegion), \"Unknown\", any_client_CountryOrRegion), Sessions = sessionCount, Events = eventCount, OS=replace('\",\"',', ',trim_end('\"]',substring(OS, 2))), Browsers = replace('\",\"',', ',trim_end('\"]',substring(Browsers, 2)))\r\n | project Users, Location = strcat(Cities, \", \", Countries), Events, NumberLabel = 'events', OS=iff(OS =='', \"Unknown\", iff(strlen(OS) > 40, strcat(substring(OS, 0, 38), '...'), OS)), Browsers = iff(Browsers =='', \"Unknown\", Browsers)\r\n | order by Events ", + "size": 3, + "queryType": 0, + "resourceType": "microsoft.insights/components", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Users", + "formatter": 7, + "formatOptions": { + "linkColumn": "Users", + "linkTarget": "UserTimeline", + "linkLabel": "View user timeline", + "linkIsContextBlade": true + } + }, + "subtitleContent": { + "columnMatch": "Location", + "formatter": 1, + "formatOptions": {}, + "tooltipFormat": { + "tooltip": "Location: {0}" + } + }, + "leftContent": { + "columnMatch": "Events", + "formatter": 12, + "formatOptions": {}, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2, + "maximumSignificantDigits": 4 + } + } + }, + "rightContent": { + "columnMatch": "NumberLabel", + "formatter": 2, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + }, + "tooltipFormat": {} + }, + "secondaryContent": { + "columnMatch": "OS", + "formatOptions": {}, + "tooltipFormat": { + "tooltip": "OS: {0}" + } + }, + "showBorder": true, + "size": "auto" + } + }, + "name": "query - UserTiles" + } + ] + }, + "name": "group - 19" + } + ] +} \ No newline at end of file diff --git a/UsageMetrics/Workbooks/Usage - Users/settings.json b/UsageMetrics/Workbooks/Usage - Users/settings.json new file mode 100644 index 0000000..740b919 --- /dev/null +++ b/UsageMetrics/Workbooks/Usage - Users/settings.json @@ -0,0 +1,12 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Users", + "author": "Microsoft", + "galleries": [ + { + "type": "usageMetrics", + "resourceType": "microsoft.insights/components", + "order": 200 + } + ] +} \ No newline at end of file diff --git a/UsageMetrics/Workbooks/categoryResources.json b/UsageMetrics/Workbooks/categoryResources.json new file mode 100644 index 0000000..cd8f7ee --- /dev/null +++ b/UsageMetrics/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Usage data tracking for users, sessions and events", "description": "", "order": 100} +} \ No newline at end of file diff --git a/View Designer/Alerts/README b/View Designer/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/View Designer/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/View Designer/Queries/README b/View Designer/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/View Designer/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/View Designer/Workbooks/Donut-List/Donut-list.workbook b/View Designer/Workbooks/Donut-List/Donut-list.workbook new file mode 100644 index 0000000..67c7e96 --- /dev/null +++ b/View Designer/Workbooks/Donut-List/Donut-list.workbook @@ -0,0 +1,149 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Donut & List Template\r\nUse this report to model the Donut & List tile from View Designer.\r\n\r\n1. To replace the below views with your own queries, select the `Edit` button in the toolbar at the top of the page to enter the `Edit Mode`.\r\n\r\n2. Then choose the `↑ Edit` option in the lower right hand corner of the Pie Chart and List cells and paste your query.\r\n\r\n💡 For an individual step-by-step instructions on how to make this workbook, follow our [guide](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-tiles#donut--list-tile) or read more about other features in the [Workbooks Documentation](https://docs.microsoft.com/en-us/azure/azure-monitor/app/usage-workbooks)\r\n
\r\n
" + }, + "name": "text - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "9878ee10-a66a-4438-afdd-29789d76bd61", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search *\r\n| where TimeGenerated {TimeRange}\r\n| summarize AggregatedValue = count() by Type | order by AggregatedValue desc\r\n", + "size": 1, + "showAnalytics": true, + "title": "Data Type Distribution", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Type", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "showPin": true, + "name": "query - 2" + } + ], + "styleSettings": { + "spacingStyle": "none" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/View Designer/Workbooks/Donut-List/settings.json b/View Designer/Workbooks/Donut-List/settings.json new file mode 100644 index 0000000..07ac6e3 --- /dev/null +++ b/View Designer/Workbooks/Donut-List/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Donut & List", + "description":"Outline of the Donut & List Tile from View Designer", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.operationalinsights/workspaces", "order": 400 } + ] +} diff --git a/View Designer/Workbooks/Line Chart Callout List/Line Chart Callout List.workbook b/View Designer/Workbooks/Line Chart Callout List/Line Chart Callout List.workbook new file mode 100644 index 0000000..a527654 --- /dev/null +++ b/View Designer/Workbooks/Line Chart Callout List/Line Chart Callout List.workbook @@ -0,0 +1,181 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Line Chart, Callout, & List Template\r\nUse this report to model the Line Chart, Callout, & List tile from View Designer\r\n\r\n1. To replace the below views with your own queries, select the `Edit` button in the toolbar at the top of the page to enter the `Edit Mode`.\r\n\r\n2. Choose the `↑ Edit` option in the lower right hand corner of the each cell and paste your query.\r\n\r\n💡 For an individual step-by-step instructions on how to make this workbook, follow our [guide](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-tiles#line-chart--list-tile) or read more about other features in the [Workbooks Documentation](https://docs.microsoft.com/en-us/azure/azure-monitor/app/usage-workbooks)\r\n
\r\n
" + }, + "name": "text - 4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "9878ee10-a66a-4438-afdd-29789d76bd61", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search *\r\n| summarize AggregatedValue = count() by Type, bin(TimeGenerated, 1h)\r\n| sort by TimeGenerated desc", + "size": 1, + "aggregation": 3, + "showAnalytics": true, + "title": "Data Type Distribution", + "timeContext": { + "durationMs": 86400000 + }, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * \r\n| summarize AggregatedValue = count() by Computer \r\n| summarize Count = count() ", + "size": 1, + "title": "Average per hour", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": false + } + }, + "customWidth": "50", + "name": "query - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Type", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 86400000 + }, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "showPin": true, + "name": "query - 2" + } + ], + "styleSettings": { + "spacingStyle": "none" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/View Designer/Workbooks/Line Chart Callout List/settings.json b/View Designer/Workbooks/Line Chart Callout List/settings.json new file mode 100644 index 0000000..e37dbbd --- /dev/null +++ b/View Designer/Workbooks/Line Chart Callout List/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Line Chart, Callout, & List", + "description":"Outline of the Line Chart, Callout, & List Tile from View Designer", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.operationalinsights/workspaces", "order": 400 } + ] +} diff --git a/View Designer/Workbooks/Number List/Number List.workbook b/View Designer/Workbooks/Number List/Number List.workbook new file mode 100644 index 0000000..9a158e9 --- /dev/null +++ b/View Designer/Workbooks/Number List/Number List.workbook @@ -0,0 +1,164 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Number & List Template\r\nUse this report to model the Number & List tile from View Designer\r\n\r\n1. To replace the below views with your own queries, select the `Edit` button in the toolbar at the top of the page to enter the `Edit Mode`.\r\n\r\n2. Then select the `↑ Edit` option in the lower right hand corner of the Tile and List cells to paste your query.\r\n\r\n💡 For an individual step-by-step instructions on how to make this workbook, follow our [guide](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-tiles#number--list-tile) or read more about other features in the [Workbooks Documentation](https://docs.microsoft.com/en-us/azure/azure-monitor/app/usage-workbooks)\r\n
\r\n
" + }, + "name": "text - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "9878ee10-a66a-4438-afdd-29789d76bd61", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * \r\n| summarize AggregatedValue = count() by Computer \r\n| summarize Count = count() ", + "size": 1, + "title": "Average per hour", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": false + } + }, + "name": "query - 4", + "styleSettings": { + "margin": "0px 0px -200px 0px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Type", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "filter": true + }, + "sortBy": [] + }, + "customWidth": "50", + "showPin": true, + "name": "query - 2" + } + ], + "styleSettings": { + "spacingStyle": "none" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/View Designer/Workbooks/Number List/settings.json b/View Designer/Workbooks/Number List/settings.json new file mode 100644 index 0000000..09247d9 --- /dev/null +++ b/View Designer/Workbooks/Number List/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Number & List", + "description":"Outline of the Number & List Tile from View Designer", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.operationalinsights/workspaces", "order": 400 } + ] +} diff --git a/View Designer/Workbooks/Tabbed/Tabbed Views.workbook b/View Designer/Workbooks/Tabbed/Tabbed Views.workbook new file mode 100644 index 0000000..c1f7841 --- /dev/null +++ b/View Designer/Workbooks/Tabbed/Tabbed Views.workbook @@ -0,0 +1,468 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Tabbed Overview\r\nThis report utilizes Workbooks tabs to consolidate multiple views to one workbook.\r\n\r\nUsers can modify the queries using the 🖊️ Edit button from the top toolbar, and change queries for a specific step using the ↑ Edit button in the lower right hand corner.\r\n\r\nRead more about converting from [View Designer to Workbooks](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-options) or discover additional [Workbooks features](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/workbooks-overview).\r\n
\r\n
" + }, + "name": "text - 7" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "12e24ac4-d5f3-42ec-9c32-118fd5438150", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + } + }, + { + "id": "55e1e171-10f3-43e1-9e0b-d7922d304448", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "isRequired": true, + "query": "search * \r\n| summarize AggregatedValue = count() by Computer \r\n| summarize Count = count() \r\n| project Message = strcat('# ', Count)", + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 6" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Data Type Distribution", + "subTarget": "DataType", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Data Types Over Time", + "subTarget": "OverTime", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Data Types By Computer", + "subTarget": "Timeline", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Computers Sending Data", + "subTarget": "Computers", + "style": "link" + } + ] + }, + "name": "links - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize AggregatedValue = count() by Type | order by AggregatedValue desc\r\n| render piechart ", + "size": 1, + "showAnalytics": true, + "title": "Data Type Distribution", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "DataType" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Type", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "showIcon": true, + "aggregation": "Count" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "DataType" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search *\r\n| summarize AggregatedValue = count() by Type, bin(TimeGenerated, 1h)\r\n| sort by TimeGenerated desc", + "size": 1, + "showAnalytics": true, + "title": "Data Types Over Time", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart" + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "OverTime" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Type", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "OverTime" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Computer, bin(TimeGenerated,{TimeRange:grain})", + "size": 1, + "showAnalytics": true, + "title": "Data Type Distribution", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "barchart" + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Timeline" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Computer", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Computer", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Timeline" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 9" + }, + { + "type": 1, + "content": { + "json": "\r\n_Average per hour_\r\n{Message}" + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Computers" + }, + "customWidth": "50", + "name": "text - 10 - Copy", + "styleSettings": { + "margin": "15" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Type", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Computers" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 3 - Copy" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/View Designer/Workbooks/Tabbed/settings.json b/View Designer/Workbooks/Tabbed/settings.json new file mode 100644 index 0000000..0dc9f04 --- /dev/null +++ b/View Designer/Workbooks/Tabbed/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Tabbed Overview", + "description":"Combines multiple views into a tabbed layout", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.operationalinsights/workspaces", "order": 300 } + ] +} diff --git a/View Designer/Workbooks/Timeline List/Timeline List.workbook b/View Designer/Workbooks/Timeline List/Timeline List.workbook new file mode 100644 index 0000000..7dd0c54 --- /dev/null +++ b/View Designer/Workbooks/Timeline List/Timeline List.workbook @@ -0,0 +1,151 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Timeline & List Template\r\nUse this report to model the Timeline & List tile from View Designer\r\n\r\n1. To replace the below views with your own queries, select the `Edit` button in the toolbar at the top of the page to enter the `Edit Mode`.\r\n\r\n2. Then choose the `↑ Edit` option in the lower right hand corner of the Timeline Chart and List cells and paste your query.\r\n\r\n💡 For an individual step-by-step instructions on how to make this workbook, follow our [guide](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-tiles#timeline--list) or read more about other features in the [Workbooks Documentation](https://docs.microsoft.com/en-us/azure/azure-monitor/app/usage-workbooks)
\r\n
" + }, + "name": "text - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "9878ee10-a66a-4438-afdd-29789d76bd61", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Computer, bin(TimeGenerated,{TimeRange:grain})", + "size": 1, + "aggregation": 3, + "showAnalytics": true, + "title": "Data Type Distribution", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "barchart" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Computer", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Computer", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "filter": true + }, + "sortBy": [] + }, + "customWidth": "50", + "showPin": true, + "name": "query - 2" + } + ], + "styleSettings": { + "spacingStyle": "none" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/View Designer/Workbooks/Timeline List/settings.json b/View Designer/Workbooks/Timeline List/settings.json new file mode 100644 index 0000000..14c1676 --- /dev/null +++ b/View Designer/Workbooks/Timeline List/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Timeline & List", + "description":"Outline of the Timeline & List Tile from View Designer", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.operationalinsights/workspaces", "order": 400 } + ] +} diff --git a/View Designer/Workbooks/Two Numbers List/Two Numbers List.workbook b/View Designer/Workbooks/Two Numbers List/Two Numbers List.workbook new file mode 100644 index 0000000..d4ef1e3 --- /dev/null +++ b/View Designer/Workbooks/Two Numbers List/Two Numbers List.workbook @@ -0,0 +1,170 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Two Numbers & List Template\r\nUse this report to model the Two Numbers & List tile from View Designer\r\n\r\n1. To replace the below views with your own queries, select the `Edit` button in the toolbar at the top of the page to enter the `Edit Mode`.\r\n\r\n2. Then select the `↑ Edit` option in the lower right hand corner of the parameter step below, choose the `Message` and `Message2nd` parameter and the 🖊️icon to open the context menu. From there, you can replace the number queries.\r\n*Make sure to include `| project Message = strcat('# ', Count)` for large text formatting.*\r\n\r\n\r\n3. Then choose the `↑ Edit` option in the lower right hand corner of the List cell and paste your query.\r\n\r\n💡 For an individual step-by-step instructions on how to make this workbook, follow our [guide](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-tiles) or read more about other features in the [Workbooks Documentation](https://docs.microsoft.com/azure/azure-monitor/app/usage-workbooks)\r\n
\r\n
" + }, + "name": "text - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "9878ee10-a66a-4438-afdd-29789d76bd61", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "e1d34b98-42ee-4781-9350-73f16548c4f2", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "isRequired": true, + "query": "search * \r\n| summarize AggregatedValue = count() by Computer\r\n| summarize Count = count()\r\n| project Message = strcat('# ', Count)", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "99f2effe-5a24-4764-b71a-2624fce768c9", + "version": "KqlParameterItem/1.0", + "name": "Message2nd", + "type": 1, + "isRequired": true, + "query": "search * \r\n| summarize Count = count()\r\n| project Message = strcat('# ', Count)", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "_Average per hour_\r\n{Message}\r\n_Total entries_\r\n{Message2nd}\r\n
\r\n
" + }, + "name": "text - 5", + "styleSettings": { + "margin": "15px 0px -75px 15px", + "padding": "0px" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Type", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "filter": true + }, + "sortBy": [] + }, + "customWidth": "50", + "showPin": true, + "name": "query - 2" + } + ], + "styleSettings": { + "spacingStyle": "none" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/View Designer/Workbooks/Two Numbers List/settings.json b/View Designer/Workbooks/Two Numbers List/settings.json new file mode 100644 index 0000000..cced684 --- /dev/null +++ b/View Designer/Workbooks/Two Numbers List/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Two Numbers & List", + "description":"Outline of the Two Numbers & List Tile from View Designer", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.operationalinsights/workspaces", "order": 400 } + ] +} diff --git a/View Designer/Workbooks/Vertical Overview/Vertical Overview.workbook b/View Designer/Workbooks/Vertical Overview/Vertical Overview.workbook new file mode 100644 index 0000000..72faf4e --- /dev/null +++ b/View Designer/Workbooks/Vertical Overview/Vertical Overview.workbook @@ -0,0 +1,408 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Vertical Overview\r\nThis report utilizes consolidates multiple views in Workbooks using a vertical layout.\r\n\r\nUsers can modify the queries using the `🖊️ Edit` button from the top toolbar, and change queries for a specific step using the `↑ Edit` button in the lower right hand corner.\r\n\r\nRead more about converting from [View Designer to Workbooks](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-options) or discover additional [Workbooks features](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/workbooks-overview).\r\n
\r\n
" + }, + "name": "text - 7" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "12e24ac4-d5f3-42ec-9c32-118fd5438150", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize AggregatedValue = count() by Type | order by AggregatedValue desc", + "size": 1, + "showAnalytics": true, + "title": "Data Type Distribution", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Type", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "showIcon": true, + "aggregation": "Count" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "customWidth": "50", + "showPin": true, + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search *\r\n| summarize AggregatedValue = count() by Type, bin(TimeGenerated, 1h)\r\n| sort by TimeGenerated desc", + "size": 1, + "showAnalytics": true, + "title": "Data Types Over Time", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Type", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "customWidth": "50", + "showPin": true, + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Computer, bin(TimeGenerated,{TimeRange:grain})", + "size": 1, + "showAnalytics": true, + "title": "Data Type Distribution", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "barchart" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Computer", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Computer", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "customWidth": "50", + "showPin": true, + "name": "query - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * \r\n| summarize AggregatedValue = count() by Computer \r\n| summarize Count = count() ", + "size": 0, + "showAnalytics": true, + "title": "Computers sending data", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": false + } + }, + "customWidth": "50", + "showPin": true, + "name": "query - 10" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search * | summarize Count = count() by Type", + "size": 1, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Count", + "formatter": 4, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_bar_Count_1", + "sortOrder": 2 + } + ] + }, + "customWidth": "50", + "showPin": true, + "name": "query - 3 - Copy" + } + ], + "styleSettings": { + "spacingStyle": "none" + }, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/View Designer/Workbooks/Vertical Overview/settings.json b/View Designer/Workbooks/Vertical Overview/settings.json new file mode 100644 index 0000000..c6e54b3 --- /dev/null +++ b/View Designer/Workbooks/Vertical Overview/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Vertical Overview", + "description":"Combines multiple views into a vertical layout", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.operationalinsights/workspaces", "order": 300 } + ] +} diff --git a/View Designer/Workbooks/View Designer Transition Guide/View Designer Transition Guide.workbook b/View Designer/Workbooks/View Designer Transition Guide/View Designer Transition Guide.workbook new file mode 100644 index 0000000..fac4388 --- /dev/null +++ b/View Designer/Workbooks/View Designer Transition Guide/View Designer Transition Guide.workbook @@ -0,0 +1,494 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Getting started with creating new views in Workbooks\r\n\r\n### Jump to a section" + }, + "name": "text - 0" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "bullets", + "links": [ + { + "cellValue": "why workbooks", + "linkTarget": "step", + "linkLabel": "Why Workbooks?", + "style": "link" + }, + { + "cellValue": "quick start", + "linkTarget": "step", + "linkLabel": "Quick Start Templates", + "style": "link" + }, + { + "cellValue": "edit mode", + "linkTarget": "step", + "linkLabel": "Edit Mode", + "style": "link", + "workbookContext": {}, + "alertRuleContext": {} + }, + { + "cellValue": "Parameters", + "linkTarget": "step", + "linkLabel": "Parameters", + "style": "link", + "workbookContext": {}, + "alertRuleContext": {} + }, + { + "cellValue": "running queries", + "linkTarget": "step", + "linkLabel": "Running Queries", + "style": "link" + }, + { + "cellValue": "customizing", + "linkTarget": "step", + "linkLabel": "Customizing Visualizations", + "style": "link", + "workbookContext": {}, + "alertRuleContext": {} + }, + { + "cellValue": "additional resources - Copy", + "linkTarget": "step", + "linkLabel": "Additional Resources", + "style": "link" + } + ] + }, + "customWidth": "25", + "name": "links - 16", + "styleSettings": { + "padding": "0px 0px 0px 25px" + } + }, + { + "type": 1, + "content": { + "json": "### [Why Convert View Designer Dashboards to Workbooks?](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-overview#why-convert-view-designer-dashboards-to-workbooks)\r\n\r\nWorkbooks is a platform that unlocks the full potential of your data. Workbooks not only retains all the capabilities of View Designer, but offers greater flexibility and additional functionality through text, metrics, parameters, and other chart customizations.\r\n\r\n### Advantages of Workbooks over View Designer\r\n* Supports both logs AND metrics\r\n* Allows both personal views for individual access control and shared Workbooks views\r\n* Custom layout options with tabs, sizing, and scaling controls\r\n* Support for querying across multiple workspaces, Application Insights applications, and subscriptions\r\n* Enables custom parameters that dynamically update associated charts and visualizations\r\n* Template gallery support from public GitHub" + }, + "customWidth": "75", + "name": "why workbooks", + "styleSettings": { + "margin": "-30px" + } + }, + { + "type": 1, + "content": { + "json": "### [Workbooks Quick Start Templates ](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-tiles)\r\n\r\nWorkbooks in log analytics workspaces already have custom templates designed to replicate the existing View Designer tiles. Below links to the templates for quick access, or the templates can be opened in the Workbooks gallery.\r\n\r\nOnce you select a template link follow these steps to update your views.\r\n\r\n1. Select the `Edit` button in the toolbar at the top of the page to enter the `Edit Mode`.\r\n\r\n2. Then choose the `↑ Edit` option in the lower right hand corner of a cell and paste your query." + }, + "name": "quick start", + "styleSettings": { + "margin": "30px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "nav", + "links": [ + { + "linkTarget": "WorkbookTemplate", + "linkLabel": "Tabbed Overview", + "style": "primary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/View Designer/Tabbed", + "typeSource": "workbook", + "gallerySource": "workbook" + }, + "alertRuleContext": {} + }, + { + "linkTarget": "WorkbookTemplate", + "linkLabel": "Vertical Overview", + "style": "primary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/View Designer/Vertical Overview", + "typeSource": "workbook", + "gallerySource": "workbook" + }, + "alertRuleContext": {} + }, + { + "cellValue": "", + "linkTarget": "WorkbookTemplate", + "linkLabel": "Donut & List", + "style": "primary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/View Designer/Donut-List", + "typeSource": "workbook", + "gallerySource": "workbook" + } + }, + { + "linkTarget": "WorkbookTemplate", + "linkLabel": "Timeline & List", + "style": "primary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/View Designer/Timeline List", + "typeSource": "workbook", + "gallerySource": "workbook" + }, + "alertRuleContext": {} + }, + { + "linkTarget": "WorkbookTemplate", + "linkLabel": "Number & List", + "style": "primary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/View Designer/Number List", + "typeSource": "workbook", + "gallerySource": "workbook" + } + }, + { + "linkTarget": "WorkbookTemplate", + "linkLabel": "Two Numbers & List", + "style": "primary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/View Designer/Two Numbers List", + "typeSource": "workbook", + "gallerySource": "workbook" + }, + "alertRuleContext": {} + }, + { + "linkTarget": "WorkbookTemplate", + "linkLabel": "Line Chart, Callout, & List", + "style": "primary", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "Community-Workbooks/View Designer/Line Chart Callout List", + "typeSource": "workbook", + "gallerySource": "workbook" + }, + "alertRuleContext": {} + } + ] + }, + "name": "links - 13" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-overview", + "linkTarget": "Url", + "linkLabel": "View Designer transition documentation", + "preText": "For additional assistance, please reference the ", + "postText": "", + "style": "link" + }, + { + "cellValue": "https://docs.microsoft.com/en-us/azure/azure-monitor/app/usage-workbooks", + "linkTarget": "Url", + "linkLabel": "Workbooks documentation", + "preText": " or the ", + "style": "link" + } + ] + }, + "name": "additional resources" + }, + { + "type": 1, + "content": { + "json": "## [Understanding Editing in Workbooks](https://docs.microsoft.com/en-us/azure/azure-monitor/app/usage-workbooks#editing-rearranging-cloning-and-deleting-workbook-sections)\r\n\r\nView Designer has users select a specific visualization type, then edit the query to update the data source.\r\n\r\nWorkbooks lets users first run their query, then choose and customize their optimal visualization for their data. Workbooks has two modes, an editing and reading mode. By default, saved Workbooks and templates open up in the reading mode, to start editing, click on the `🖊️ Edit` button in the top toolbar. \r\n\r\nTo edit a cell, simply select the `↑ Edit` button located at the lower right hand corner of each cell. Workbooks allows users to edit multiple steps at the same time, and to return to reading mode, select `Done Editing` from the top toolbar." + }, + "name": "edit mode" + }, + { + "type": 1, + "content": { + "json": "## [Parameters in Workbooks](https://docs.microsoft.com/en-us/azure/azure-monitor/app/usage-workbooks#adding-parameter-sections)\r\n\r\nYou can now create a time range filter by selecting the \"Add parameters\" option and selecting the \"Time Range Picker\" as shown in the example below:" + }, + "name": "Parameters" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "b8228ea2-2b9d-40e0-8b52-be60e28e805a", + "version": "KqlParameterItem/1.0", + "name": "Time", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 3" + }, + { + "type": 1, + "content": { + "json": "Parameters can also be further customized to display subscriptions, resources, or even be based off of a query." + }, + "name": "text - 4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "b381b0aa-b7e0-457e-ae77-78a21fcd9b96", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "includeAll": false + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Time", + "value": [ + "value::all" + ] + }, + { + "id": "182f39eb-958f-449b-b97c-0517c39698e1", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project name, id\r\n| union (Resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| order by name asc\r\n| take 5\r\n| project id, name)\r\n| summarize Count = count() by id, name\r\n| order by name asc\r\n| project value = id, label = id, selected = Count > 1", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "Time", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 5" + }, + { + "type": 1, + "content": { + "json": "### [Running queries and making visualizations in Workbooks](https://docs.microsoft.com/en-us/azure/azure-monitor/app/usage-workbooks#adding-query-sections)\r\n\r\nQueries function the same as they would in View Designer or LA workspaces. With Workbooks, you can even change the scope that you query against, whether it is multiple workspaces or resources.\r\n\r\nWorkbooks also allows you to control the many options that there are for visualizations. You can create a grids, pie charts, bar charts, line charts, and much more." + }, + "name": "running queries" + }, + { + "type": 1, + "content": { + "json": "To begin try using a sample query:\r\n``` \r\nsearch *\r\n| summarize AggregatedValue = count() by Type \r\n| order by AggregatedValue desc\r\n ```\r\n Then under the Visualizations dropdown, select \"Pie Chart\"\r\nNotice how if you update the time parameter above, you are able to change the displayed time values." + }, + "name": "text - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search *\r\n| summarize AggregatedValue = count() by Type \r\n| order by AggregatedValue desc", + "size": 1, + "title": "An Example Pie Chart", + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart" + }, + "name": "query - 7" + }, + { + "type": 1, + "content": { + "json": "We can re-utilize the same query and form a bar chart as well. To do so, select the \"Bar chart\" option underneath the visualizations dropdown.\r\n\r\n### [Customizing Visualizations](https://docs.microsoft.com/en-us/azure/azure-monitor/app/usage-workbooks#advanced-analytic-query-settings)\r\n\r\nFor visualizations, you can also make customizations such as changing to color and displayed data, as shown in the examples below.\r\n\r\nWe can also make numerous cosmetic changes to the charts, for example, the size of each cell, adding an export or pin to dashboard option are available in the ⚙️, for the advanced settings." + }, + "name": "customizing" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search *\r\n| summarize AggregatedValue = count() by Type\r\n| order by AggregatedValue desc", + "size": 0, + "title": "One Example Bar Chart", + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "barchart" + }, + "customWidth": "50", + "name": "query - 10" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "search *\r\n| summarize AggregatedValue = count() by Type\r\n| order by AggregatedValue desc", + "size": 3, + "showAnalytics": true, + "title": "Another Example Bar Chart", + "timeContext": { + "durationMs": 86400000 + }, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "barchart", + "chartSettings": { + "seriesLabelSettings": [ + { + "seriesName": "*", + "color": "purple" + }, + { + "seriesName": "Usage", + "color": "purple" + } + ] + } + }, + "customWidth": "50", + "showPin": true, + "name": "query - 10 - Copy" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/view-designer-conversion-overview", + "linkTarget": "Url", + "linkLabel": "View Designer transition documentation", + "preText": "For additional assistance, please reference the ", + "postText": "", + "style": "link" + }, + { + "cellValue": "https://docs.microsoft.com/en-us/azure/azure-monitor/app/usage-workbooks", + "linkTarget": "Url", + "linkLabel": "Workbooks documentation", + "preText": " or the ", + "style": "link" + } + ] + }, + "name": "additional resources - Copy" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/View Designer/Workbooks/View Designer Transition Guide/settings.json b/View Designer/Workbooks/View Designer Transition Guide/settings.json new file mode 100644 index 0000000..92dbeb2 --- /dev/null +++ b/View Designer/Workbooks/View Designer Transition Guide/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"View Designer Transition Guide", + "description":"Quick start guide to use Workbooks for View Designer Users", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.operationalinsights/workspaces", "order": 100 } + ] +} diff --git a/View Designer/Workbooks/categoryResources.json b/View Designer/Workbooks/categoryResources.json new file mode 100644 index 0000000..2f91b85 --- /dev/null +++ b/View Designer/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"View Designer Guides", "description": "", "order": 200} +} \ No newline at end of file diff --git a/Virtual Machine Scale Sets - Network Dependencies/Alerts/README b/Virtual Machine Scale Sets - Network Dependencies/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Virtual Machine Scale Sets - Network Dependencies/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Virtual Machine Scale Sets - Network Dependencies/Queries/README b/Virtual Machine Scale Sets - Network Dependencies/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Virtual Machine Scale Sets - Network Dependencies/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Virtual Machine Scale Sets - Network Dependencies/Workbooks/Active Ports/Active Ports.workbook b/Virtual Machine Scale Sets - Network Dependencies/Workbooks/Active Ports/Active Ports.workbook new file mode 100644 index 0000000..530eb94 --- /dev/null +++ b/Virtual Machine Scale Sets - Network Dependencies/Workbooks/Active Ports/Active Ports.workbook @@ -0,0 +1,292 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "80a15801-7442-49f3-a82f-6e55849ec7fb", + "version": "KqlParameterItem/1.0", + "name": "DefaultResource", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachinescalesets": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": null + }, + { + "id": "7da21a07-10f4-4455-9105-c37132dcee0d", + "version": "KqlParameterItem/1.0", + "name": "Context", + "type": 1, + "isRequired": false, + "query": "// {DefaultResource}\r\nwhere strcat(\"'\", id, \"'\") =~ \"{DefaultResource:value}\"\r\n| project value = tostring(pack('sub', subscriptionId, 'type', type, 'id', id))", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null, + "name": "parameters - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "59d0c633-2f35-48d0-ab7e-0b25e81f6eb2", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "quote": "'", + "delimiter": ",", + "query": "summarize by subscriptionId\r\n| project strcat('/subscriptions/', subscriptionId), selected = subscriptionId == todynamic('{Context}').sub", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "45c1e9b3-ff85-4825-85b1-a41a256cb060", + "version": "KqlParameterItem/1.0", + "name": "ResourceType", + "type": 7, + "isRequired": true, + "query": "summarize by type\r\n| where type =~ \"microsoft.compute/virtualmachines\" or type =~ \"microsoft.compute/virtualmachinescalesets\" or type =~ \"microsoft.operationalinsights/workspaces\"\r\n| project type, selected = todynamic('{Context}').type =~ type", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "0e9819ac-8b12-4827-98e0-f93e26077517", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "type": 5, + "isRequired": true, + "query": "where type =~ '{ResourceType}'\r\n| summarize by id, name\r\n| project id, selected = id == todynamic('{Context}').id", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "Context", + "comparison": "isEqualTo", + "value": null + }, + "name": "parameters - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "d50b9c51-4e63-4a89-8793-64292a082c4e", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + }, + "timeContextFromParameter": null + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null, + "name": "parameters - 4" + }, + { + "type": 1, + "content": { + "json": "## Port activity by Computer, Process, IP and Port" + }, + "conditionalVisibility": null, + "name": "text - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// {DefaultResource} {Subscriptions} {ResourceType} {Resources}\nVMBoundPort\n| where Ip != \"127.0.0.1\"\n| summarize BytesSent=sum(BytesSent), BytesReceived=sum(BytesReceived), LinksEstablished=sum(LinksEstablished), LinksTerminated=sum(LinksTerminated), arg_max(TimeGenerated, LinksLive) by Computer, ProcessName, Ip, Port, IsWildcardBind\n| project-away TimeGenerated\n| order by BytesSent desc", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "{ResourceType}", + "crossComponentResources": [ + "{Resources}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "BytesSent", + "formatter": 4, + "formatOptions": { + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "BytesReceived", + "formatter": 4, + "formatOptions": { + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "LinksEstablished", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + } + }, + { + "columnMatch": "LinksTerminated", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + } + }, + { + "columnMatch": "LinksLive", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "conditionalVisibility": null, + "name": "query - 2" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Virtual Machine Scale Sets - Network Dependencies/Workbooks/Active Ports/settings.json b/Virtual Machine Scale Sets - Network Dependencies/Workbooks/Active Ports/settings.json new file mode 100644 index 0000000..f4aaac8 --- /dev/null +++ b/Virtual Machine Scale Sets - Network Dependencies/Workbooks/Active Ports/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Active Ports", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.compute/virtualmachinescalesets", "order": 175 }, + { "type": "insights", "resourceType": "microsoft.compute/virtualmachinescalesets", "order": 175 } + ] +} diff --git a/Virtual Machine Scale Sets - Network Dependencies/Workbooks/Connections Overview/Connections Overview.workbook b/Virtual Machine Scale Sets - Network Dependencies/Workbooks/Connections Overview/Connections Overview.workbook new file mode 100644 index 0000000..132a568 --- /dev/null +++ b/Virtual Machine Scale Sets - Network Dependencies/Workbooks/Connections Overview/Connections Overview.workbook @@ -0,0 +1,1016 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e41c2177-932a-4c58-ba24-03ef070eb197", + "version": "KqlParameterItem/1.0", + "name": "Resource", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachinescalesets": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": null + }, + { + "id": "a9393837-8ef0-40e5-b223-4df1208a691e", + "version": "KqlParameterItem/1.0", + "name": "Test", + "type": 1, + "isRequired": false, + "query": "VMConnection\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "648ac90d-4be5-4c08-ac13-bcff7f8ddbf9", + "version": "KqlParameterItem/1.0", + "name": "DisclaimerText", + "type": 1, + "isRequired": false, + "query": "print iff('{Test}' == '' , 'This workbook requires [Azure Monitor for VMs (preview)](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview) enabled', iff('{Test}' == '0', '⚠ There is currently no `VMConnection` data in this workspace', 'The following table presents the connection statistics for computers in your workspace (max `10,000` rows). Use the Hierarchy dropdown for more detailed information for each computer but fewer computers will be shown if the total number of rows rendered exceeds `10,000`.'))", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": { + "parameterName": "_", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "{DisclaimerText}\r\n\r\n---" + }, + "conditionalVisibility": null, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "addcec31-b7ac-4715-a78d-9b803f86af8a", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-01-28T23:37:45.026Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-01-28T23:37:45.026Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-01-28T23:37:45.026Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "timeContextFromParameter": null + }, + { + "id": "db9b2f1d-188a-4dda-af4a-b39deeb34da3", + "version": "KqlParameterItem/1.0", + "name": "Direction", + "type": 2, + "description": "Direction of the network connection from the VMs", + "isRequired": true, + "value": "outbound", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"inbound\", \"label\":\"Inbound\" },\r\n { \"value\":\"outbound\", \"label\":\"Outbound\" }\r\n]", + "timeContextFromParameter": null + }, + { + "id": "8744c427-f060-4725-95af-850af2fa08b1", + "version": "KqlParameterItem/1.0", + "name": "ComputerNameContains", + "type": 1, + "isRequired": false, + "isHiddenWhenLocked": false, + "timeContextFromParameter": null + }, + { + "id": "b141bd6c-cd8d-488e-a5f6-83ab00d31161", + "version": "KqlParameterItem/1.0", + "name": "Computers", + "type": 2, + "isRequired": false, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "VMConnection\r\n| where Computer contains '{ComputerNameContains}'\r\n| summarize by Computer\r\n| project Value = Computer, Display = Computer, isSelected = false\r\n| order by Display asc\r\n| union (datatable(Value:string, Display:string, isSelected:boolean)['*', 'All',true])", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "488d1f86-cabc-4fcc-8dc9-9a2e5803fb20", + "version": "KqlParameterItem/1.0", + "name": "ComputerFilter", + "type": 1, + "isRequired": true, + "query": "let computerFilter = iff('*' in ({Computers}), \"| where Computer contains '{ComputerNameContains}'\", \"| where Computer in ({Computers})\");\r\nprint(computerFilter)", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "56ab6626-c12d-4de1-8a3d-8a6099db3cd3", + "version": "KqlParameterItem/1.0", + "name": "hierarchy", + "type": 1, + "isRequired": true, + "value": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Direction == 'inbound'), result = '[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Port -> Remote IP\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Port\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]'", + "criteriaContext": { + "leftOperand": "Direction", + "operator": "==", + "rightValType": "static", + "rightVal": "inbound", + "resultValType": "static", + "resultVal": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Port -> Remote IP\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Port\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]" + } + }, + { + "condition": "else result = '[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "8be4bd82-b145-4602-af53-52c9e8f8d51e", + "version": "KqlParameterItem/1.0", + "name": "Hierarchy", + "type": 2, + "description": "Select the level of detail to be shown in the table below", + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"{hierarchy}\",\"transformers\":[{\"type\":\"jsonpath\"}]}", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "5526f711-6d04-469e-8d06-351508f1014e", + "version": "KqlParameterItem/1.0", + "name": "TableFilter", + "type": 2, + "description": "Filter table based on presence of malicious connections or at least one link failing", + "isRequired": false, + "multiSelect": true, + "quote": "", + "delimiter": "", + "value": [], + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"Only Malicious Connections\",\r\n \"value\": \" | where MaliciousConnectionsCount >= 1\"\r\n },\r\n {\r\n \"label\": \"Only Links Failed\",\r\n \"value\": \" | where LinksFailed >= 1\"\r\n }\r\n]", + "timeContextFromParameter": null + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": null, + "name": "parameters - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Resource}" + ], + "parameters": [ + { + "id": "5e335a1b-7f99-4647-854a-d7b5cb489bb2", + "version": "KqlParameterItem/1.0", + "name": "ServiceMapComputers", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"let computers = ServiceMapComputer_CL | summarize (TimeGenerated, Properties) = arg_max(TimeGenerated, pack_all()) by Computer;\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "c69fbaae-4fd2-4527-acdd-a2c358eebffa", + "version": "KqlParameterItem/1.0", + "name": "MaliciousIpData", + "type": 1, + "isRequired": false, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"let maliciousIpData = VMConnection | where Direction == '{Direction}' {ComputerFilter} | where MaliciousIp != '' | summarize by Computer, ProcessName, MaliciousIp, DestinationPort, RemoteIp, IsActive, IndicatorThreatType, RemoteCountry, RemoteLongitude, RemoteLatitude, Confidence, Severity, FirstReportedDateTime, LastReportedDateTime | project MaliciousIp = strcat(Computer, '-', ProcessName, '-', MaliciousIp), MaliciousPort = strcat(Computer, '-', ProcessName, '-', DestinationPort), MaliciousPortIp = strcat(Computer, '-', ProcessName, '-', DestinationPort, '-', RemoteIp), Computer = Computer, Process = strcat(Computer, '-', ProcessName), MaliciousIpInfo = pack('Malicious IP', MaliciousIp, 'Is Active', IsActive, 'Indicator Threat Type', IndicatorThreatType, 'Remote Country', RemoteCountry, 'Longitude', RemoteLongitude, 'Latitude', RemoteLatitude, 'Confidence', Confidence, 'Severity', Severity, 'First Reported DateTime', FirstReportedDateTime, 'Last Reported DateTime', LastReportedDateTime, 'Destination Port', DestinationPort, 'Remote IP', RemoteIp);\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "dd933ac8-1273-48fe-8d09-bd65d857ce83", + "version": "KqlParameterItem/1.0", + "name": "ComputerData", + "type": 1, + "isRequired": false, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"let computerData = VMConnection | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Name = strcat('🖥️ ', Computer), ComputerName = Computer, Type = 'Computer', TypeKey = 1, Key = Computer, ParentKey = '---' | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Computer) on $left.Key == $right.Computer | project-away Computer | order by Name asc;\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "fb879823-c082-4c53-af7e-18d044032f99", + "version": "KqlParameterItem/1.0", + "name": "RemoteIpDataInbound", + "type": 1, + "isRequired": false, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"let remoteIpDataInbound = VMConnection | where Direction == 'inbound' | where 'inbound' == 'inbound' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort), '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), Id = strcat(Computer, '-', ProcessName, '-', RemoteIp), ComputerName = Computer | join kind=inner sourcePortData on $left.ParentKey == $right.Key | project-away AverageResponseTime1, Computer1, Key1, LinksFailed1, MaxLinksLive1, ParentKey1, ProcessName1, Responses1, TotalBytesReceived1, TotalBytesSent1, Type1, TypeKey1 | order by Name asc | join kind=leftouter ipComputerMapping on $left.RemoteIp == $right.Ipv4 | extend Name = iff(RemoteIp == '', 'Unknown', strcat('🌐 External (', RemoteIp, ')')) | project-away Computer, Ipv4 | order by Name desc | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPortIp | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIp, Computer, Process, Computer1, MaliciousIpInfo1, Id;\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "3ad60c70-b530-49c0-a59b-8df690dffbc8", + "version": "KqlParameterItem/1.0", + "name": "ProcessName", + "type": 1, + "isRequired": false, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"let processData = VMConnection | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, Name = strcat('🎫 ', ProcessName), Type = 'Process', TypeKey = 2, Key = strcat(Computer, '-', ProcessName), ParentKey = Computer, ComputerName = Computer | join kind=inner computerData on $left.ParentKey == $right.Key | project-away Name1, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Process) on $left.Key == $right.Process | project-away Process, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | order by Name asc;\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "c9eea7db-3d14-4fbf-8ae6-b7507ec1d43f", + "version": "KqlParameterItem/1.0", + "name": "RemoteIpData", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"let remoteIpData = VMConnection | where '{Direction}' == 'outbound' | where Direction == '{Direction}' {ComputerFilter} | extend RemoteIp = iff(Direction == 'outbound', DestinationIp, SourceIp) | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=inner processData on $left.ParentKey == $right.Key | project-away Name, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousIp | project-away MaliciousIp, Computer, Process, Computer1, Computer2, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | join kind = leftouter (ipComputerMapping) on $left.RemoteIp == $right.Ipv4 | extend Name = iff(Computer == '', iff(RemoteIp == '127.0.0.1', '🌐 Localhost', strcat('🌐 External (', RemoteIp, ')')), strcat('🖥️ ', Computer)) | project-away Computer, Ipv4 | order by Name desc;\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "4a9ed59b-002e-4c81-b437-8456faeef6a6", + "version": "KqlParameterItem/1.0", + "name": "SourcePortData", + "type": 1, + "isRequired": false, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"let sourcePortData = VMConnection | where Direction == '{Direction}' | where '{Direction}' == 'inbound' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPort | extend MaliciousIpInfo = tostring(MaliciousIpInfo) | project-away Computer1, MaliciousIp, MaliciousPort, MaliciousPortIp, Process; {RemoteIpDataInbound}\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "e31a8d21-e24b-45ec-9806-e6c45bca15aa", + "version": "KqlParameterItem/1.0", + "name": "DestinationPortData", + "type": 1, + "isRequired": false, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"let destinationPortData = VMConnection | where Direction == '{Direction}' | where '{Direction}' == 'outbound' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', DestinationIp, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName, '-', DestinationIp), ComputerName = Computer | join kind=inner remoteIpData on $left.ParentKey == $right.Key | project-away Name1, Responses1, Type1, Key1, ParentKey1 | order by Name asc;\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "a54f3df8-c872-4a19-a280-84b203987ec8", + "version": "KqlParameterItem/1.0", + "name": "QueryProject", + "type": 1, + "isRequired": false, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"| extend MaliciousConnectionsCount = iff(MaliciousIpInfo == '', 0, iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', tolong(MaliciousIpInfo), 1)) | project ComputerName, ProcessName, RemoteIp, DestinationPort, Name = iff(Name == '🎫 ', '🎫 ', Name), Type, MaliciousConnections = iff(MaliciousIpInfo == '', '✅ No Malicious Connections', iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', iff(MaliciousConnectionsCount > 1, strcat('❌ ', MaliciousIpInfo, ' Malicious Connections'), strcat('❌ ', MaliciousIpInfo, ' Malicious Connection')), '❌ Malicious Connection')), Responses, MaxLinksLive, LinksFailed, AverageResponseTime, TotalBytesSent, TotalBytesReceived, Info = iff(MaliciousIpInfo != '', MaliciousIpInfo, ''), Key, ParentKey, TypeKey, MaliciousConnectionsCount | order by TypeKey asc, MaliciousConnectionsCount desc, LinksFailed desc, AverageResponseTime desc, Responses desc, MaxLinksLive desc, Name asc | project-away TypeKey\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "9789ead5-eae5-4f52-86c2-ac197da62f30", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process_IP_Port", + "type": 1, + "isRequired": false, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} {RemoteIpData} {DestinationPortData} {SourcePortData} let overalldata = VMConnection | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; computerData | union processData | union remoteIpData | union destinationPortData | union remoteIpDataInbound | union sourcePortData | union overalldata {QueryProject}\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "0d6a320e-2cef-44fd-ac0b-ad833f8d0c03", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process_IP", + "type": 1, + "isRequired": false, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} {RemoteIpData} {SourcePortData} let overalldata = VMConnection | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; computerData | union processData | union remoteIpData | union sourcePortData | union overalldata {QueryProject}\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "2de0d685-4382-4822-a8aa-f3583ff11b66", + "version": "KqlParameterItem/1.0", + "name": "QueryPadDestinationPortTable", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"let destinationPortPadding = datatable (DestinationPort: string) [];\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "df8a6322-511e-40e0-a258-fe717099a072", + "version": "KqlParameterItem/1.0", + "name": "QueryPadRemoteIpTable", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"let remoteIpPadding = datatable (RemoteIp: string) [];\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "e8f2c394-18e8-4d6d-8f5e-8453cb67128c", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process", + "type": 1, + "isRequired": false, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} let overalldata = VMConnection | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; {QueryPadDestinationPortTable} {QueryPadRemoteIpTable} computerData | union remoteIpPadding | union destinationPortPadding | union processData | union overalldata {QueryProject}\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "a4b0e146-7c89-40bb-ade2-ed2e392e9311", + "version": "KqlParameterItem/1.0", + "name": "Computer", + "type": 1, + "isRequired": false, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} let overalldata = VMConnection | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; {QueryPadDestinationPortTable} {QueryPadRemoteIpTable} {QueryPadProcessNameTable} computerData | union remoteIpPadding | union processNamePadding | union destinationPortPadding | union overalldata {QueryProject}\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "084fb5fc-e8e4-42df-8a9f-ac1001950ba2", + "version": "KqlParameterItem/1.0", + "name": "QueryPadProcessNameTable", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\":\\\"let processNamePadding = datatable (ProcessName: string) [];\\\"}\"}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "a08757da-e72b-474d-a1d2-65fb7020cc14", + "version": "KqlParameterItem/1.0", + "name": "FinalQuery", + "type": 1, + "isRequired": false, + "query": "print(strcat(\r\niff({Hierarchy} == 0, \"{Computer_Process_IP_Port}\", \r\niff({Hierarchy} == 1, \"{Computer_Process_IP}\",\r\niff({Hierarchy} == 2, \"{Computer_Process}\",\r\niff({Hierarchy} == 3, \"{Computer}\", \"{Computer}\")))),'{TableFilter:value}'));", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "874eeebe-2ea2-4c04-a3b9-ab3b30e95573", + "version": "KqlParameterItem/1.0", + "name": "ConnectionGrid", + "type": 1, + "isRequired": false, + "value": "{}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": null, + "name": "parameters - 3" + }, + { + "type": 1, + "content": { + "json": "💡 Select a row from the table below to view connection details for that entry." + }, + "conditionalVisibility": null, + "name": "text - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{FinalQuery:value}", + "size": 0, + "exportParameterName": "ConnectionGrid", + "showAnalytics": true, + "noDataMessage": "No data to be shown for this particular scope combination, please adjust the time range, table filters, etc.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Computer", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "ProcessName", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "RemoteIp", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "DestinationPort", + "formatter": 5, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Responses", + "formatter": 4, + "formatOptions": { + "palette": "blueDark" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "MaxLinksLive", + "formatter": 4, + "formatOptions": { + "palette": "lightBlue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "LinksFailed", + "formatter": 4, + "formatOptions": { + "palette": "red" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "AverageResponseTime", + "formatter": 4, + "formatOptions": { + "palette": "purple" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalBytesSent", + "formatter": 4, + "formatOptions": { + "palette": "orange" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalBytesReceived", + "formatter": 4, + "formatOptions": { + "palette": "green" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Info", + "formatter": 5, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info" + } + }, + { + "columnMatch": "Key", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "ParentKey", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "MaliciousConnectionsCount", + "formatter": 5, + "formatOptions": {} + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "idColumn": "Key", + "parentColumn": "ParentKey", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": false + } + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "KPIValue", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null, + "showPin": true, + "name": "query - 5" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "7e4c3d29-2be6-4288-903b-95502ddab577", + "version": "KqlParameterItem/1.0", + "name": "ComputerName", + "type": 1, + "isRequired": false, + "query": "// {Resource:label}\r\nlet row = dynamic({ConnectionGrid});\r\nlet computerName = row.ComputerName;\r\nprint computerName", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "3bda15ac-c4ea-487f-acf5-2c14c8d33038", + "version": "KqlParameterItem/1.0", + "name": "ProcessName", + "type": 1, + "isRequired": false, + "query": "// {Resource:label}\r\nlet row = dynamic({ConnectionGrid});\r\nlet ProcessName = row.ProcessName;\r\nprint ProcessName", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "e424020b-8c6e-4a06-9639-ed696192442a", + "version": "KqlParameterItem/1.0", + "name": "RemoteIp", + "type": 1, + "isRequired": false, + "query": "// {Resource:label}\r\nlet row = dynamic({ConnectionGrid});\r\nlet RemoteIp = row.RemoteIp;\r\nprint RemoteIp", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "a479367c-f99b-4c93-b18c-51f07ce5069d", + "version": "KqlParameterItem/1.0", + "name": "DestinationPort", + "type": 1, + "isRequired": false, + "query": "// {Resource:label}\r\nlet row = dynamic({ConnectionGrid});\r\nlet destinationPort = row.DestinationPort;\r\nprint destinationPort", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "dcf5f274-fbbf-4fb8-8c35-6b528a08cac9", + "version": "KqlParameterItem/1.0", + "name": "ShowDetail", + "type": 1, + "isRequired": true, + "query": "print(strcat('{ComputerName}{ProcessName}{RemoteIp}{DestinationPort}' != ''))", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "1ce27926-6842-497b-ac53-70c006e11231", + "version": "KqlParameterItem/1.0", + "name": "Heading", + "type": 1, + "isRequired": false, + "query": "// {Resource:label}\r\nprint(strcat('💻 {ComputerName}',iff('{ProcessName}' != '',' > 🎫 {ProcessName}',''),iff('{Direction}' == 'outbound',strcat(iff('{RemoteIp}' != '',' > 🌐 {RemoteIp}',''),iff('{DestinationPort}' != '',' > 🔸 {DestinationPort}','')),strcat(iff('{DestinationPort}' != '',' > 🔸 {DestinationPort}',''),iff('{RemoteIp}' != '',' > 🌐 {RemoteIp}','')))))", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "b44edb14-76ad-48b3-9921-b5dfb5a6db60", + "version": "KqlParameterItem/1.0", + "name": "QueryFilter", + "type": 1, + "isRequired": false, + "query": "// {Resource:label}\r\nprint(strcat(' where Computer == \"{ComputerName}\"',iff('{ProcessName}' != '', ' | where ProcessName == \"{ProcessName}\"', ''),iff('{RemoteIp}' != '',' | where RemoteIp == \"{RemoteIp}\"',''),iff('{DestinationPort}' != '',' | where DestinationPort == \"{DestinationPort}\"','')));", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": null, + "name": "parameters - 6" + }, + { + "type": 1, + "content": { + "json": "

{Heading}

" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "### Responses" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 8" + }, + { + "type": 1, + "content": { + "json": "### Latency" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 9" + }, + { + "type": 1, + "content": { + "json": "### Network" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 10" + }, + { + "type": 1, + "content": { + "json": "### Links" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 11" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// {Resource:label}\r\nlet SourceMachineData = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| {QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize Responses = sum(Responses) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// {Resource:label}\r\nlet SourceMachineData = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| {QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize P50 = percentiles(ResponseTimeSum, 50), P90 = percentiles(ResponseTimeSum, 90), P95 = percentiles(ResponseTimeSum, 95) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "aggregation": 3, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "visualization": "linechart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// {Resource:label}\r\nlet SourceMachineData = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| {QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize Sent = sum(BytesSent), Received = sum(BytesReceived) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 14" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// {Resource:label}\r\nlet SourceMachineData = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| {QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize MaxOpenPorts = max(LinksLive), SumFailed = sum(LinksFailed) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "aggregation": 3, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 15" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Virtual Machine Scale Sets - Network Dependencies/Workbooks/Connections Overview/settings.json b/Virtual Machine Scale Sets - Network Dependencies/Workbooks/Connections Overview/settings.json new file mode 100644 index 0000000..e756ee7 --- /dev/null +++ b/Virtual Machine Scale Sets - Network Dependencies/Workbooks/Connections Overview/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Connections Overview", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.compute/virtualmachinescalesets", "order": 175 }, + { "type": "insights", "resourceType": "microsoft.compute/virtualmachinescalesets", "order": 175 } + ] +} diff --git a/Virtual Machine Scale Sets - Network Dependencies/Workbooks/categoryResources.json b/Virtual Machine Scale Sets - Network Dependencies/Workbooks/categoryResources.json new file mode 100644 index 0000000..0e547f5 --- /dev/null +++ b/Virtual Machine Scale Sets - Network Dependencies/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Network Dependencies", "description": "Look for network dependencies of your Virtual Machine Scale Sets.", "order": 200} +} diff --git a/Virtual Machine Scale Sets - Performance Analysis/Alerts/README b/Virtual Machine Scale Sets - Performance Analysis/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Virtual Machine Scale Sets - Performance Analysis/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Virtual Machine Scale Sets - Performance Analysis/Queries/README b/Virtual Machine Scale Sets - Performance Analysis/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Virtual Machine Scale Sets - Performance Analysis/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis (Perf)/Performance Analysis (Perf).workbook b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis (Perf)/Performance Analysis (Perf).workbook new file mode 100644 index 0000000..b6f0c01 --- /dev/null +++ b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis (Perf)/Performance Analysis (Perf).workbook @@ -0,0 +1,1479 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "value::selected" + ], + "parameters": [ + { + "id": "688dc7cb-bea3-41ae-ae94-32d22e09568c", + "version": "KqlParameterItem/1.0", + "name": "Resource", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachinescalesets": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": null + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "_", + "comparison": "isEqualTo", + "value": "_" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "# Performance Analysis" + }, + "conditionalVisibility": { + "parameterName": "ContextFree", + "comparison": "isEqualTo", + "value": "value::1" + }, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Resource}" + ], + "parameters": [ + { + "id": "5f8cce4b-9c4c-47da-8683-7e5ccc9faed3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": false, + "value": { + "durationMs": 1800000 + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "d6de19ff-cde4-41c2-9fba-b441312ea5c9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "type": 1, + "isRequired": false, + "query": "Perf\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": null, + "name": "parameters - 2" + }, + { + "type": 1, + "content": { + "json": "⚠ This workbook requires [Azure Monitor for VMs (preview)](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview) enabled in order to show accurate and complete information for your VMs. Follow the link to onboard machines or select a different workspace." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": null + }, + "name": "text - 3" + }, + { + "type": 1, + "content": { + "json": "---" + }, + "conditionalVisibility": null, + "name": "text - 4" + }, + { + "type": 1, + "content": { + "json": "

Top 100 Machines

" + }, + "conditionalVisibility": null, + "name": "text - 5" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Resource}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "description": "Select a VM performance counter for the table below", + "isRequired": false, + "query": "// {Resource} {Test}\r\nPerf\r\n| where TimeGenerated {TimeRange}\r\n| where ObjectName != 'Network' and ObjectName != 'Network Interface'\r\n| summarize by CounterName, ObjectName, CounterText = CounterName\r\n| order by ObjectName asc, CounterText asc\r\n| project Counter = pack('counter', CounterName, 'object', ObjectName), CounterText, group = ObjectName", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "974d5ac2-4fc5-48e7-a8f7-16fc9dddc4ac", + "version": "KqlParameterItem/1.0", + "name": "CounterText", + "type": 1, + "isRequired": false, + "query": "let metric = dynamic({Counter});\r\nrange Steps from 1 to 1 step 1\r\n| project strcat(metric.object, \" > \", metric.counter)", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "ce228deb-88eb-4438-9dce-6c6d1972ff09", + "version": "KqlParameterItem/1.0", + "name": "IsNetworkCounter", + "type": 1, + "isRequired": false, + "query": "let counter = dynamic({Counter});\r\nprint tostring(counter.object == 'Network Adapter')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "3b23aa7a-2afd-40ba-a710-0e2cc73c764b", + "version": "KqlParameterItem/1.0", + "name": "NetworkDirection", + "type": 1, + "isRequired": false, + "query": "let metric = dynamic({Counter});\r\nprint(iff(metric.counter == 'Bytes Received/sec', 'Received', 'Sent'))", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "9ad8858d-8ef3-4144-94b1-66a8bf9fa9c9", + "version": "KqlParameterItem/1.0", + "name": "Aggregators", + "type": 2, + "description": "Select one or more different aggregates to display in the table below", + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th\", \"label\":\"P95th\", \"selected\": true },\r\n { \"value\":\"Min\", \"label\":\"Min\", \"selected\": false },\r\n { \"value\":\"Max\", \"label\":\"Max\", \"selected\": true }\r\n]", + "timeContextFromParameter": null + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TableTrend", + "type": 2, + "description": "Select a percentile to display in the Trend column in the table below", + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\": false }\r\n]", + "timeContextFromParameter": null + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "tableTrendOrder", + "type": 1, + "isRequired": false, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{TableTrend}' contains 'P5th' or '{TableTrend}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "c2f05b6d-970d-4fde-88b0-868387c02250", + "version": "KqlParameterItem/1.0", + "name": "mergedAggregators", + "type": 1, + "isRequired": false, + "query": "let aggregators = iff('{Aggregators}' contains '{TableTrend:label}', '{Aggregators}', '{Aggregators},{TableTrend:label}');\r\nrange Steps from 1 to 1 step 1\r\n| project aggregators", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "69c79551-68b9-4c84-bf57-202540482a02", + "version": "KqlParameterItem/1.0", + "name": "ShowTable", + "type": 1, + "isRequired": false, + "query": "print iff(\"{Test:value}\" == \"\", \"False\", iff(\"{IsNetworkCounter:value}\" == \"False\", \"True\", \"False\"))", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "6b664a24-d9a3-47b0-9d94-9cada9ddb8ce", + "version": "KqlParameterItem/1.0", + "name": "ShowNetworkTable", + "type": 1, + "isRequired": false, + "query": "print iff(\"{Test:value}\" == \"\", \"False\", \"{IsNetworkCounter:value}\")", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "343c4eae-e482-4678-a936-c4ad43b2ec19", + "version": "KqlParameterItem/1.0", + "name": "CounterTest", + "type": 1, + "isRequired": false, + "query": "Perf\r\n| take 1", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "parameters - 6" + }, + { + "type": 1, + "content": { + "json": "There are no performance counters, either onboard machines to this workspace or enable performance counters." + }, + "conditionalVisibility": { + "parameterName": "CounterTest", + "comparison": "isEqualTo", + "value": "" + }, + "name": "text - 7" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// {Resource} {Test}\r\nlet metric = dynamic({Counter}); \r\nlet maxResultCount = 100; let summaryPerComputer = totable(Perf | where TimeGenerated {TimeRange} | where ObjectName == metric.object and CounterName == metric.counter | summarize hint.shufflekey = Computer Average = avg(CounterValue), Max = max(CounterValue), Min = min(CounterValue), percentiles(CounterValue, 5, 10, 50, 80, 90, 95) by Computer | project Computer, Average, Max, Min, P5th = percentile_CounterValue_5, P10th = percentile_CounterValue_10, P50th = percentile_CounterValue_50, P80th = percentile_CounterValue_80, P90th = percentile_CounterValue_90, P95th = percentile_CounterValue_95 | order by {TableTrend:label} {tableTrendOrder}, Computer | limit maxResultCount); let computerList = summaryPerComputer | project Computer; let MachineSummary = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | project Computer, MachineSummary = pack('Fully Qualified Domain Name', Computer, 'OS Type', OperatingSystemFamily_s, 'Operating System', OperatingSystemFullName_s, 'Ipv4 Addresses', Ipv4Addresses_s, 'Ipv6 Addresses', Ipv6Addresses_s, 'Mac Addresses', MacAddresses_s, 'DNS Names', DnsNames_s, 'CPUs', strcat(Cpus_d, ' @ ', CpuSpeed_d, ' MHz'), 'Bitness', Bitness_s, 'Physcial Memory', strcat(PhysicalMemory_d, ' MB'), 'Virtualization State', VirtualizationState_s, 'VM Type', VirtualMachineType_s, 'OMS Agent', split(ResourceName_s, 'm-')[1]); let EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) []; let OmsNodeIdentityAndProps = computerList | extend NodeId = Computer | extend Priority = 1 | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer); let ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2; let NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps | summarize arg_max(Priority, *) by Computer; let NodeIdentityAndPropsMin = NodeIdentityAndProps | extend Type = iff(NodeProps.type == 'StandAloneNode', iff(NodeProps.azureResourceId == '', 'Non-Azure Virtual Machine', 'Azure Virtual Machine'), NodeProps.type), ResourceId = iff(NodeProps.type == 'AzureScaleSetNode', NodeProps.vmScaleSetResourceId, iff(NodeProps.type == 'AzureCloudServiceNode', NodeProps.cloudServiceDeploymentId, Computer)), ResourceName = iff(NodeProps.type == 'AzureScaleSetNode', strcat(NodeProps.vmScaleSetName, ' | ', NodeProps.scaleSetInstanceId), iff(NodeProps.type == 'AzureCloudServiceNode', strcat(NodeProps.cloudServiceRoleName, ' | ', NodeProps.cloudServiceInstanceId), Computer)) | project Computer, Type, ResourceId, ResourceName; let trend = Perf | where TimeGenerated {TimeRange} | where Computer in (computerList) | where ObjectName == metric.object and CounterName == metric.counter | make-series {TableTrend} default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Computer | project Computer, ['Trend ({TableTrend:label})'] = {TableTrend:label}; summaryPerComputer | join kind=leftouter (trend) on Computer | join kind=leftouter (NodeIdentityAndProps) on Computer | join kind=leftouter (NodeIdentityAndPropsMin) on Computer | join kind=leftouter (MachineSummary) on Computer | project ResourceName, Type, {mergedAggregators}, ['Trend ({TableTrend:label})'], Properties = MachineSummary | sort by {TableTrend:label} {tableTrendOrder} | limit maxResultCount", + "size": 0, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Average", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P50th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (Average)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Properties", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info" + } + }, + { + "columnMatch": "P95th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P5th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P10th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P80th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P90th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Min", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Max", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (P95th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P5th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P90th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P80th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P50th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P10th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "ShowTable", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 8" + }, + { + "type": 1, + "content": { + "json": "#### ℹ `Total Bytes {NetworkDirection}` counters are also being utilized to display the network table. The delta of `Total Bytes {NetworkDirection}` over a time period is being calculated to match up with the `Bytes {NetworkDirection}/sec` counter to display an accurate representation of network activity over all machines" + }, + "conditionalVisibility": { + "parameterName": "ShowNetworkTable", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "text - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// {Resource} {Test}\r\nlet timeRangeStart = {TimeRange:start};\r\nlet timeRangeEnd = {TimeRange:end};\r\nlet timeRangeGrain = {TimeRange:grain}; \r\nlet maxResultCount = 100; \r\nlet linuxMetric = iff('{NetworkDirection}' == 'Received', dynamic({'object': 'Network', 'counter': 'Total Bytes Received'}), dynamic({'object': 'Network', 'counter': 'Total Bytes Transmitted'}));\r\nlet windowsMetric = iff('{NetworkDirection}' == 'Received', dynamic({\"counter\":\"Bytes Received/sec\",\"object\":\"Network Adapter\"}), dynamic({\"counter\":\"Bytes Sent/sec\",\"object\":\"Network Adapter\"}));\r\nlet Network = materialize(Perf \r\n| where TimeGenerated {TimeRange} \r\n| where ObjectName == linuxMetric.object and CounterName == linuxMetric.counter \r\n| extend ComputerId = iff(isempty(_ResourceId), Computer, _ResourceId) \r\n| order by CounterName asc, InstanceName, ComputerId asc, TimeGenerated asc \r\n| extend prev_ComputerId=prev(ComputerId), prev_Value=prev(CounterValue), prev_t=prev(TimeGenerated), prev_instance=prev(InstanceName) \r\n| project TimeGenerated, ComputerId, Computer, _ResourceId, cValue = iff(prev_ComputerId == ComputerId and prev_instance == InstanceName and CounterValue >= prev_Value and TimeGenerated > prev_t, (CounterValue-prev_Value)/((TimeGenerated-prev_t)/1s), real(0)) \r\n| summarize CounterValue = sum(cValue) by ComputerId, Computer, _ResourceId, bin(TimeGenerated, 2s) \r\n| union (Perf \r\n| where TimeGenerated {TimeRange} \r\n| where ObjectName == windowsMetric.object and CounterName == windowsMetric.counter \r\n| extend ComputerId = iff(isempty(_ResourceId), Computer, _ResourceId)) \r\n| summarize CounterValue = sum(CounterValue) by ComputerId, Computer, _ResourceId, bin(TimeGenerated, 2s)); \r\nlet summaryPerComputer = totable(Network \r\n| summarize hint.shufflekey = ComputerId Average = avg(CounterValue), Max = max(CounterValue), percentiles(CounterValue, 50, 90, 95) by ComputerId, Computer, _ResourceId \r\n| project ComputerId, Computer, Average, Max, P50th = percentile_CounterValue_50, P90th = percentile_CounterValue_90, P95th = percentile_CounterValue_95, ResourceId = _ResourceId \r\n| order by {TableTrend:label} {tableTrendOrder}, Computer \r\n| limit maxResultCount); \r\nlet computerList = summaryPerComputer \r\n| project ComputerId, Computer;\r\nlet MachineSummary = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | extend ComputerId = iff(isempty(_ResourceId), Computer, _ResourceId) | where ComputerId in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | project Computer, MachineSummary = pack('Fully Qualified Domain Name', Computer, 'OS Type', OperatingSystemFamily_s, 'Operating System', OperatingSystemFullName_s, 'Ipv4 Addresses', Ipv4Addresses_s, 'Ipv6 Addresses', Ipv6Addresses_s, 'Mac Addresses', MacAddresses_s, 'DNS Names', DnsNames_s, 'CPUs', strcat(Cpus_d, ' @ ', CpuSpeed_d, ' MHz'), 'Bitness', Bitness_s, 'Physcial Memory', strcat(PhysicalMemory_d, ' MB'), 'Virtualization State', VirtualizationState_s, 'VM Type', VirtualMachineType_s, 'OMS Agent', split(ResourceName_s, 'm-')[1]); let EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) []; let OmsNodeIdentityAndProps = computerList | extend NodeId = Computer | extend Priority = 1 | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer); let ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2; let NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps | summarize arg_max(Priority, *) by Computer; let NodeIdentityAndPropsMin = NodeIdentityAndProps | extend Type = iff(NodeProps.type == 'StandAloneNode', iff(NodeProps.azureResourceId == '', 'Non-Azure Virtual Machine', 'Azure Virtual Machine'), NodeProps.type), ResourceId = iff(NodeProps.type == 'AzureScaleSetNode', NodeProps.vmScaleSetResourceId, iff(NodeProps.type == 'AzureCloudServiceNode', NodeProps.cloudServiceDeploymentId, Computer)), ResourceName = iff(NodeProps.type == 'AzureScaleSetNode', strcat(NodeProps.vmScaleSetName, ' | ', NodeProps.scaleSetInstanceId), iff(NodeProps.type == 'AzureCloudServiceNode', strcat(NodeProps.cloudServiceRoleName, ' | ', NodeProps.cloudServiceInstanceId), Computer)) | project Computer, Type, ResourceId, ResourceName; \r\nlet trend = Network \r\n| where ComputerId in (computerList) \r\n| summarize hint.shufflekey = ComputerId {TableTrend} by ComputerId, Computer, bin(TimeGenerated, timeRangeGrain) \r\n| project ComputerId, Computer, {TableTrend:label} \r\n| summarize hint.shufflekey = ComputerId trendList = makelist({TableTrend:label}) by ComputerId, Computer; \r\nsummaryPerComputer \r\n| join (trend) on Computer \r\n| join (NodeIdentityAndProps) on Computer \r\n| join kind=leftouter (NodeIdentityAndPropsMin) on Computer \r\n| join kind=leftouter (MachineSummary) on Computer\r\n| project ResourceName, Type, {mergedAggregators}, ['Trend ({TableTrend:label})'] = trendList, Properties = MachineSummary\r\n| sort by {TableTrend:label} {tableTrendOrder} | limit maxResultCount", + "size": 0, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "P95th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Average", + "formatter": 1, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P10th", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P50th", + "formatter": 1, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (P95th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Properties", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "️️️ℹ Info" + } + }, + { + "columnMatch": "P5th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P80th", + "formatter": 1, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P90th", + "formatter": 1, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Min", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Max", + "formatter": 1, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (P5th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P90th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P80th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P50th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P10th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (Average)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "ShowNetworkTable", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 10" + }, + { + "type": 1, + "content": { + "json": "---\r\n## Top 10 Machines" + }, + "conditionalVisibility": null, + "name": "text - 11" + }, + { + "type": 1, + "content": { + "json": "### CPU Utilization %" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "text - 12" + }, + { + "type": 1, + "content": { + "json": "### Available Memory" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "text - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Resource}" + ], + "parameters": [ + { + "id": "92358ae0-d5e1-494b-b65b-6d904f1325c5", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(CounterValue, 95), 2)", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "timeContextFromParameter": null + }, + { + "id": "27345375-4376-4e2f-8ac4-59d4eab9d235", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "isRequired": false, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "4d9ba0ec-9d22-4fec-9f85-4be334f42d91", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "50242f48-6c7d-449b-ad93-838c94e615a0", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "parameters - 14" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Resource}" + ], + "parameters": [ + { + "id": "333837c2-d5a4-4173-9aad-3db1dca17e2a", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(CounterValue, 95), 2)", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "timeContextFromParameter": null + }, + { + "id": "a23b29a5-5e4a-4d8e-ba73-bfdf27b2980e", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "isRequired": false, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "cc8dfabc-9eb9-4227-97bb-f5e9319030ec", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "ff7a79ff-742a-4c6e-8628-c52f45b3bf71", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "parameters - 15" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let cpuSummary=totable(Perf\r\n | where TimeGenerated {TimeRange} \r\n | where (ObjectName == 'Processor' and InstanceName == '_Total' and CounterName == '% Processor Time')\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, CounterName\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where (ObjectName == 'Processor' and InstanceName == '_Total' and CounterName == '% Processor Time')\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "query - 16" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(Perf\r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == 'Memory' and CounterName in ('Available MBytes', 'Available MBytes Memory')\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, CounterName\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where ObjectName == 'Memory' and CounterName in ('Available MBytes', 'Available MBytes Memory')\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "query - 17" + }, + { + "type": 1, + "content": { + "json": "### Bytes Sent Rate" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "### Bytes Received Rate" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "text - 19" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Resource}" + ], + "parameters": [ + { + "id": "360da4c1-97fa-4b15-a008-33a6110d0acd", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(CounterValue, 95), 2)", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "timeContextFromParameter": null + }, + { + "id": "31ccd4a1-d626-44bb-a5de-1780a33b37a5", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "isRequired": false, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "4765abab-a682-49f6-bb41-d64852aba192", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "1d9b0ea9-09d4-4c73-8e59-fa7ab760b880", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "parameters - 20" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Resource}" + ], + "parameters": [ + { + "id": "6772b281-d17d-4293-a227-1b2ed67f399e", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(CounterValue, 95), 2)", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "timeContextFromParameter": null + }, + { + "id": "5e2eef28-0528-406f-86b5-ceae535455f9", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "isRequired": false, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "586fa51c-1a45-4602-adcb-62eb0f619b7f", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "912085b6-f920-4a37-9ce3-f1ef86bd5df8", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "parameters - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let linuxNetworkSend=Perf \r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == 'Network' and CounterName == 'Total Bytes Transmitted'\r\n | order by CounterName asc, InstanceName, Computer asc, TimeGenerated asc\r\n | extend prev_Computer=prev(Computer), prev_Value=prev(CounterValue), prev_t=prev(TimeGenerated), prev_counter=prev(CounterName), prev_instance=prev(InstanceName)\r\n | project TimeGenerated, Computer, CounterValue = iff(prev_Computer == Computer and prev_instance == InstanceName and prev_counter == CounterName and CounterValue >= prev_Value and TimeGenerated > prev_t, (CounterValue-prev_Value)/((TimeGenerated-prev_t)/1s), real(0))\r\n | summarize hint.shufflekey=Computer CounterValue = sum(CounterValue) by Computer, bin(TimeGenerated, 2s);\r\nlet windowsNetworkSend = Perf \r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == 'Network Adapter' and CounterName == 'Bytes Sent/sec'\r\n | summarize hint.shufflekey=Computer CounterValue = sum(CounterValue) by Computer, bin(TimeGenerated, 2s);\r\nlet networkDataSend = union linuxNetworkSend, windowsNetworkSend;\r\nlet networkSendSummary = totable(networkDataSend\r\n | where TimeGenerated {TimeRange}\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(networkSendSummary | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nnetworkDataSend\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "query - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let linuxNetworkReceive=Perf \r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == 'Network' and CounterName == 'Total Bytes Received'\r\n | order by CounterName asc, InstanceName, Computer asc, TimeGenerated asc\r\n | extend prev_Computer=prev(Computer), prev_Value=prev(CounterValue), prev_t=prev(TimeGenerated), prev_counter=prev(CounterName), prev_instance=prev(InstanceName)\r\n | project TimeGenerated, Computer, CounterValue = iff(prev_Computer == Computer and prev_instance == InstanceName and prev_counter == CounterName and CounterValue >= prev_Value and TimeGenerated > prev_t, (CounterValue-prev_Value)/((TimeGenerated-prev_t)/1s), real(0))\r\n | summarize hint.shufflekey=Computer CounterValue = sum(CounterValue) by Computer, bin(TimeGenerated, 2s);\r\nlet windowsNetworkReceive = Perf \r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == 'Network Adapter' and CounterName == 'Bytes Received/sec'\r\n | summarize hint.shufflekey=Computer CounterValue = sum(CounterValue) by Computer, bin(TimeGenerated, 2s);\r\nlet networkDataReceive = union linuxNetworkReceive, windowsNetworkReceive;\r\nlet networkReceiveSummary = totable(networkDataReceive\r\n | where TimeGenerated {TimeRange}\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(networkReceiveSummary | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nnetworkDataReceive\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "query - 23" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk Space Used %" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "text - 24" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "text - 25" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Resource}" + ], + "parameters": [ + { + "id": "5d6afbec-79f6-4cd1-b3a1-361503478304", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(CounterValue, 95), 2)", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "timeContextFromParameter": null + }, + { + "id": "1d5a805c-acce-4afe-a38b-c2740fb3ff26", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrder", + "type": 1, + "isRequired": false, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "parameters - 26" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "text - 27" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let diskSummary=totable(Perf\r\n | where TimeGenerated {TimeRange} \r\n | where (ObjectName == 'LogicalDisk' and InstanceName != '_Total' and CounterName in ('% Free Space')) or (ObjectName == 'Logical Disk' and InstanceName != '_Total' and CounterName in ('% Used Space'))\r\n | project TimeGenerated, Computer, CounterName = '% Used Space', CounterValue = case(ObjectName == 'LogicalDisk' and CounterName == '% Free Space', 100 - CounterValue, CounterValue < 0, real(0), CounterValue)\r\n | summarize hint.shufflekey=Computer {Aggregate} by Computer, CounterName\r\n | top 10 by {Aggregate:label} {aggregateOrder});\r\nlet computerList=(diskSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where (ObjectName == 'LogicalDisk' and InstanceName != '_Total' and CounterName in ('% Free Space')) or (ObjectName == 'Logical Disk' and InstanceName != '_Total' and CounterName in ('% Used Space'))\r\n | where Computer in (computerList)\r\n | project TimeGenerated, Computer, CounterName = '% Used Space', CounterValue = case(ObjectName == 'LogicalDisk' and CounterName == '% Free Space', 100 - CounterValue, CounterValue < 0, real(0), CounterValue)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {Aggregate} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "query - 28" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis (Perf)/settings.json b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis (Perf)/settings.json new file mode 100644 index 0000000..6d8881b --- /dev/null +++ b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis (Perf)/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.compute/virtualmachinescalesets", "categoryKey": "vmInsightsVirtualMachinesPerf", "order": 200 }, + { "type": "insights", "resourceType": "microsoft.compute/virtualmachinescalesets", "categoryKey": "vmInsightsVirtualMachinesPerf", "order": 200 } + ] +} diff --git a/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis (Preview)/Performance Analysis (Preview).workbook b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis (Preview)/Performance Analysis (Preview).workbook new file mode 100644 index 0000000..b8d377d --- /dev/null +++ b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis (Preview)/Performance Analysis (Preview).workbook @@ -0,0 +1,1404 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "688dc7cb-bea3-41ae-ae94-32d22e09568c", + "version": "KqlParameterItem/1.0", + "name": "DefaultResource", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachinescalesets": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "bbbc300a-6f91-4b2b-b4b5-842b4bf8577a", + "version": "KqlParameterItem/1.0", + "name": "Selection", + "type": 1, + "query": "where type =~ 'microsoft.compute/virtualmachinescalesets'\r\n| extend match = id =~ \"{DefaultResource}\"\r\n| order by match desc, name asc\r\n| take 1\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "_", + "comparison": "isEqualTo", + "value": "_" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "# Performance Analysis" + }, + "conditionalVisibility": { + "parameterName": "ContextFree", + "comparison": "isEqualTo", + "value": "value::1" + }, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resource}" + ], + "parameters": [ + { + "id": "1db5ee15-fe52-458b-91d1-7ee39d8c2cd3", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "summarize by subscriptionId\r\n| project value = strcat('/subscriptions/', subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ todynamic('{Selection}').sub, true, false)", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "9732eff8-fb57-4cbd-8ade-5ae746f33760", + "version": "KqlParameterItem/1.0", + "name": "Resource", + "label": "Virtual Machine Scale Set", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.compute/virtualmachinescalesets'\r\n| summarize by id, name\r\n| project id, selected = iff(id =~ todynamic('{Selection}').ws, true, false)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "5f8cce4b-9c4c-47da-8683-7e5ccc9faed3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "label": "Time Range" + }, + { + "id": "d6de19ff-cde4-41c2-9fba-b441312ea5c9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "type": 1, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| take 1", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "name": "parameters - 2" + }, + { + "type": 1, + "content": { + "json": "⚠ A subscription has not yet been selected. Select a subscription under the `Subscriptions` dropdown or refresh the workbook." + }, + "conditionalVisibility": { + "parameterName": "Subscriptions", + "comparison": "isEqualTo", + "value": null + }, + "name": "text - 29" + }, + { + "type": 1, + "content": { + "json": "⚠ No performance counters were detected in the selected workspace for the specified time period (`{TimeRange:label}`). Either try a broader time range, select a different workspace, or onboard virtual machines to the selected workspace `{Workspaces:label}`.\r\n\r\nIf you choose to onboard virtual machines to workspace `{Workspaces:label}`, follow the instruction in the following link: [Azure Monitor for VMs (preview)](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview)." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": null + }, + "name": "text - 3" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Top 100 Machines", + "subTarget": "top100", + "style": "link" + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Top 10 Machines", + "subTarget": "top10", + "style": "link" + } + ] + }, + "name": "links - 28" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resource}" + ], + "parameters": [ + { + "id": "41bb3710-5e9e-4b66-91fd-e11435899880", + "version": "KqlParameterItem/1.0", + "name": "ComputerNameContains", + "label": "Computer Name Contains", + "type": 1, + "description": "This will filter the computers whose name contains the keyword. This will query all the machines in the workspace.", + "value": "" + }, + { + "id": "b533865a-3539-42b1-8dcd-33ca0d481c2a", + "version": "KqlParameterItem/1.0", + "name": "ComputerFilter", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\": \\\"| where Computer contains '{ComputerNameContains}'\\\"}\"}", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "description": "Select a VM performance counter for the table below", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Namespace, Name, CounterText = Name\r\n| order by Name asc, Namespace asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resource}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "974d5ac2-4fc5-48e7-a8f7-16fc9dddc4ac", + "version": "KqlParameterItem/1.0", + "name": "CounterText", + "type": 1, + "query": "let metric = dynamic({Counter});\r\nrange Steps from 1 to 1 step 1\r\n| project strcat(metric.object, \" > \", metric.counter)", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "9ad8858d-8ef3-4144-94b1-66a8bf9fa9c9", + "version": "KqlParameterItem/1.0", + "name": "Aggregators", + "type": 2, + "description": "Select one or more different aggregates to display in the table below", + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th\", \"label\":\"P95th\", \"selected\": true },\r\n { \"value\":\"Min\", \"label\":\"Min\", \"selected\": false },\r\n { \"value\":\"Max\", \"label\":\"Max\", \"selected\": true }\r\n]" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TableTrend", + "type": 2, + "description": "Select a percentile to display in the Trend column in the table below", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\": false }\r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "tableTrendOrder", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TableTrend contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TableTrend", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TableTrend contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TableTrend", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "6868a13a-498e-4c1b-80c2-8c44b3427126", + "version": "KqlParameterItem/1.0", + "name": "tableTrendLabel", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TableTrend:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "c2f05b6d-970d-4fde-88b0-868387c02250", + "version": "KqlParameterItem/1.0", + "name": "mergedAggregators", + "type": 1, + "value": "Average", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregators contains tableTrendLabel), result = Aggregators", + "criteriaContext": { + "leftOperand": "Aggregators", + "operator": "contains", + "rightValType": "param", + "rightVal": "tableTrendLabel", + "resultValType": "param", + "resultVal": "Aggregators" + } + }, + { + "condition": "else result = '{Aggregators},{tableTrendLabel}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{Aggregators},{tableTrendLabel}" + } + } + ] + }, + { + "id": "27faa340-a75f-4ae1-a43a-1aa6ece37cff", + "version": "KqlParameterItem/1.0", + "name": "StandardQuery", + "type": 1, + "query": "let metric = dynamic({Counter}); \r\nlet timeRangeStart = {TimeRange:start};\r\nlet timeRangeEnd = {TimeRange:end};\r\nlet timeRangeGrain = {TimeRange:grain};\r\nprint(strcat(\"let maxResultCount = 100; let metric = dynamic(\", metric, \"); let summaryPerComputer = totable(InsightsMetrics | where TimeGenerated {TimeRange} {ComputerFilter} | where Namespace == metric.object and Name == metric.counter | summarize hint.shufflekey = Computer Average = avg(Val), Max = max(Val), Min = min(Val), percentiles(Val, 5, 10, 50, 80, 90, 95) by Computer | project Computer, Average, Max, Min, P5th = percentile_Val_5, P10th = percentile_Val_10, P50th = percentile_Val_50, P80th = percentile_Val_80, P90th = percentile_Val_90, P95th = percentile_Val_95 | order by {TableTrend:label} {tableTrendOrder}, Computer | limit maxResultCount); let computerList = summaryPerComputer | project Computer; let MachineSummary = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | project Computer, MachineSummary = pack('Fully Qualified Domain Name', Computer, 'OS Type', OperatingSystemFamily_s, 'Operating System', OperatingSystemFullName_s, 'Ipv4 Addresses', Ipv4Addresses_s, 'Ipv6 Addresses', Ipv6Addresses_s, 'Mac Addresses', MacAddresses_s, 'DNS Names', DnsNames_s, 'CPUs', strcat(Cpus_d, ' @ ', CpuSpeed_d, ' MHz'), 'Bitness', Bitness_s, 'Physcial Memory', strcat(PhysicalMemory_d, ' MB'), 'Virtualization State', VirtualizationState_s, 'VM Type', VirtualMachineType_s, 'OMS Agent', split(ResourceName_s, 'm-')[1]); let EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) []; let OmsNodeIdentityAndProps = computerList | extend NodeId = Computer | extend Priority = 1 | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer); let ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2; let NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps | summarize arg_max(Priority, *) by Computer; let NodeIdentityAndPropsMin = NodeIdentityAndProps | extend Type = iff(NodeProps.type == 'StandAloneNode', iff(NodeProps.azureResourceId == '', 'Non-Azure Virtual Machine', 'Azure Virtual Machine'), NodeProps.type), ResourceId = iff(NodeProps.type == 'AzureScaleSetNode', NodeProps.vmScaleSetResourceId, iff(NodeProps.type == 'AzureCloudServiceNode', NodeProps.cloudServiceDeploymentId, Computer)), ResourceName = iff(NodeProps.type == 'AzureScaleSetNode', strcat(NodeProps.vmScaleSetName, ' | ', NodeProps.scaleSetInstanceId), iff(NodeProps.type == 'AzureCloudServiceNode', strcat(NodeProps.cloudServiceRoleName, ' | ', NodeProps.cloudServiceInstanceId), Computer)) | project Computer, Type, ResourceId, ResourceName; let trend = InsightsMetrics | where TimeGenerated {TimeRange} | where Computer in (computerList) | where Namespace == metric.object and Name == metric.counter | make-series {TableTrend} default = 0 on TimeGenerated in range(datetime('\", timeRangeStart,\"'), datetime('\", timeRangeEnd ,\"'), totimespan('\", timeRangeGrain, \"')) by Computer | project Computer, ['Trend ({TableTrend:label})'] = {TableTrend:label}; summaryPerComputer | join kind=leftouter (trend) on Computer | join kind=leftouter (NodeIdentityAndProps) on Computer | join kind=leftouter (NodeIdentityAndPropsMin) on Computer | join kind=leftouter (MachineSummary) on Computer | project ResourceName, Type, {mergedAggregators}, ['Trend ({TableTrend:label})'], Properties = MachineSummary | sort by {TableTrend:label} {tableTrendOrder}\"));\r\n", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "69c79551-68b9-4c84-bf57-202540482a02", + "version": "KqlParameterItem/1.0", + "name": "ShowTable", + "type": 1, + "query": "print iff(\"{Test:value}\" == \"\", \"False\", \"True\")", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibilities": [ + { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + } + ], + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "parameters - 6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{StandardQuery}", + "size": 0, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Average", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P50th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (Average)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Properties", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info" + } + }, + { + "columnMatch": "P95th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P5th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P10th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P80th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P90th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Min", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Max", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (P95th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P5th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P90th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P80th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P50th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P10th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowTable", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + } + ], + "conditionalVisibility": { + "parameterName": "ShowTable", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 8" + }, + { + "type": 1, + "content": { + "json": "### CPU Utilization %" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 12" + }, + { + "type": 1, + "content": { + "json": "### Available Memory" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "92358ae0-d5e1-494b-b65b-6d904f1325c5", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "27345375-4376-4e2f-8ac4-59d4eab9d235", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "4d9ba0ec-9d22-4fec-9f85-4be334f42d91", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "50242f48-6c7d-449b-ad93-838c94e615a0", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 14" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "333837c2-d5a4-4173-9aad-3db1dca17e2a", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P5th = round(percentile(Val, 5), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "a23b29a5-5e4a-4d8e-ba73-bfdf27b2980e", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "cc8dfabc-9eb9-4227-97bb-f5e9319030ec", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "ff7a79ff-742a-4c6e-8628-c52f45b3bf71", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 15" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 1, + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 16" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'Memory' and Name == 'AvailableMB'\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, Name\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'Memory' and Name == 'AvailableMB'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 4, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 17" + }, + { + "type": 1, + "content": { + "json": "### Bytes Sent Rate" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "### Bytes Received Rate" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 19" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "360da4c1-97fa-4b15-a008-33a6110d0acd", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "31ccd4a1-d626-44bb-a5de-1780a33b37a5", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "4765abab-a682-49f6-bb41-d64852aba192", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "1d9b0ea9-09d4-4c73-8e59-fa7ab760b880", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 20" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "6772b281-d17d-4293-a227-1b2ed67f399e", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "5e2eef28-0528-406f-86b5-ceae535455f9", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "586fa51c-1a45-4602-adcb-62eb0f619b7f", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "912085b6-f920-4a37-9ce3-f1ef86bd5df8", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, Name\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 23" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk Space Used %" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 24" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 25" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5d6afbec-79f6-4cd1-b3a1-361503478304", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "1d5a805c-acce-4afe-a38b-c2740fb3ff26", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrder", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 26" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 27" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n\t| extend Val = 100 - Val\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n\t| extend Val = 100 - Val\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 1, + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 28" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis (Preview)/settings.json b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis (Preview)/settings.json new file mode 100644 index 0000000..1ccb8f0 --- /dev/null +++ b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis (Preview)/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "insights", "resourceType": "microsoft.compute/virtualmachinescalesets", "categoryKey": "vmInsightsVirtualMachinesInsightsMetrics", "order": 200 } + ] +} diff --git a/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis/Performance Analysis.workbook b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis/Performance Analysis.workbook new file mode 100644 index 0000000..126ff48 --- /dev/null +++ b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis/Performance Analysis.workbook @@ -0,0 +1,1391 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "688dc7cb-bea3-41ae-ae94-32d22e09568c", + "version": "KqlParameterItem/1.0", + "name": "DefaultResource", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachinescalesets": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "bbbc300a-6f91-4b2b-b4b5-842b4bf8577a", + "version": "KqlParameterItem/1.0", + "name": "Selection", + "type": 1, + "query": "where type =~ 'microsoft.compute/virtualmachinescalesets'\r\n| extend match = id =~ \"{DefaultResource}\"\r\n| order by match desc, name asc\r\n| take 1\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "_", + "comparison": "isEqualTo", + "value": "_" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "# Performance Analysis" + }, + "conditionalVisibility": { + "parameterName": "ContextFree", + "comparison": "isEqualTo", + "value": "value::1" + }, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resource}" + ], + "parameters": [ + { + "id": "1db5ee15-fe52-458b-91d1-7ee39d8c2cd3", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "summarize by subscriptionId\r\n| project value = strcat('/subscriptions/', subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ todynamic('{Selection}').sub, true, false)", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "9732eff8-fb57-4cbd-8ade-5ae746f33760", + "version": "KqlParameterItem/1.0", + "name": "Resource", + "label": "Virtual Machine Scale Set", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.compute/virtualmachinescalesets'\r\n| summarize by id, name\r\n| project id, selected = iff(id =~ todynamic('{Selection}').ws, true, false)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "5f8cce4b-9c4c-47da-8683-7e5ccc9faed3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "label": "Time Range" + }, + { + "id": "d6de19ff-cde4-41c2-9fba-b441312ea5c9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "type": 1, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| take 1", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "name": "parameters - 2" + }, + { + "type": 1, + "content": { + "json": "⚠ A subscription has not yet been selected. Select a subscription under the `Subscriptions` dropdown or refresh the workbook." + }, + "conditionalVisibility": { + "parameterName": "Subscriptions", + "comparison": "isEqualTo", + "value": null + }, + "name": "text - 29" + }, + { + "type": 1, + "content": { + "json": "⚠ No performance counters were detected in the selected workspace for the specified time period (`{TimeRange:label}`). Either try a broader time range, select a different workspace, or onboard virtual machines to the selected workspace `{Workspaces:label}`.\r\n\r\nIf you choose to onboard virtual machines to workspace `{Workspaces:label}`, follow the instruction in the following link: [Azure Monitor for VMs (preview)](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview)." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": null + }, + "name": "text - 3" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Top 100 Machines", + "subTarget": "top100", + "style": "link" + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Top 10 Machines", + "subTarget": "top10", + "style": "link" + } + ] + }, + "name": "links - 28" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resource}" + ], + "parameters": [ + { + "id": "41bb3710-5e9e-4b66-91fd-e11435899880", + "version": "KqlParameterItem/1.0", + "name": "ComputerNameContains", + "label": "Computer Name Contains", + "type": 1, + "description": "This will filter the computers whose name contains the keyword. This will query all the machines in the workspace.", + "value": "" + }, + { + "id": "b533865a-3539-42b1-8dcd-33ca0d481c2a", + "version": "KqlParameterItem/1.0", + "name": "ComputerFilter", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\": \\\"| where Computer contains '{ComputerNameContains}'\\\"}\"}", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "description": "Select a VM performance counter for the table below", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Namespace, Name, CounterText = Name\r\n| order by Name asc, Namespace asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resource}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "974d5ac2-4fc5-48e7-a8f7-16fc9dddc4ac", + "version": "KqlParameterItem/1.0", + "name": "CounterText", + "type": 1, + "query": "let metric = dynamic({Counter});\r\nrange Steps from 1 to 1 step 1\r\n| project strcat(metric.object, \" > \", metric.counter)", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "9ad8858d-8ef3-4144-94b1-66a8bf9fa9c9", + "version": "KqlParameterItem/1.0", + "name": "Aggregators", + "type": 2, + "description": "Select one or more different aggregates to display in the table below", + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th\", \"label\":\"P95th\", \"selected\": true },\r\n { \"value\":\"Min\", \"label\":\"Min\", \"selected\": false },\r\n { \"value\":\"Max\", \"label\":\"Max\", \"selected\": true }\r\n]" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TableTrend", + "type": 2, + "description": "Select a percentile to display in the Trend column in the table below", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\": false }\r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "tableTrendOrder", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TableTrend contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TableTrend", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TableTrend contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TableTrend", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "6868a13a-498e-4c1b-80c2-8c44b3427126", + "version": "KqlParameterItem/1.0", + "name": "tableTrendLabel", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TableTrend:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "c2f05b6d-970d-4fde-88b0-868387c02250", + "version": "KqlParameterItem/1.0", + "name": "mergedAggregators", + "type": 1, + "value": "Average", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregators contains tableTrendLabel), result = Aggregators", + "criteriaContext": { + "leftOperand": "Aggregators", + "operator": "contains", + "rightValType": "param", + "rightVal": "tableTrendLabel", + "resultValType": "param", + "resultVal": "Aggregators" + } + }, + { + "condition": "else result = '{Aggregators},{tableTrendLabel}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{Aggregators},{tableTrendLabel}" + } + } + ] + }, + { + "id": "69c79551-68b9-4c84-bf57-202540482a02", + "version": "KqlParameterItem/1.0", + "name": "ShowTable", + "type": 1, + "query": "print iff(\"{Test:value}\" == \"\", \"False\", \"True\")", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibilities": [ + { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + } + ], + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "parameters - 6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter}); \r\nlet maxResultCount = 100; let summaryPerComputer = totable(InsightsMetrics | where TimeGenerated {TimeRange} {ComputerFilter} | where Namespace == metric.object and Name == metric.counter | summarize hint.shufflekey = Computer Average = avg(Val), Max = max(Val), Min = min(Val), percentiles(Val, 5, 10, 50, 80, 90, 95) by Computer | project Computer, Average, Max, Min, P5th = percentile_Val_5, P10th = percentile_Val_10, P50th = percentile_Val_50, P80th = percentile_Val_80, P90th = percentile_Val_90, P95th = percentile_Val_95 | order by {TableTrend:label} {tableTrendOrder}, Computer | limit maxResultCount); let computerList = summaryPerComputer | project Computer; let MachineSummary = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | project Computer, MachineSummary = pack('Fully Qualified Domain Name', Computer, 'OS Type', OperatingSystemFamily_s, 'Operating System', OperatingSystemFullName_s, 'Ipv4 Addresses', Ipv4Addresses_s, 'Ipv6 Addresses', Ipv6Addresses_s, 'Mac Addresses', MacAddresses_s, 'DNS Names', DnsNames_s, 'CPUs', strcat(Cpus_d, ' @ ', CpuSpeed_d, ' MHz'), 'Bitness', Bitness_s, 'Physcial Memory', strcat(PhysicalMemory_d, ' MB'), 'Virtualization State', VirtualizationState_s, 'VM Type', VirtualMachineType_s, 'OMS Agent', split(ResourceName_s, 'm-')[1]); let EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) []; let OmsNodeIdentityAndProps = computerList | extend NodeId = Computer | extend Priority = 1 | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer); let ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2; let NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps | summarize arg_max(Priority, *) by Computer; let NodeIdentityAndPropsMin = NodeIdentityAndProps | extend Type = iff(NodeProps.type == 'StandAloneNode', iff(NodeProps.azureResourceId == '', 'Non-Azure Virtual Machine', 'Azure Virtual Machine'), NodeProps.type), ResourceId = iff(NodeProps.type == 'AzureScaleSetNode', NodeProps.vmScaleSetResourceId, iff(NodeProps.type == 'AzureCloudServiceNode', NodeProps.cloudServiceDeploymentId, Computer)), ResourceName = iff(NodeProps.type == 'AzureScaleSetNode', strcat(NodeProps.vmScaleSetName, ' | ', NodeProps.scaleSetInstanceId), iff(NodeProps.type == 'AzureCloudServiceNode', strcat(NodeProps.cloudServiceRoleName, ' | ', NodeProps.cloudServiceInstanceId), Computer)) | project Computer, Type, ResourceId, ResourceName; let trend = InsightsMetrics | where TimeGenerated {TimeRange} | where Computer in (computerList) | where Namespace == metric.object and Name == metric.counter | make-series {TableTrend} default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Computer | project Computer, ['Trend ({TableTrend:label})'] = {TableTrend:label}; summaryPerComputer | join kind=leftouter (trend) on Computer | join kind=leftouter (NodeIdentityAndProps) on Computer | join kind=leftouter (NodeIdentityAndPropsMin) on Computer | join kind=leftouter (MachineSummary) on Computer | project ResourceName, Type, {mergedAggregators}, ['Trend ({TableTrend:label})'], Properties = MachineSummary | sort by {TableTrend:label} {tableTrendOrder} | limit maxResultCount", + "size": 0, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Average", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P50th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (Average)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Properties", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info" + } + }, + { + "columnMatch": "P95th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P5th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P10th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P80th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P90th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Min", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Max", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (P95th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P5th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P90th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P80th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P50th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P10th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowTable", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + } + ], + "conditionalVisibility": { + "parameterName": "ShowTable", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 8" + }, + { + "type": 1, + "content": { + "json": "### CPU Utilization %" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 12" + }, + { + "type": 1, + "content": { + "json": "### Available Memory" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "92358ae0-d5e1-494b-b65b-6d904f1325c5", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "27345375-4376-4e2f-8ac4-59d4eab9d235", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "4d9ba0ec-9d22-4fec-9f85-4be334f42d91", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "50242f48-6c7d-449b-ad93-838c94e615a0", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 14" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "333837c2-d5a4-4173-9aad-3db1dca17e2a", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P5th = round(percentile(Val, 5), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "a23b29a5-5e4a-4d8e-ba73-bfdf27b2980e", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "cc8dfabc-9eb9-4227-97bb-f5e9319030ec", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "ff7a79ff-742a-4c6e-8628-c52f45b3bf71", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 15" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 1, + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 16" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'Memory' and Name == 'AvailableMB'\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, Name\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'Memory' and Name == 'AvailableMB'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 4, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 17" + }, + { + "type": 1, + "content": { + "json": "### Bytes Sent Rate" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "### Bytes Received Rate" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 19" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "360da4c1-97fa-4b15-a008-33a6110d0acd", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "31ccd4a1-d626-44bb-a5de-1780a33b37a5", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "4765abab-a682-49f6-bb41-d64852aba192", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "1d9b0ea9-09d4-4c73-8e59-fa7ab760b880", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 20" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "6772b281-d17d-4293-a227-1b2ed67f399e", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "5e2eef28-0528-406f-86b5-ceae535455f9", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "586fa51c-1a45-4602-adcb-62eb0f619b7f", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + { + "id": "912085b6-f920-4a37-9ce3-f1ef86bd5df8", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, Name\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 23" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk Space Used %" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 24" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 25" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5d6afbec-79f6-4cd1-b3a1-361503478304", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "1d5a805c-acce-4afe-a38b-c2740fb3ff26", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrder", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Resource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 26" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 27" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n\t| extend Val = 100 - Val\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n\t| extend Val = 100 - Val\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachinescalesets", + "crossComponentResources": [ + "{Resource}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 1, + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 28" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis/settings.json b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis/settings.json new file mode 100644 index 0000000..3f334f4 --- /dev/null +++ b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/Performance Analysis/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.compute/virtualmachinescalesets", "categoryKey": "vmInsightsVirtualMachinesInsightsMetrics", "order": 175 }, + { "type": "insights", "resourceType": "microsoft.compute/virtualmachinescalesets", "categoryKey": "vmInsightsVirtualMachinesInsightsMetrics", "order": 175 } + ] +} diff --git a/Virtual Machine Scale Sets - Performance Analysis/Workbooks/categoryResources.json b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/categoryResources.json new file mode 100644 index 0000000..68795dc --- /dev/null +++ b/Virtual Machine Scale Sets - Performance Analysis/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Performance Analysis", "description": "Look for common issues with your Virtual Machine Scale Sets via metrics", "order": 200} +} diff --git a/Virtual Machines (Classic)/Alerts/README b/Virtual Machines (Classic)/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Virtual Machines (Classic)/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Virtual Machines (Classic)/Queries/README b/Virtual Machines (Classic)/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Virtual Machines (Classic)/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Virtual Machines (Classic)/Workbooks/Key Metrics/Key Metrics.workbook b/Virtual Machines (Classic)/Workbooks/Key Metrics/Key Metrics.workbook new file mode 100644 index 0000000..37ef2db --- /dev/null +++ b/Virtual Machines (Classic)/Workbooks/Key Metrics/Key Metrics.workbook @@ -0,0 +1,399 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Virtual Machines (Classic) Metrics" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "85bc1eb3-c168-4054-a925-2bcc86074223", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.classiccompute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + }, + "value": [ + "value::3" + ] + }, + { + "id": "0d13757a-59d3-4fdc-ae21-1de067448751", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-21T23:40:02.726Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-21T23:40:02.726Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-21T23:40:02.726Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-21T23:40:02.726Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resourcegroup/resourcegroups" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Percentage CPU" + }, + "conditionalVisibility": null + }, + { + "type": 10, + "content": { + "chartId": "workbook3fdb1843-c2e1-4420-8e67-e3367994134f", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-23T20:23:30.343Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classiccompute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.classiccompute/virtualmachines", + "metric": "microsoft.classiccompute/virtualmachines--Percentage CPU", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "blue" + } + ] + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "*Percentage CPU* is the percentage of allocated compute units that are currently in use by the Virtual Machine(s)." + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Disk Reads" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Disk Writes" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook3fdb1843-c2e1-4420-8e67-e3367994134f", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-23T20:23:30.361Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classiccompute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.classiccompute/virtualmachines", + "metric": "microsoft.classiccompute/virtualmachines--Disk Read Bytes/Sec", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "orange" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook3fdb1843-c2e1-4420-8e67-e3367994134f", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-23T20:23:30.368Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classiccompute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.classiccompute/virtualmachines", + "metric": "microsoft.classiccompute/virtualmachines--Disk Write Bytes/Sec", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "orange" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Disk reads* is the average bytes read from disk during monitoring period." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Disk writes* is the average bytes written to disk during monitoring period." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Network In" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Network Out" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook3fdb1843-c2e1-4420-8e67-e3367994134f", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-23T20:23:30.384Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classiccompute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.classiccompute/virtualmachines", + "metric": "microsoft.classiccompute/virtualmachines--Network In", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "green" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook3fdb1843-c2e1-4420-8e67-e3367994134f", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-08-23T20:23:30.396Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.classiccompute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.classiccompute/virtualmachines", + "metric": "microsoft.classiccompute/virtualmachines--Network Out", + "aggregation": 4, + "chartType": 3, + "splitBy": null, + "color": "green" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Network In* is the number of bytes received on all network interfaces by the Virtual Machine(s) (Incoming Traffic)." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Network out* is the number of bytes out on all network interfaces by the Virtual Machine(s) (Outgoing Traffic)." + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ] +} \ No newline at end of file diff --git a/Virtual Machines (Classic)/Workbooks/Key Metrics/settings.json b/Virtual Machines (Classic)/Workbooks/Key Metrics/settings.json new file mode 100644 index 0000000..07401a3 --- /dev/null +++ b/Virtual Machines (Classic)/Workbooks/Key Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Key Metrics", + "author": "Microsoft", + "galleries": [ + { "type": "performance-vmclassic", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 }, + { "type": "failure-vmclassic", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 } + ] +} \ No newline at end of file diff --git a/Virtual Machines (Classic)/Workbooks/categoryResources.json b/Virtual Machines (Classic)/Workbooks/categoryResources.json new file mode 100644 index 0000000..48f2416 --- /dev/null +++ b/Virtual Machines (Classic)/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Virtual Machine (Classic) Metrics", "description": "Look for common issues with your VM via metrics", "order": 200} +} \ No newline at end of file diff --git a/Virtual Machines - Network Dependencies/Alerts/README b/Virtual Machines - Network Dependencies/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Virtual Machines - Network Dependencies/Queries/README b/Virtual Machines - Network Dependencies/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Virtual Machines - Network Dependencies/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Virtual Machines - Network Dependencies/Workbooks/Active Ports (Dev)/Active Ports (Dev).workbook b/Virtual Machines - Network Dependencies/Workbooks/Active Ports (Dev)/Active Ports (Dev).workbook new file mode 100644 index 0000000..332aff2 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Active Ports (Dev)/Active Ports (Dev).workbook @@ -0,0 +1,485 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "10607c01-15dc-4df0-a70f-8d1823c41ac0", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "f95de9f8-8ce2-45d7-9515-c1396cb125eb", + "version": "KqlParameterItem/1.0", + "name": "DefaultResourceGroup", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/resourcegroups": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "54f9b46f-0363-425f-9411-d79d847caa21", + "version": "KqlParameterItem/1.0", + "name": "SelectedResourceGroup", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (DefaultResourceGroup != 'value::1'), result = 'false'", + "criteriaContext": { + "leftOperand": "DefaultResourceGroup", + "operator": "!=", + "rightValType": "static", + "rightVal": "value::1", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ], + "timeContextFromParameter": "TimeRange" + }, + { + "id": "6388d6d7-d4ca-4f3d-b581-42aeaa41e63f", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "1f191d03-002b-4b04-a4ee-c5bedb8e6527", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "query": "where type in~('microsoft.compute/virtualmachines', 'microsoft.compute/virtualmachinescalesets')\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| project value = subscriptionId, label = subscriptionId, selected = iff(strcat('/subscriptions/', subscriptionId) =~ '{DefaultSubscription}', true, false)", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "ebdc8ba1-90cc-4029-8df5-bf9deb31df0a", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroups", + "label": "Resource groups", + "type": 2, + "isRequired": true, + "query": "Resources\r\n| where type in~('microsoft.compute/virtualmachines', 'microsoft.compute/virtualmachinescalesets')\r\n| summarize Count = count() by ResourceGroup = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), ResourceGroupName = resourceGroup\r\n| order by Count desc\r\n| project value = ResourceGroup, label = ResourceGroupName, selected = iff(ResourceGroup =~ '{DefaultResourceGroup}', true, false)\r\n| union (datatable(value:string, label:string, selected:boolean)[\r\n'*', 'All resource groups', {SelectedResourceGroup}\r\n])", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "236186d0-04f4-4752-826b-239202ec9b44", + "version": "KqlParameterItem/1.0", + "name": "ArmPrefix", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ResourceGroups != '*'), result = '{ResourceGroups:unformatted}'", + "criteriaContext": { + "leftOperand": "ResourceGroups", + "operator": "!=", + "rightValType": "static", + "rightVal": "*", + "resultValType": "static", + "resultVal": "{ResourceGroups:unformatted}" + } + }, + { + "condition": "else result = '{Subscription}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{Subscription}" + } + } + ], + "timeContextFromParameter": "TimeRange", + "value": "" + }, + { + "id": "19132bc7-1624-4205-98d7-abc779dc1824", + "version": "KqlParameterItem/1.0", + "name": "ArmUrl", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{ArmPrefix}/providers/Microsoft.Insights/vmInsightsOnboardingStatuses?api-version=2018-11-27-preview\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 8, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "de30cdfe-fcab-4c1a-8e84-cf12e08fb804", + "version": "KqlParameterItem/1.0", + "name": "OnboardQueryResult", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{ArmUrl}\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 12, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "d0dc9f80-0be7-48cb-a4b3-fdb9f64932a1", + "version": "KqlParameterItem/1.0", + "name": "OnboardedVms", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "{\"version\":\"1.0.0\",\"content\":\"{OnboardQueryResult}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value.*\",\"columns\":[{\"path\":\"$.properties.resourceId\",\"columnid\":\"Workspaces\"}]}}]}", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "f3884e38-09d5-40cb-baa7-f5906e23d307", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachines", + "label": "Virtual machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| take 1\n| project ids = dynamic([{OnboardedVms}])\n| mvexpand ids limit 400\n| extend id = tolower(tostring(ids))\n| extend vmss = extract(@'(/subscriptions/.+/resourcegroups/.+/providers/microsoft.compute/virtualmachinescalesets/.+)/virtualmachines/.+', 1, id)\n| project id = iff(vmss == '', id, vmss), group = iff(vmss == '', 'Virtual machines', 'Virtual machine scale sets')\n| summarize by id, group\n| project value = id, label = id, selected = false, group", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c50c67ca-3dba-4a7f-ad19-2d5d28185e12", + "version": "KqlParameterItem/1.0", + "name": "TargetWorkspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "\"", + "delimiter": ",", + "query": "{\"version\":\"1.0.0\",\"content\":\"{OnboardQueryResult}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value.*\",\"columns\":[{\"path\":\"$.properties.data.*.workspace.id\",\"columnid\":\"Workspaces\"}]}}]}", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "97011276-637b-46e6-9e9f-056c30389501", + "version": "KqlParameterItem/1.0", + "name": "DistinctTargetWorkspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| take 1\n| project ws = '{TargetWorkspaces}'\n| extend ws = replace(@'\"\\[', '', ws)\n| extend ws = replace(@'\\]\"', '', ws)\n| extend ws = todynamic(strcat('[', ws, ']'))\n| mvexpand ws limit 400\n| summarize by tolower(tostring(ws))", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "a40d5985-4da2-4c55-b73e-4cca93c8b560", + "version": "KqlParameterItem/1.0", + "name": "WorkspaceLocations", + "label": "Workspace locations", + "type": 8, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({DistinctTargetWorkspaces})\n| summarize Count = count() by location\n| order by Count desc\n| extend Row = row_number()\n| project value = location, label = location, selected = Row == 1", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2454837b-8bc8-4707-8245-0560c029b0ac", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({DistinctTargetWorkspaces}) and location in ({WorkspaceLocations})\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7b41836d-1da2-4f43-91fe-4edc728e87fa", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "## Port activity by Computer, Process, IP and Port" + }, + "name": "text - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMBoundPort\n| where Ip != \"127.0.0.1\"\n| summarize BytesSent=sum(BytesSent), BytesReceived=sum(BytesReceived), LinksEstablished=sum(LinksEstablished), LinksTerminated=sum(LinksTerminated), arg_max(TimeGenerated, LinksLive) by Computer, ProcessName, Ip, Port, IsWildcardBind\n| project-away TimeGenerated\n| order by BytesSent desc", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "BytesSent", + "formatter": 4, + "formatOptions": { + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "BytesReceived", + "formatter": 4, + "formatOptions": { + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "LinksEstablished", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + } + }, + { + "columnMatch": "LinksTerminated", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + } + }, + { + "columnMatch": "LinksLive", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "name": "query - 2" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Active Ports (Dev)/settings.json b/Virtual Machines - Network Dependencies/Workbooks/Active Ports (Dev)/settings.json new file mode 100644 index 0000000..b0c9f1c --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Active Ports (Dev)/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Active Ports (Dev)", + "isPreview": true, + "author": "Microsoft", + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 175 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Active Ports/Active Ports.workbook b/Virtual Machines - Network Dependencies/Workbooks/Active Ports/Active Ports.workbook new file mode 100644 index 0000000..6a6ab98 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Active Ports/Active Ports.workbook @@ -0,0 +1,374 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "80a15801-7442-49f3-a82f-6e55849ec7fb", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "90119d28-e9c1-4c0d-8715-1f601d337f5c", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "7da21a07-10f4-4455-9105-c37132dcee0d", + "version": "KqlParameterItem/1.0", + "name": "ContextSelection", + "type": 1, + "query": "// {DefaultWorkspace}\r\nwhere strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7324c544-2fd2-4d61-b529-481a0f5fd286", + "version": "KqlParameterItem/1.0", + "name": "HybridMode", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ContextSelection is empty ), result = 'false'", + "criteriaContext": { + "leftOperand": "ContextSelection", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ] + }, + { + "id": "2942e38e-232e-4d89-9ada-12f9863b3c5b", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {DefaultSubscription}\r\nsummarize by subscriptionId\r\n| project strcat('/subscriptions/', subscriptionId), selected = iff({HybridMode} == true, iff(subscriptionId == todynamic('{ContextSelection}').sub, true, false), iff(strcat('/subscriptions/', subscriptionId) == '{DefaultSubscription}', true, false))", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2bc1e5fc-cc2d-4eb5-bead-5f7d96664dec", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {Subscriptions}\r\nwhere type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| order by tolower(name) asc\r\n| extend Row = row_number()\r\n| project id, selected = iff({HybridMode} == 'true', iff(id == todynamic('{ContextSelection}').ws, true, false), Row == 1)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d0f502a4-2f0f-4d3d-af70-5198d41f3e0c", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "48e2b8b9-e618-480c-80e6-5cf1cee85ee9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "label": "Not Onboarded", + "type": 1, + "query": "VMConnection\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": null, + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "⚠ `VMConnection` table was either not detected or empty. Try the following:\r\n\r\n* Select a different time range\r\n* Try different scope selections\r\n* Onboard to Azure Monitor for VMs ([Azure Monitor for VMs GA FAQ](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-ga-release-faq))." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": "1" + }, + "name": "text - 3" + }, + { + "type": 1, + "content": { + "json": "## Port activity by Computer, Process, IP and Port" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "text - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMBoundPort\n| where Ip != \"127.0.0.1\"\n| summarize BytesSent=sum(BytesSent), BytesReceived=sum(BytesReceived), LinksEstablished=sum(LinksEstablished), LinksTerminated=sum(LinksTerminated), arg_max(TimeGenerated, LinksLive) by Computer, ProcessName, Ip, Port, IsWildcardBind\n| project-away TimeGenerated\n| order by BytesSent desc", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "BytesSent", + "formatter": 4, + "formatOptions": { + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "BytesReceived", + "formatter": 4, + "formatOptions": { + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "LinksEstablished", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + } + }, + { + "columnMatch": "LinksTerminated", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + } + }, + { + "columnMatch": "LinksLive", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "query - 2" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Active Ports/settings.json b/Virtual Machines - Network Dependencies/Workbooks/Active Ports/settings.json new file mode 100644 index 0000000..f97cf31 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Active Ports/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Active Ports", + "author": "Microsoft", + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 175 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Connection Records/Connection Records.workbook b/Virtual Machines - Network Dependencies/Workbooks/Connection Records/Connection Records.workbook new file mode 100644 index 0000000..108ab19 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Connection Records/Connection Records.workbook @@ -0,0 +1,224 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "Each record from [VMConnections](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/service-map) represents a connection from one machine to another over a 1-minute interval.\n\nEach record aggregates the following properties over a 1-minute interval: the total number of bytes sent and received, the number of links (port connections) that are established, currently active, and terminated, and the number of responses received.\n\n
" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "a4bac540-6b00-461b-b521-2f97477bac3d", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": null + }, + { + "id": "5f8cce4b-9c4c-47da-8683-7e5ccc9faed3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": false, + "value": { + "durationMs": 3600000 + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "

TimeRange specifies how far back in time to gather connection records from VMConnections. Selecting a large time range will result in a long query processing time.

\r\n\r\n
" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Aggregate Connection Records\n\n" + }, + "conditionalVisibility": null, + "customWidth": "25" + }, + { + "type": 1, + "content": { + "json": "### Connection Records by Country" + }, + "conditionalVisibility": null, + "customWidth": "75" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| summarize Count = count() by Direction", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "piechart" + }, + "conditionalVisibility": null, + "customWidth": "25" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| summarize Count = count() by RemoteCountry, bin(TimeGenerated, {TimeRange:grain})", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": true, + "showAnalytics": false, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": null, + "customWidth": "75" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Connection Records/settings.json b/Virtual Machines - Network Dependencies/Workbooks/Connection Records/settings.json new file mode 100644 index 0000000..92daa67 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Connection Records/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Connections Records (preview)", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 300 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Connections Overview (Azure Preview)/Connections Overview (Azure Preview).workbook b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview (Azure Preview)/Connections Overview (Azure Preview).workbook new file mode 100644 index 0000000..ef6418b --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview (Azure Preview)/Connections Overview (Azure Preview).workbook @@ -0,0 +1,1802 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "10607c01-15dc-4df0-a70f-8d1823c41ac0", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "f95de9f8-8ce2-45d7-9515-c1396cb125eb", + "version": "KqlParameterItem/1.0", + "name": "DefaultResourceGroup", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/resourcegroups": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "54f9b46f-0363-425f-9411-d79d847caa21", + "version": "KqlParameterItem/1.0", + "name": "SelectedResourceGroup", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (DefaultResourceGroup != 'value::1'), result = 'false'", + "criteriaContext": { + "leftOperand": "DefaultResourceGroup", + "operator": "!=", + "rightValType": "static", + "rightVal": "value::1", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ], + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "6388d6d7-d4ca-4f3d-b581-42aeaa41e63f", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "1f191d03-002b-4b04-a4ee-c5bedb8e6527", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "query": "where type in~('microsoft.compute/virtualmachines', 'microsoft.compute/virtualmachinescalesets')\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| project value = subscriptionId, label = subscriptionId, selected = iff(strcat('/subscriptions/', subscriptionId) =~ '{DefaultSubscription}', true, false)", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "ebdc8ba1-90cc-4029-8df5-bf9deb31df0a", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroups", + "label": "Resource groups", + "type": 2, + "isRequired": true, + "query": "Resources\r\n| where type in~('microsoft.compute/virtualmachines', 'microsoft.compute/virtualmachinescalesets')\r\n| summarize Count = count() by ResourceGroup = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), ResourceGroupName = resourceGroup\r\n| order by Count desc\r\n| project value = ResourceGroup, label = ResourceGroupName, selected = iff(ResourceGroup =~ '{DefaultResourceGroup}', true, false)\r\n| union (datatable(value:string, label:string, selected:boolean)[\r\n'*', 'All resource groups', {SelectedResourceGroup}\r\n])", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "236186d0-04f4-4752-826b-239202ec9b44", + "version": "KqlParameterItem/1.0", + "name": "ArmPrefix", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ResourceGroups != '*'), result = '{ResourceGroups:unformatted}'", + "criteriaContext": { + "leftOperand": "ResourceGroups", + "operator": "!=", + "rightValType": "static", + "rightVal": "*", + "resultValType": "static", + "resultVal": "{ResourceGroups:unformatted}" + } + }, + { + "condition": "else result = '{Subscription}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{Subscription}" + } + } + ], + "timeContextFromParameter": "TimeRange", + "value": "", + "resourceType": "microsoft.insights/components" + }, + { + "id": "19132bc7-1624-4205-98d7-abc779dc1824", + "version": "KqlParameterItem/1.0", + "name": "ArmUrl", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{ArmPrefix}/providers/Microsoft.Insights/vmInsightsOnboardingStatuses?api-version=2018-11-27-preview\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "de30cdfe-fcab-4c1a-8e84-cf12e08fb804", + "version": "KqlParameterItem/1.0", + "name": "OnboardQueryResult", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{ArmUrl}\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 12 + }, + { + "id": "d0dc9f80-0be7-48cb-a4b3-fdb9f64932a1", + "version": "KqlParameterItem/1.0", + "name": "OnboardedVms", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "{\"version\":\"1.0.0\",\"content\":\"{OnboardQueryResult}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value.*\",\"columns\":[{\"path\":\"$.properties.resourceId\",\"columnid\":\"Workspaces\"}]}}]}", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "f3884e38-09d5-40cb-baa7-f5906e23d307", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachines", + "label": "Virtual machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| take 1\n| project ids = dynamic([{OnboardedVms}])\n| mvexpand ids limit 400\n| extend id = tolower(tostring(ids))\n| extend vmss = extract(@'(/subscriptions/.+/resourcegroups/.+/providers/microsoft.compute/virtualmachinescalesets/.+)/virtualmachines/.+', 1, id)\n| extend arc = extract(@'(/subscriptions/.+/resourcegroups/.+/providers/microsoft.hybridcompute/machines/.+)', 1, id)\n| project id = iff(vmss == '', id, vmss), group = iff(vmss == '', iff(arc == '', 'Virtual machine', 'Azure Arc machine'), 'Virtual machine scale sets')\n| summarize by id, group\n| project value = id, label = id, selected = false, group", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c50c67ca-3dba-4a7f-ad19-2d5d28185e12", + "version": "KqlParameterItem/1.0", + "name": "TargetWorkspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "\"", + "delimiter": ",", + "query": "{\"version\":\"1.0.0\",\"content\":\"{OnboardQueryResult}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value.*\",\"columns\":[{\"path\":\"$.properties.data.*.workspace.id\",\"columnid\":\"Workspaces\"}]}}]}", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "97011276-637b-46e6-9e9f-056c30389501", + "version": "KqlParameterItem/1.0", + "name": "DistinctTargetWorkspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| take 1\n| project ws = '{TargetWorkspaces}'\n| extend ws = replace(@'\"\\[', '', ws)\n| extend ws = replace(@'\\]\"', '', ws)\n| extend ws = todynamic(strcat('[', ws, ']'))\n| mvexpand ws limit 400\n| summarize by tolower(tostring(ws))", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "a40d5985-4da2-4c55-b73e-4cca93c8b560", + "version": "KqlParameterItem/1.0", + "name": "WorkspaceLocations", + "label": "Workspace locations", + "type": 8, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({DistinctTargetWorkspaces})\n| summarize Count = count() by location\n| order by Count desc\n| extend Row = row_number()\n| project value = location, label = location, selected = Row == 1", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2454837b-8bc8-4707-8245-0560c029b0ac", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({DistinctTargetWorkspaces}) and location in ({WorkspaceLocations})\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7b41836d-1da2-4f43-91fe-4edc728e87fa", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "905e418c-ddf2-4d5f-9821-66e15381ceed", + "version": "KqlParameterItem/1.0", + "name": "Test", + "label": "Not Onboarded", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{OnboardedVms}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "9711af09-11eb-4b4d-8de0-ea21677fae4d", + "version": "KqlParameterItem/1.0", + "name": "virtualMachinesSnippet", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"| where _ResourceId in ({VirtualMachines}) or _ResourceIdVmss in ({VirtualMachines})\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "c94a9f39-9d0c-406e-92e2-2dc0a3c2ac9b", + "version": "KqlParameterItem/1.0", + "name": "virtualMachinesValue", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{VirtualMachines}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "80df5c1e-5eaf-4f4a-bf40-8c81aaebcc19", + "version": "KqlParameterItem/1.0", + "name": "vmSnippet", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (virtualMachinesValue == '*'), result = '| where _ResourceId startswith \"{ArmPrefix}\"'", + "criteriaContext": { + "leftOperand": "virtualMachinesValue", + "operator": "==", + "rightValType": "static", + "rightVal": "*", + "resultValType": "static", + "resultVal": "| where _ResourceId startswith \"{ArmPrefix}\"" + } + }, + { + "condition": "else result = virtualMachinesSnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "virtualMachinesSnippet" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "db9b2f1d-188a-4dda-af4a-b39deeb34da3", + "version": "KqlParameterItem/1.0", + "name": "Direction", + "type": 2, + "description": "Direction of the network connection from the VMs", + "isRequired": true, + "value": "outbound", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"inbound\", \"label\":\"Inbound\" },\r\n { \"value\":\"outbound\", \"label\":\"Outbound\" }\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "56ab6626-c12d-4de1-8a3d-8a6099db3cd3", + "version": "KqlParameterItem/1.0", + "name": "hierarchy", + "type": 1, + "isRequired": true, + "value": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Direction == 'inbound'), result = '[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Port -> Remote IP\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Port\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]'", + "criteriaContext": { + "leftOperand": "Direction", + "operator": "==", + "rightValType": "static", + "rightVal": "inbound", + "resultValType": "static", + "resultVal": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Port -> Remote IP\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Port\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]" + } + }, + { + "condition": "else result = '[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "8be4bd82-b145-4602-af53-52c9e8f8d51e", + "version": "KqlParameterItem/1.0", + "name": "Hierarchy", + "type": 2, + "description": "Select the level of detail to be shown in the table below", + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"{hierarchy}\",\"transformers\":[{\"type\":\"jsonpath\"}]}", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "5526f711-6d04-469e-8d06-351508f1014e", + "version": "KqlParameterItem/1.0", + "name": "TableFilter", + "type": 2, + "description": "Filter table based on presence of malicious connections or at least one link failing", + "multiSelect": true, + "quote": "", + "delimiter": "", + "value": [], + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"Only Malicious Connections\",\r\n \"value\": \" | where MaliciousConnectionsCount >= 1\"\r\n },\r\n {\r\n \"label\": \"Only Links Failed\",\r\n \"value\": \" | where LinksFailed >= 1\"\r\n }\r\n]", + "label": "Table Filter", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5e335a1b-7f99-4647-854a-d7b5cb489bb2", + "version": "KqlParameterItem/1.0", + "name": "ServiceMapComputers", + "type": 1, + "isRequired": true, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let computers = ServiceMapComputer_CL | summarize (TimeGenerated, Properties) = arg_max(TimeGenerated, pack_all()) by Computer;'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let computers = ServiceMapComputer_CL | summarize (TimeGenerated, Properties) = arg_max(TimeGenerated, pack_all()) by Computer;" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "c69fbaae-4fd2-4527-acdd-a2c358eebffa", + "version": "KqlParameterItem/1.0", + "name": "MaliciousIpData", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let maliciousIpData = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | where MaliciousIp != '' | summarize by Computer, ProcessName, MaliciousIp, DestinationPort, RemoteIp, IsActive, IndicatorThreatType, RemoteCountry, RemoteLongitude, RemoteLatitude, Confidence, Severity, FirstReportedDateTime, LastReportedDateTime | project MaliciousIp = strcat(Computer, '-', ProcessName, '-', MaliciousIp), MaliciousPort = strcat(Computer, '-', ProcessName, '-', DestinationPort), MaliciousPortIp = strcat(Computer, '-', ProcessName, '-', DestinationPort, '-', RemoteIp), Computer = Computer, Process = strcat(Computer, '-', ProcessName), MaliciousIpInfo = pack('Malicious IP', MaliciousIp, 'Is Active', IsActive, 'Indicator Threat Type', IndicatorThreatType, 'Remote Country', RemoteCountry, 'Longitude', RemoteLongitude, 'Latitude', RemoteLatitude, 'Confidence', Confidence, 'Severity', Severity, 'First Reported DateTime', FirstReportedDateTime, 'Last Reported DateTime', LastReportedDateTime, 'Destination Port', DestinationPort, 'Remote IP', RemoteIp);'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let maliciousIpData = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | where MaliciousIp != '' | summarize by Computer, ProcessName, MaliciousIp, DestinationPort, RemoteIp, IsActive, IndicatorThreatType, RemoteCountry, RemoteLongitude, RemoteLatitude, Confidence, Severity, FirstReportedDateTime, LastReportedDateTime | project MaliciousIp = strcat(Computer, '-', ProcessName, '-', MaliciousIp), MaliciousPort = strcat(Computer, '-', ProcessName, '-', DestinationPort), MaliciousPortIp = strcat(Computer, '-', ProcessName, '-', DestinationPort, '-', RemoteIp), Computer = Computer, Process = strcat(Computer, '-', ProcessName), MaliciousIpInfo = pack('Malicious IP', MaliciousIp, 'Is Active', IsActive, 'Indicator Threat Type', IndicatorThreatType, 'Remote Country', RemoteCountry, 'Longitude', RemoteLongitude, 'Latitude', RemoteLatitude, 'Confidence', Confidence, 'Severity', Severity, 'First Reported DateTime', FirstReportedDateTime, 'Last Reported DateTime', LastReportedDateTime, 'Destination Port', DestinationPort, 'Remote IP', RemoteIp);" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "dd933ac8-1273-48fe-8d09-bd65d857ce83", + "version": "KqlParameterItem/1.0", + "name": "ComputerData", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let computerData = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Name = strcat('🖥️ ', Computer), ComputerName = Computer, Type = 'Computer', TypeKey = 1, Key = Computer, ParentKey = '---' | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Computer) on $left.Key == $right.Computer | project-away Computer | order by Name asc;'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let computerData = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Name = strcat('🖥️ ', Computer), ComputerName = Computer, Type = 'Computer', TypeKey = 1, Key = Computer, ParentKey = '---' | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Computer) on $left.Key == $right.Computer | project-away Computer | order by Name asc;" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "fb879823-c082-4c53-af7e-18d044032f99", + "version": "KqlParameterItem/1.0", + "name": "RemoteIpDataInbound", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let remoteIpDataInbound = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == 'inbound' | where 'inbound' == 'inbound' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort), '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), Id = strcat(Computer, '-', ProcessName, '-', RemoteIp), ComputerName = Computer | join kind=inner sourcePortData on $left.ParentKey == $right.Key | project-away AverageResponseTime1, Computer1, Key1, LinksFailed1, MaxLinksLive1, ParentKey1, ProcessName1, Responses1, TotalBytesReceived1, TotalBytesSent1, Type1, TypeKey1 | order by Name asc | join kind=leftouter ipComputerMapping on $left.RemoteIp == $right.Ipv4 | extend Name = iff(RemoteIp == '', 'Unknown', strcat('🌐 External (', RemoteIp, ')')) | project-away Computer, Ipv4 | order by Name desc | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPortIp | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIp, Computer, Process, Computer1, MaliciousIpInfo1, Id;'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let remoteIpDataInbound = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == 'inbound' | where 'inbound' == 'inbound' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort), '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), Id = strcat(Computer, '-', ProcessName, '-', RemoteIp), ComputerName = Computer | join kind=inner sourcePortData on $left.ParentKey == $right.Key | project-away AverageResponseTime1, Computer1, Key1, LinksFailed1, MaxLinksLive1, ParentKey1, ProcessName1, Responses1, TotalBytesReceived1, TotalBytesSent1, Type1, TypeKey1 | order by Name asc | join kind=leftouter ipComputerMapping on $left.RemoteIp == $right.Ipv4 | extend Name = iff(RemoteIp == '', 'Unknown', strcat('🌐 External (', RemoteIp, ')')) | project-away Computer, Ipv4 | order by Name desc | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPortIp | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIp, Computer, Process, Computer1, MaliciousIpInfo1, Id;" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "3ad60c70-b530-49c0-a59b-8df690dffbc8", + "version": "KqlParameterItem/1.0", + "name": "ProcessName", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let processData = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, Name = strcat('🎫 ', ProcessName), Type = 'Process', TypeKey = 2, Key = strcat(Computer, '-', ProcessName), ParentKey = Computer, ComputerName = Computer | join kind=inner computerData on $left.ParentKey == $right.Key | project-away Name1, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Process) on $left.Key == $right.Process | project-away Process, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | order by Name asc;'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let processData = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, Name = strcat('🎫 ', ProcessName), Type = 'Process', TypeKey = 2, Key = strcat(Computer, '-', ProcessName), ParentKey = Computer, ComputerName = Computer | join kind=inner computerData on $left.ParentKey == $right.Key | project-away Name1, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Process) on $left.Key == $right.Process | project-away Process, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | order by Name asc;" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "c9eea7db-3d14-4fbf-8ae6-b7507ec1d43f", + "version": "KqlParameterItem/1.0", + "name": "RemoteIpData", + "type": 1, + "isRequired": true, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let remoteIpData = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where '{Direction}' == 'outbound' | where Direction == '{Direction}' | extend RemoteIp = iff(Direction == 'outbound', DestinationIp, SourceIp) | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=inner processData on $left.ParentKey == $right.Key | project-away Name, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousIp | project-away MaliciousIp, Computer, Process, Computer1, Computer2, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | join kind = leftouter (ipComputerMapping) on $left.RemoteIp == $right.Ipv4 | extend Name = iff(Computer == '', iff(RemoteIp == '127.0.0.1', '🌐 Localhost', strcat('🌐 External (', RemoteIp, ')')), strcat('🖥️ ', Computer)) | project-away Computer, Ipv4 | order by Name desc;'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let remoteIpData = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where '{Direction}' == 'outbound' | where Direction == '{Direction}' | extend RemoteIp = iff(Direction == 'outbound', DestinationIp, SourceIp) | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=inner processData on $left.ParentKey == $right.Key | project-away Name, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousIp | project-away MaliciousIp, Computer, Process, Computer1, Computer2, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | join kind = leftouter (ipComputerMapping) on $left.RemoteIp == $right.Ipv4 | extend Name = iff(Computer == '', iff(RemoteIp == '127.0.0.1', '🌐 Localhost', strcat('🌐 External (', RemoteIp, ')')), strcat('🖥️ ', Computer)) | project-away Computer, Ipv4 | order by Name desc;" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "4a9ed59b-002e-4c81-b437-8456faeef6a6", + "version": "KqlParameterItem/1.0", + "name": "SourcePortData", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let sourcePortData = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | where '{Direction}' == 'inbound' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPort | extend MaliciousIpInfo = tostring(MaliciousIpInfo) | project-away Computer1, MaliciousIp, MaliciousPort, MaliciousPortIp, Process; {RemoteIpDataInbound}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let sourcePortData = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | where '{Direction}' == 'inbound' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPort | extend MaliciousIpInfo = tostring(MaliciousIpInfo) | project-away Computer1, MaliciousIp, MaliciousPort, MaliciousPortIp, Process; {RemoteIpDataInbound}" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "e31a8d21-e24b-45ec-9806-e6c45bca15aa", + "version": "KqlParameterItem/1.0", + "name": "DestinationPortData", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let destinationPortData = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | where '{Direction}' == 'outbound' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', DestinationIp, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName, '-', DestinationIp), ComputerName = Computer | join kind=inner remoteIpData on $left.ParentKey == $right.Key | project-away Name1, Responses1, Type1, Key1, ParentKey1 | order by Name asc;'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let destinationPortData = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | where '{Direction}' == 'outbound' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', DestinationIp, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName, '-', DestinationIp), ComputerName = Computer | join kind=inner remoteIpData on $left.ParentKey == $right.Key | project-away Name1, Responses1, Type1, Key1, ParentKey1 | order by Name asc;" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "a54f3df8-c872-4a19-a280-84b203987ec8", + "version": "KqlParameterItem/1.0", + "name": "QueryProject", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '| extend MaliciousConnectionsCount = iff(MaliciousIpInfo == '', 0, iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', tolong(MaliciousIpInfo), 1)) | project ComputerName, ProcessName, RemoteIp, DestinationPort, Name = iff(Name == '🎫 ', '🎫 ', Name), Type, MaliciousConnections = iff(MaliciousIpInfo == '', '✅ No Malicious Connections', iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', iff(MaliciousConnectionsCount > 1, strcat('❌ ', MaliciousIpInfo, ' Malicious Connections'), strcat('❌ ', MaliciousIpInfo, ' Malicious Connection')), '❌ Malicious Connection')), Responses, MaxLinksLive, LinksFailed, AverageResponseTime, TotalBytesSent, TotalBytesReceived, Info = iff(MaliciousIpInfo != '', MaliciousIpInfo, ''), Key, ParentKey, TypeKey, MaliciousConnectionsCount | order by TypeKey asc, MaliciousConnectionsCount desc, LinksFailed desc, AverageResponseTime desc, Responses desc, MaxLinksLive desc, Name asc | project-away TypeKey'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| extend MaliciousConnectionsCount = iff(MaliciousIpInfo == '', 0, iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', tolong(MaliciousIpInfo), 1)) | project ComputerName, ProcessName, RemoteIp, DestinationPort, Name = iff(Name == '🎫 ', '🎫 ', Name), Type, MaliciousConnections = iff(MaliciousIpInfo == '', '✅ No Malicious Connections', iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', iff(MaliciousConnectionsCount > 1, strcat('❌ ', MaliciousIpInfo, ' Malicious Connections'), strcat('❌ ', MaliciousIpInfo, ' Malicious Connection')), '❌ Malicious Connection')), Responses, MaxLinksLive, LinksFailed, AverageResponseTime, TotalBytesSent, TotalBytesReceived, Info = iff(MaliciousIpInfo != '', MaliciousIpInfo, ''), Key, ParentKey, TypeKey, MaliciousConnectionsCount | order by TypeKey asc, MaliciousConnectionsCount desc, LinksFailed desc, AverageResponseTime desc, Responses desc, MaxLinksLive desc, Name asc | project-away TypeKey" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "9789ead5-eae5-4f52-86c2-ac197da62f30", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process_IP_Port", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} {RemoteIpData} {DestinationPortData} {SourcePortData} let overalldata = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; computerData | union processData | union remoteIpData | union destinationPortData | union remoteIpDataInbound | union sourcePortData | union overalldata\t{QueryProject}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} {RemoteIpData} {DestinationPortData} {SourcePortData} let overalldata = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; computerData | union processData | union remoteIpData | union destinationPortData | union remoteIpDataInbound | union sourcePortData | union overalldata\t{QueryProject}" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "0d6a320e-2cef-44fd-ac0b-ad833f8d0c03", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process_IP", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} {RemoteIpData} {SourcePortData} let overalldata = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; computerData | union processData | union remoteIpData | union sourcePortData | union overalldata {QueryProject}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} {RemoteIpData} {SourcePortData} let overalldata = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; computerData | union processData | union remoteIpData | union sourcePortData | union overalldata {QueryProject}" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "2de0d685-4382-4822-a8aa-f3583ff11b66", + "version": "KqlParameterItem/1.0", + "name": "QueryPadDestinationPortTable", + "type": 1, + "isRequired": true, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let destinationPortPadding = datatable (DestinationPort: string) [];'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let destinationPortPadding = datatable (DestinationPort: string) [];" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "df8a6322-511e-40e0-a258-fe717099a072", + "version": "KqlParameterItem/1.0", + "name": "QueryPadRemoteIpTable", + "type": 1, + "isRequired": true, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let remoteIpPadding = datatable (RemoteIp: string) [];'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let remoteIpPadding = datatable (RemoteIp: string) [];" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "e8f2c394-18e8-4d6d-8f5e-8453cb67128c", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} let overalldata = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; {QueryPadDestinationPortTable} {QueryPadRemoteIpTable} computerData | union remoteIpPadding | union destinationPortPadding | union processData | union overalldata {QueryProject}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} let overalldata = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; {QueryPadDestinationPortTable} {QueryPadRemoteIpTable} computerData | union remoteIpPadding | union destinationPortPadding | union processData | union overalldata {QueryProject}" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "084fb5fc-e8e4-42df-8a9f-ac1001950ba2", + "version": "KqlParameterItem/1.0", + "name": "QueryPadProcessNameTable", + "type": 1, + "isRequired": true, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let processNamePadding = datatable (ProcessName: string) [];'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let processNamePadding = datatable (ProcessName: string) [];" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "a4b0e146-7c89-40bb-ade2-ed2e392e9311", + "version": "KqlParameterItem/1.0", + "name": "Computer", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} let overalldata = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; {QueryPadDestinationPortTable} {QueryPadRemoteIpTable} {QueryPadProcessNameTable} computerData | union remoteIpPadding | union processNamePadding | union destinationPortPadding | union overalldata {QueryProject}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} let overalldata = VMConnection | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; {QueryPadDestinationPortTable} {QueryPadRemoteIpTable} {QueryPadProcessNameTable} computerData | union remoteIpPadding | union processNamePadding | union destinationPortPadding | union overalldata {QueryProject}" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "a08757da-e72b-474d-a1d2-65fb7020cc14", + "version": "KqlParameterItem/1.0", + "name": "FinalQuery", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Hierarchy == '0'), result = '{Computer_Process_IP_Port} {TableFilter}'", + "criteriaContext": { + "leftOperand": "Hierarchy", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "static", + "resultVal": "{Computer_Process_IP_Port} {TableFilter}" + } + }, + { + "condition": "if (Hierarchy == '1'), result = '{Computer_Process_IP} {TableFilter}'", + "criteriaContext": { + "leftOperand": "Hierarchy", + "operator": "==", + "rightValType": "static", + "rightVal": "1", + "resultValType": "static", + "resultVal": "{Computer_Process_IP} {TableFilter}" + } + }, + { + "condition": "if (Hierarchy == '2'), result = '{Computer_Process} {TableFilter}'", + "criteriaContext": { + "leftOperand": "Hierarchy", + "operator": "==", + "rightValType": "static", + "rightVal": "2", + "resultValType": "static", + "resultVal": "{Computer_Process} {TableFilter}" + } + }, + { + "condition": "if (Hierarchy == '3'), result = '{Computer} {TableFilter}'", + "criteriaContext": { + "leftOperand": "Hierarchy", + "operator": "==", + "rightValType": "static", + "rightVal": "3", + "resultValType": "static", + "resultVal": "{Computer} {TableFilter}" + } + }, + { + "condition": "else result = '{Computer} {TableFilter}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{Computer} {TableFilter}" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "874eeebe-2ea2-4c04-a3b9-ab3b30e95573", + "version": "KqlParameterItem/1.0", + "name": "ConnectionGrid", + "type": 1, + "description": "Table placeholder", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components" + }, + { + "id": "7d229be6-fe1e-4b68-9a88-e7a53e639198", + "version": "KqlParameterItem/1.0", + "name": "GridComputerName", + "type": 1, + "description": "Table placeholder", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "e1562f78-bdb1-4bae-9cfd-5120e2061f5d", + "version": "KqlParameterItem/1.0", + "name": "GridProcessName", + "type": 1, + "description": "Table placeholder", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "5423665b-218d-44fb-9cd5-0891168fd542", + "version": "KqlParameterItem/1.0", + "name": "GridRemoteIp", + "type": 1, + "description": "Table placeholder", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "9a543572-e7dd-4332-8db3-7f039b06148a", + "version": "KqlParameterItem/1.0", + "name": "GridDestinationPort", + "type": 1, + "description": "Table placeholder", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 3" + }, + { + "type": 1, + "content": { + "json": "💡 Select a row from the table below to view connection details for that entry." + }, + "name": "text - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{FinalQuery:value}", + "size": 0, + "noDataMessage": "No data to be shown for this particular scope combination, please adjust the time range, table filters, etc.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportedParameters": [ + { + "parameterName": "ConnectionGrid", + "parameterType": 1, + "defaultValue": "{}" + }, + { + "fieldName": "ComputerName", + "parameterName": "GridComputerName", + "parameterType": 1 + }, + { + "fieldName": "ProcessName", + "parameterName": "GridProcessName", + "parameterType": 1 + }, + { + "fieldName": "RemoteIp", + "parameterName": "GridRemoteIp", + "parameterType": 1, + "defaultValue": "" + }, + { + "fieldName": "DestinationPort", + "parameterName": "GridDestinationPort", + "parameterType": 1, + "defaultValue": "" + } + ], + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Computer", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ProcessName", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "RemoteIp", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DestinationPort", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Responses", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "MaxLinksLive", + "formatter": 4, + "formatOptions": { + "palette": "lightBlue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "LinksFailed", + "formatter": 4, + "formatOptions": { + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "AverageResponseTime", + "formatter": 4, + "formatOptions": { + "palette": "purple", + "showIcon": true + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalBytesSent", + "formatter": 4, + "formatOptions": { + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalBytesReceived", + "formatter": 4, + "formatOptions": { + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Info", + "formatter": 5, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info", + "showIcon": true + } + }, + { + "columnMatch": "Key", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ParentKey", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "MaliciousConnectionsCount", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "idColumn": "Key", + "parentColumn": "ParentKey", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": false + } + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "KPIValue", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "showPin": true, + "name": "query - 5" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "dcf5f274-fbbf-4fb8-8c35-6b528a08cac9", + "version": "KqlParameterItem/1.0", + "name": "ShowDetail", + "type": 1, + "isRequired": true, + "value": "False", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ConnectionGrid != '{}'), result = 'True'", + "criteriaContext": { + "leftOperand": "ConnectionGrid", + "operator": "!=", + "rightValType": "static", + "rightVal": "{}", + "resultValType": "static", + "resultVal": "True" + } + }, + { + "condition": "else result = 'False'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "False" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "9a8b4514-a921-48d6-be63-f053286a2acb", + "version": "KqlParameterItem/1.0", + "name": "Blank", + "type": 1, + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "", + "resourceType": "microsoft.insights/components" + }, + { + "id": "0e3e1001-dbf6-4ee8-8235-b8e19451a30d", + "version": "KqlParameterItem/1.0", + "name": "GridDestinationPort", + "type": 1, + "description": "Force blank if ", + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{GridDestinationPort}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{GridDestinationPort}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "28944bf4-98f9-42ce-8f1f-b2a6e077347a", + "version": "KqlParameterItem/1.0", + "name": "HeadingDestinationPort", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridDestinationPort != Blank), result = ' > 🔸 {GridDestinationPort}'", + "criteriaContext": { + "leftOperand": "GridDestinationPort", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": " > 🔸 {GridDestinationPort}" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "", + "resourceType": "microsoft.insights/components" + }, + { + "id": "02d4b80c-fc1f-4a4e-8fc7-c35ce670ace7", + "version": "KqlParameterItem/1.0", + "name": "HeadingRemoteIp", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridRemoteIp != Blank), result = ' > 🌐 {GridRemoteIp}'", + "criteriaContext": { + "leftOperand": "GridRemoteIp", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": " > 🌐 {GridRemoteIp}" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "", + "resourceType": "microsoft.insights/components" + }, + { + "id": "7a5e3753-c1ae-4a94-b8f9-82c71ca46198", + "version": "KqlParameterItem/1.0", + "name": "HeadingDirection", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Direction == 'outbound'), result = '{HeadingRemoteIp} {HeadingDestinationPort}'", + "criteriaContext": { + "leftOperand": "Direction", + "operator": "==", + "rightValType": "static", + "rightVal": "outbound", + "resultValType": "static", + "resultVal": "{HeadingRemoteIp} {HeadingDestinationPort}" + } + }, + { + "condition": "else result = '{HeadingDestinationPort} {HeadingRemoteIp}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{HeadingDestinationPort} {HeadingRemoteIp}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "", + "resourceType": "microsoft.insights/components" + }, + { + "id": "e8d8beb6-0109-454f-a4e2-6c79addce3b0", + "version": "KqlParameterItem/1.0", + "name": "HeadingProcess", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridProcessName != Blank), result = ' > 🎫 {GridProcessName}'", + "criteriaContext": { + "leftOperand": "GridProcessName", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": " > 🎫 {GridProcessName}" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "", + "resourceType": "microsoft.insights/components" + }, + { + "id": "1ce27926-6842-497b-ac53-70c006e11231", + "version": "KqlParameterItem/1.0", + "name": "Heading", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '💻 {GridComputerName} {HeadingProcess} {HeadingDirection}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "💻 {GridComputerName} {HeadingProcess} {HeadingDirection}" + } + } + ], + "value": "", + "resourceType": "microsoft.insights/components" + }, + { + "id": "4a155a6b-f28a-49c4-b3e3-a975316dcf20", + "version": "KqlParameterItem/1.0", + "name": "QueryProcessName", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridProcessName != Blank), result = ' | where ProcessName == \"{GridProcessName}\"'", + "criteriaContext": { + "leftOperand": "GridProcessName", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": " | where ProcessName == \"{GridProcessName}\"" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "128e1c98-bae2-431c-99b7-ed214988e02b", + "version": "KqlParameterItem/1.0", + "name": "QueryRemoteIp", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridRemoteIp != Blank), result = ' | where RemoteIp == \"{GridRemoteIp}\"'", + "criteriaContext": { + "leftOperand": "GridRemoteIp", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": " | where RemoteIp == \"{GridRemoteIp}\"" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "87897941-a28b-479d-a03b-921cdd1d36f5", + "version": "KqlParameterItem/1.0", + "name": "QueryDestinationPort", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridDestinationPort != Blank), result = ' | where DestinationPort == \"{GridDestinationPort}\"'", + "criteriaContext": { + "leftOperand": "GridDestinationPort", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": " | where DestinationPort == \"{GridDestinationPort}\"" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "b44edb14-76ad-48b3-9921-b5dfb5a6db60", + "version": "KqlParameterItem/1.0", + "name": "QueryFilter", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridComputerName != Blank), result = '| where Computer == \"{GridComputerName}\" {QueryDestinationPort} {QueryRemoteIp} {QueryProcessName}'", + "criteriaContext": { + "leftOperand": "GridComputerName", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": "| where Computer == \"{GridComputerName}\" {QueryDestinationPort} {QueryRemoteIp} {QueryProcessName}" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 6" + }, + { + "type": 1, + "content": { + "json": "

{Heading}

" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "### Responses" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 8" + }, + { + "type": 1, + "content": { + "json": "### Latency" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 9" + }, + { + "type": 1, + "content": { + "json": "### Network" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 10" + }, + { + "type": 1, + "content": { + "json": "### Links" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 11" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection \r\n| parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n{vmSnippet}\r\n{QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize Responses = sum(Responses) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection \r\n| parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n{vmSnippet}\r\n{QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize P50 = percentiles(ResponseTimeSum, 50), P90 = percentiles(ResponseTimeSum, 90), P95 = percentiles(ResponseTimeSum, 95) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "aggregation": 3, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection \r\n| parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n{vmSnippet}\r\n{QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize Sent = sum(BytesSent), Received = sum(BytesReceived) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 14" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection \r\n| parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n{vmSnippet}\r\n{QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize MaxOpenPorts = max(LinksLive), SumFailed = sum(LinksFailed) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "aggregation": 3, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 15" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Virtual Machines - Network Dependencies/Workbooks/Connections Overview (Azure Preview)/settings.json b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview (Azure Preview)/settings.json new file mode 100644 index 0000000..69c6075 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview (Azure Preview)/settings.json @@ -0,0 +1,10 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Connections Overview (Azure Preview)", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 100 }, + { "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorVirtualMachines", "order": 100 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Connections Overview - Single VM (Preview)/Connections Overview.workbook b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview - Single VM (Preview)/Connections Overview.workbook new file mode 100644 index 0000000..65f1dd1 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview - Single VM (Preview)/Connections Overview.workbook @@ -0,0 +1,1067 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "

Connections Overview

" + }, + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "e41c2177-932a-4c58-ba24-03ef070eb197", + "version": "KqlParameterItem/1.0", + "name": "Computer", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "a9393837-8ef0-40e5-b223-4df1208a691e", + "version": "KqlParameterItem/1.0", + "name": "Test", + "type": 1, + "query": "VMConnection\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines", + "value": null + }, + { + "id": "648ac90d-4be5-4c08-ac13-bcff7f8ddbf9", + "version": "KqlParameterItem/1.0", + "name": "DisclaimerText", + "type": 1, + "query": "print iff('{Test}' == '' , 'This workbook requires [Azure Monitor for VMs (preview)](https://aka.ms/vminsights) enabled', iff('{Test}' == '0', '⚠ There is currently no `VMConnection` data for this virtual machine', ''))", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "conditionalVisibility": { + "parameterName": "_", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "{DisclaimerText}" + }, + "name": "text - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "addcec31-b7ac-4715-a78d-9b803f86af8a", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-01-28T23:37:45.026Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-01-28T23:37:45.026Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-01-28T23:37:45.026Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "label": "Time Range" + }, + { + "id": "db9b2f1d-188a-4dda-af4a-b39deeb34da3", + "version": "KqlParameterItem/1.0", + "name": "Direction", + "type": 2, + "description": "Direction of the network connection from the VMs", + "isRequired": true, + "value": "outbound", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"inbound\", \"label\":\"Inbound\" },\r\n { \"value\":\"outbound\", \"label\":\"Outbound\" }\r\n]" + }, + { + "id": "488d1f86-cabc-4fcc-8dc9-9a2e5803fb20", + "version": "KqlParameterItem/1.0", + "name": "ComputerFilter", + "type": 1, + "isRequired": true, + "query": "let computerFilter = strcat(\"| where Computer == \", \"'{Computer:label}'\");\r\nprint(computerFilter)", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "56ab6626-c12d-4de1-8a3d-8a6099db3cd3", + "version": "KqlParameterItem/1.0", + "name": "hierarchy", + "type": 1, + "isRequired": true, + "value": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Direction == 'inbound'), result = '[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Port -> Remote IP\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Port\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]'", + "criteriaContext": { + "leftOperand": "Direction", + "operator": "==", + "rightValType": "static", + "rightVal": "inbound", + "resultValType": "static", + "resultVal": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Port -> Remote IP\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Port\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]" + } + }, + { + "condition": "else result = '[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "8be4bd82-b145-4602-af53-52c9e8f8d51e", + "version": "KqlParameterItem/1.0", + "name": "Hierarchy", + "type": 2, + "description": "Select the level of detail to be shown in the table below", + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"{hierarchy}\",\"transformers\":[{\"type\":\"jsonpath\"}]}", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "5526f711-6d04-469e-8d06-351508f1014e", + "version": "KqlParameterItem/1.0", + "name": "TableFilter", + "type": 2, + "description": "Filter table based on presence of malicious connections or at least one link failing", + "multiSelect": true, + "quote": "", + "delimiter": "", + "value": [], + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"Only Malicious Connections\",\r\n \"value\": \" | where MaliciousConnectionsCount >= 1\"\r\n },\r\n {\r\n \"label\": \"Only Links Failed\",\r\n \"value\": \" | where LinksFailed >= 1\"\r\n }\r\n]", + "label": "Table Filter" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "parameters - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "5e335a1b-7f99-4647-854a-d7b5cb489bb2", + "version": "KqlParameterItem/1.0", + "name": "ServiceMapComputers", + "type": 1, + "isRequired": true, + "query": "print(\"let computers = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | summarize (TimeGenerated, Properties) = arg_max(TimeGenerated, pack_all()) by Computer;\");", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "c69fbaae-4fd2-4527-acdd-a2c358eebffa", + "version": "KqlParameterItem/1.0", + "name": "MaliciousIpData", + "type": 1, + "query": "print(\"let maliciousIpData = VMConnection | where TimeGenerated {TimeRange} | where Direction == '{Direction}' {ComputerFilter} | where MaliciousIp != '' | summarize by Computer, ProcessName, MaliciousIp, DestinationPort, RemoteIp, IsActive, IndicatorThreatType, RemoteCountry, RemoteLongitude, RemoteLatitude, Confidence, Severity, FirstReportedDateTime, LastReportedDateTime | project MaliciousIp = strcat(Computer, '-', ProcessName, '-', MaliciousIp), MaliciousPort = strcat(Computer, '-', ProcessName, '-', DestinationPort), MaliciousPortIp = strcat(Computer, '-', ProcessName, '-', DestinationPort, '-', RemoteIp), Computer = Computer, Process = strcat(Computer, '-', ProcessName), MaliciousIpInfo = pack('Malicious IP', MaliciousIp, 'Is Active', IsActive, 'Indicator Threat Type', IndicatorThreatType, 'Remote Country', RemoteCountry, 'Longitude', RemoteLongitude, 'Latitude', RemoteLatitude, 'Confidence', Confidence, 'Severity', Severity, 'First Reported DateTime', FirstReportedDateTime, 'Last Reported DateTime', LastReportedDateTime, 'Destination Port', DestinationPort, 'Remote IP', RemoteIp);\");", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "dd933ac8-1273-48fe-8d09-bd65d857ce83", + "version": "KqlParameterItem/1.0", + "name": "ComputerData", + "type": 1, + "query": "print(\"let computerData = VMConnection | where TimeGenerated {TimeRange} | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Name = strcat('🖥️ ', Computer), ComputerName = Computer, Type = 'Computer', TypeKey = 1, Key = Computer, ParentKey = '---' | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Computer) on $left.Key == $right.Computer | project-away Computer | order by Name asc;\");", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "fb879823-c082-4c53-af7e-18d044032f99", + "version": "KqlParameterItem/1.0", + "name": "RemoteIpDataInbound", + "type": 1, + "query": "print(\"let remoteIpDataInbound = VMConnection | where TimeGenerated {TimeRange} | where Direction == 'inbound' | where 'inbound' == 'inbound' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort), '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), Id = strcat(Computer, '-', ProcessName, '-', RemoteIp), ComputerName = Computer | join kind=inner sourcePortData on $left.ParentKey == $right.Key | project-away AverageResponseTime1, Computer1, Key1, LinksFailed1, MaxLinksLive1, ParentKey1, ProcessName1, Responses1, TotalBytesReceived1, TotalBytesSent1, Type1, TypeKey1 | order by Name asc | join kind=leftouter ipComputerMapping on $left.RemoteIp == $right.Ipv4 | extend Name = iff(RemoteIp == '', 'Unknown', strcat('🌐 External (', RemoteIp, ')')) | project-away Computer, Ipv4 | order by Name desc | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPortIp | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIp, Computer, Process, Computer1, MaliciousIpInfo1, Id;\");", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "3ad60c70-b530-49c0-a59b-8df690dffbc8", + "version": "KqlParameterItem/1.0", + "name": "ProcessName", + "type": 1, + "query": "print(\"let processData = VMConnection | where TimeGenerated {TimeRange} | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, Name = strcat('🎫 ', ProcessName), Type = 'Process', TypeKey = 2, Key = strcat(Computer, '-', ProcessName), ParentKey = Computer, ComputerName = Computer | join kind=inner computerData on $left.ParentKey == $right.Key | project-away Name1, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Process) on $left.Key == $right.Process | project-away Process, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | order by Name asc;\");", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "c9eea7db-3d14-4fbf-8ae6-b7507ec1d43f", + "version": "KqlParameterItem/1.0", + "name": "RemoteIpData", + "type": 1, + "isRequired": true, + "query": "print(\"let remoteIpData = VMConnection | where TimeGenerated {TimeRange} | where '{Direction}' == 'outbound' | where Direction == '{Direction}' {ComputerFilter} | extend RemoteIp = iff(Direction == 'outbound', DestinationIp, SourceIp) | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=inner processData on $left.ParentKey == $right.Key | project-away Name, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousIp | project-away MaliciousIp, Computer, Process, Computer1, Computer2, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | join kind = leftouter (ipComputerMapping) on $left.RemoteIp == $right.Ipv4 | extend Name = iff(Computer == '', iff(RemoteIp == '127.0.0.1', '🌐 Localhost', strcat('🌐 External (', RemoteIp, ')')), strcat('🖥️ ', Computer)) | project-away Computer, Ipv4 | order by Name desc;\")", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "4a9ed59b-002e-4c81-b437-8456faeef6a6", + "version": "KqlParameterItem/1.0", + "name": "SourcePortData", + "type": 1, + "query": "print(\"let sourcePortData = VMConnection | where TimeGenerated {TimeRange} | where Direction == '{Direction}' | where '{Direction}' == 'inbound' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPort | extend MaliciousIpInfo = tostring(MaliciousIpInfo) | project-away Computer1, MaliciousIp, MaliciousPort, MaliciousPortIp, Process; {RemoteIpDataInbound}\");", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "e31a8d21-e24b-45ec-9806-e6c45bca15aa", + "version": "KqlParameterItem/1.0", + "name": "DestinationPortData", + "type": 1, + "query": "print(\"let destinationPortData = VMConnection | where TimeGenerated {TimeRange} | where Direction == '{Direction}' | where '{Direction}' == 'outbound' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', DestinationIp, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName, '-', DestinationIp), ComputerName = Computer | join kind=inner remoteIpData on $left.ParentKey == $right.Key | project-away Name1, Responses1, Type1, Key1, ParentKey1 | order by Name asc;\");", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "a54f3df8-c872-4a19-a280-84b203987ec8", + "version": "KqlParameterItem/1.0", + "name": "QueryProject", + "type": 1, + "query": "print(\"| where Type != 'Overall' | extend MaliciousConnectionsCount = iff(MaliciousIpInfo == '', 0, iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', tolong(MaliciousIpInfo), 1)) | project ComputerName, ProcessName, RemoteIp, DestinationPort, Name = iff(Name == '🎫 ', '🎫 ', Name), Type, MaliciousConnections = iff(MaliciousIpInfo == '', '✅ No Malicious Connections', iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', iff(MaliciousConnectionsCount > 1, strcat('❌ ', MaliciousIpInfo, ' Malicious Connections'), strcat('❌ ', MaliciousIpInfo, ' Malicious Connection')), '❌ Malicious Connection')), Responses, MaxLinksLive, LinksFailed, AverageResponseTime, TotalBytesSent, TotalBytesReceived, Info = iff(MaliciousIpInfo != '', MaliciousIpInfo, ''), Key, ParentKey, TypeKey, MaliciousConnectionsCount | order by TypeKey asc, MaliciousConnectionsCount desc, LinksFailed desc, AverageResponseTime desc, Responses desc, MaxLinksLive desc, Name asc | project-away TypeKey\");", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "9789ead5-eae5-4f52-86c2-ac197da62f30", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process_IP_Port", + "type": 1, + "query": "print(strcat(\"{ServiceMapComputers}\", \" let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); \", \"{MaliciousIpData}\", \" let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; \", \"{ComputerData}\", \"{ProcessName}\", \"{RemoteIpData}\", \"{DestinationPortData}\", \"{SourcePortData}\", \" let overalldata = VMConnection | where TimeGenerated {TimeRange} | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; computerData | union processData | union remoteIpData | union destinationPortData | union remoteIpDataInbound | union sourcePortData | union overalldata\t\", \"{QueryProject}\"));", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "0d6a320e-2cef-44fd-ac0b-ad833f8d0c03", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process_IP", + "type": 1, + "query": "print(strcat(\"{ServiceMapComputers}\", \" let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); \", \"{MaliciousIpData}\", \" let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; \", \"{ComputerData}\", \"{ProcessName}\", \"{RemoteIpData}\", \"{SourcePortData}\", \" let overalldata = VMConnection | where TimeGenerated {TimeRange} | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1;\" ,\" computerData | union processData | union remoteIpData | union sourcePortData | union overalldata \", \"{QueryProject}\"));", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "2de0d685-4382-4822-a8aa-f3583ff11b66", + "version": "KqlParameterItem/1.0", + "name": "QueryPadDestinationPortTable", + "type": 1, + "isRequired": true, + "value": "let destinationPortPadding = datatable (DestinationPort: string) [];", + "isHiddenWhenLocked": true + }, + { + "id": "df8a6322-511e-40e0-a258-fe717099a072", + "version": "KqlParameterItem/1.0", + "name": "QueryPadRemoteIpTable", + "type": 1, + "isRequired": true, + "value": "let remoteIpPadding = datatable (RemoteIp: string) [];", + "isHiddenWhenLocked": true + }, + { + "id": "e8f2c394-18e8-4d6d-8f5e-8453cb67128c", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process", + "type": 1, + "query": "print(strcat(\"{ServiceMapComputers}\", \" let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); \", \"{MaliciousIpData}\", \" let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; \", \"{ComputerData}\", \"{ProcessName}\", \" let overalldata = VMConnection | where TimeGenerated {TimeRange} | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1;\", \"{QueryPadDestinationPortTable}\", \"{QueryPadRemoteIpTable}\",\" computerData | union remoteIpPadding | union destinationPortPadding | union processData | union overalldata \", \"{QueryProject}\"));", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "084fb5fc-e8e4-42df-8a9f-ac1001950ba2", + "version": "KqlParameterItem/1.0", + "name": "QueryPadProcessNameTable", + "type": 1, + "isRequired": true, + "value": "let processNamePadding = datatable (ProcessName: string) [];", + "isHiddenWhenLocked": true + }, + { + "id": "a4b0e146-7c89-40bb-ade2-ed2e392e9311", + "version": "KqlParameterItem/1.0", + "name": "Computer_Query", + "type": 1, + "query": "print(strcat(\"{ServiceMapComputers}\", \" let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); \", \"{MaliciousIpData}\", \" let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; \", \"{ComputerData}\", \" let overalldata = VMConnection | where TimeGenerated {TimeRange} | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1;\", \"{QueryPadDestinationPortTable}\", \"{QueryPadRemoteIpTable}\", \"{QueryPadProcessNameTable}\",\" computerData | union remoteIpPadding | union processNamePadding | union destinationPortPadding | union overalldata \", \"{QueryProject}\"));", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "a08757da-e72b-474d-a1d2-65fb7020cc14", + "version": "KqlParameterItem/1.0", + "name": "FinalQuery", + "type": 1, + "query": "print(strcat(\r\niff({Hierarchy} == 0, \"{Computer_Process_IP_Port}\", \r\niff({Hierarchy} == 1, \"{Computer_Process_IP}\",\r\niff({Hierarchy} == 2, \"{Computer_Process}\",\r\niff({Hierarchy} == 3, \"{Computer}\", \"{Computer}\")))),'{TableFilter:value}'));", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "874eeebe-2ea2-4c04-a3b9-ab3b30e95573", + "version": "KqlParameterItem/1.0", + "name": "ConnectionGrid", + "type": 1, + "value": "{}", + "isHiddenWhenLocked": true + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "name": "parameters - 4" + }, + { + "type": 1, + "content": { + "json": "💡 Select a row from the table below to view connection details for that entry." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "text - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{FinalQuery:value}", + "size": 0, + "showAnalytics": true, + "noDataMessage": "No data to be shown for this particular scope combination, please adjust the time range, table filters, etc.", + "exportParameterName": "ConnectionGrid", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Computer", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ProcessName", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "RemoteIp", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DestinationPort", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Responses", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "MaxLinksLive", + "formatter": 4, + "formatOptions": { + "palette": "lightBlue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "LinksFailed", + "formatter": 4, + "formatOptions": { + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "AverageResponseTime", + "formatter": 4, + "formatOptions": { + "palette": "purple", + "showIcon": true + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalBytesSent", + "formatter": 4, + "formatOptions": { + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalBytesReceived", + "formatter": 4, + "formatOptions": { + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Info", + "formatter": 5, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info", + "showIcon": true + } + }, + { + "columnMatch": "Key", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ParentKey", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "MaliciousConnectionsCount", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "idColumn": "Key", + "parentColumn": "ParentKey", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": true + }, + "labelSettings": [ + { + "columnId": "ComputerName", + "label": "ComputerName" + }, + { + "columnId": "ProcessName", + "label": "ProcessName" + }, + { + "columnId": "RemoteIp", + "label": "RemoteIp" + }, + { + "columnId": "DestinationPort", + "label": "DestinationPort" + }, + { + "columnId": "Name", + "label": "Name" + }, + { + "columnId": "Type", + "label": "Type" + }, + { + "columnId": "MaliciousConnections", + "label": "MaliciousConnections" + }, + { + "columnId": "Responses", + "label": "Responses" + }, + { + "columnId": "MaxLinksLive", + "label": "MaxLinksLive" + }, + { + "columnId": "LinksFailed", + "label": "LinksFailed" + }, + { + "columnId": "AverageResponseTime", + "label": "AverageResponseTime" + }, + { + "columnId": "TotalBytesSent", + "label": "TotalBytesSent" + }, + { + "columnId": "TotalBytesReceived", + "label": "TotalBytesReceived" + }, + { + "columnId": "Info", + "label": "Info" + }, + { + "columnId": "Key", + "label": "Key" + }, + { + "columnId": "ParentKey", + "label": "ParentKey" + }, + { + "columnId": "MaliciousConnectionsCount", + "label": "MaliciousConnectionsCount" + } + ] + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "KPIValue", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": "" + }, + "showPin": true, + "name": "query - 6" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "7e4c3d29-2be6-4288-903b-95502ddab577", + "version": "KqlParameterItem/1.0", + "name": "ComputerName", + "type": 1, + "query": "let row = dynamic({ConnectionGrid});\r\nlet computerName = row.ComputerName;\r\nprint computerName", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "3bda15ac-c4ea-487f-acf5-2c14c8d33038", + "version": "KqlParameterItem/1.0", + "name": "ProcessName", + "type": 1, + "query": "let row = dynamic({ConnectionGrid});\r\nlet ProcessName = row.ProcessName;\r\nprint ProcessName", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "e424020b-8c6e-4a06-9639-ed696192442a", + "version": "KqlParameterItem/1.0", + "name": "RemoteIp", + "type": 1, + "query": "let row = dynamic({ConnectionGrid});\r\nlet RemoteIp = row.RemoteIp;\r\nprint RemoteIp", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "a479367c-f99b-4c93-b18c-51f07ce5069d", + "version": "KqlParameterItem/1.0", + "name": "DestinationPort", + "type": 1, + "query": "let row = dynamic({ConnectionGrid});\r\nlet destinationPort = row.DestinationPort;\r\nprint destinationPort", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "dcf5f274-fbbf-4fb8-8c35-6b528a08cac9", + "version": "KqlParameterItem/1.0", + "name": "ShowDetail", + "type": 1, + "isRequired": true, + "query": "print(strcat('{ComputerName}{ProcessName}{RemoteIp}{DestinationPort}' != ''))", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "1ce27926-6842-497b-ac53-70c006e11231", + "version": "KqlParameterItem/1.0", + "name": "Heading", + "type": 1, + "query": "print(strcat('💻 {ComputerName}',iff('{ProcessName}' != '',' > 🎫 {ProcessName}',''),iff('{Direction}' == 'outbound',strcat(iff('{RemoteIp}' != '',' > 🌐 {RemoteIp}',''),iff('{DestinationPort}' != '',' > 🔸 {DestinationPort}','')),strcat(iff('{DestinationPort}' != '',' > 🔸 {DestinationPort}',''),iff('{RemoteIp}' != '',' > 🌐 {RemoteIp}','')))))", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "b44edb14-76ad-48b3-9921-b5dfb5a6db60", + "version": "KqlParameterItem/1.0", + "name": "QueryFilter", + "type": 1, + "query": "print(strcat(' where Computer == \"{ComputerName}\"',iff('{ProcessName}' != '', ' | where ProcessName == \"{ProcessName}\"', ''),iff('{RemoteIp}' != '',' | where RemoteIp == \"{RemoteIp}\"',''),iff('{DestinationPort}' != '',' | where DestinationPort == \"{DestinationPort}\"','')));", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "name": "parameters - 7" + }, + { + "type": 1, + "content": { + "json": "

{Heading}

" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "text - 8" + }, + { + "type": 1, + "content": { + "json": "### Responses" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 9" + }, + { + "type": 1, + "content": { + "json": "### Latency" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 10" + }, + { + "type": 1, + "content": { + "json": "### Network" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 11" + }, + { + "type": 1, + "content": { + "json": "### Links" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| {QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize Responses = sum(Responses) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| {QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize P50 = percentiles(ResponseTimeSum, 50), P90 = percentiles(ResponseTimeSum, 90), P95 = percentiles(ResponseTimeSum, 95) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "aggregation": 3, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "linechart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 14" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| {QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize Sent = sum(BytesSent), Received = sum(BytesReceived) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 15" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| {QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize MaxOpenPorts = max(LinksLive), SumFailed = sum(LinksFailed) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "aggregation": 3, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 16" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Connections Overview - Single VM (Preview)/settings.json b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview - Single VM (Preview)/settings.json new file mode 100644 index 0000000..8e36cf3 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview - Single VM (Preview)/settings.json @@ -0,0 +1,10 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Connections Overview (preview)", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "performance-vm", "resourceType": "microsoft.compute/virtualmachines", "order": 200 }, + { "type": "insights", "resourceType": "microsoft.compute/virtualmachines", "order": 200 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Connections Overview - Single VM/Connections Overview.workbook b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview - Single VM/Connections Overview.workbook new file mode 100644 index 0000000..9f230e5 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview - Single VM/Connections Overview.workbook @@ -0,0 +1,1565 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "

Connections Overview

" + }, + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{WorkbookResource}" + ], + "parameters": [ + { + "id": "bda827a1-fadb-4ff4-aa22-02c051d28f0a", + "version": "KqlParameterItem/1.0", + "name": "WorkbookResource", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "efbc17e6-a098-4706-8034-00e5ec8b4203", + "version": "KqlParameterItem/1.0", + "name": "resourceType", + "type": 7, + "isRequired": true, + "query": "take 1\r\n| project rt = \"{WorkbookResource:resourcetype}\"", + "crossComponentResources": [ + "value::selected" + ], + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "a9393837-8ef0-40e5-b223-4df1208a691e", + "version": "KqlParameterItem/1.0", + "name": "Test", + "type": 1, + "query": "VMConnection\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{WorkbookResource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "648ac90d-4be5-4c08-ac13-bcff7f8ddbf9", + "version": "KqlParameterItem/1.0", + "name": "DisclaimerText", + "type": 1, + "query": "print iff('{Test}' == '' , 'This workbook requires [Azure Monitor for VMs (preview)](https://aka.ms/vminsights) enabled', iff('{Test}' == '0', '⚠ There is currently no `VMConnection` data for this virtual machine', ''))", + "crossComponentResources": [ + "{WorkbookResource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "_", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "{DisclaimerText}" + }, + "name": "text - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{WorkbookResource}" + ], + "parameters": [ + { + "id": "addcec31-b7ac-4715-a78d-9b803f86af8a", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-01-28T23:37:45.026Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-01-28T23:37:45.026Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-01-28T23:37:45.026Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "label": "Time Range" + }, + { + "id": "db9b2f1d-188a-4dda-af4a-b39deeb34da3", + "version": "KqlParameterItem/1.0", + "name": "Direction", + "type": 2, + "description": "Direction of the network connection from the VMs", + "isRequired": true, + "value": "outbound", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"inbound\", \"label\":\"Inbound\" },\r\n { \"value\":\"outbound\", \"label\":\"Outbound\" }\r\n]" + }, + { + "id": "488d1f86-cabc-4fcc-8dc9-9a2e5803fb20", + "version": "KqlParameterItem/1.0", + "name": "vmSnippet", + "type": 1, + "isRequired": true, + "query": "let computerFilter = strcat(\"| where _ResourceId =~ \", \"{WorkbookResource:value}\");\r\nprint(computerFilter)", + "crossComponentResources": [ + "{WorkbookResource}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "{resourceType}" + }, + { + "id": "56ab6626-c12d-4de1-8a3d-8a6099db3cd3", + "version": "KqlParameterItem/1.0", + "name": "hierarchy", + "type": 1, + "isRequired": true, + "value": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Direction == 'inbound'), result = '[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Port -> Remote IP\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Port\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]'", + "criteriaContext": { + "leftOperand": "Direction", + "operator": "==", + "rightValType": "static", + "rightVal": "inbound", + "resultValType": "static", + "resultVal": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Port -> Remote IP\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Port\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]" + } + }, + { + "condition": "else result = '[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "8be4bd82-b145-4602-af53-52c9e8f8d51e", + "version": "KqlParameterItem/1.0", + "name": "Hierarchy", + "type": 2, + "description": "Select the level of detail to be shown in the table below", + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"{hierarchy}\",\"transformers\":[{\"type\":\"jsonpath\"}]}", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "5526f711-6d04-469e-8d06-351508f1014e", + "version": "KqlParameterItem/1.0", + "name": "TableFilter", + "type": 2, + "description": "Filter table based on presence of malicious connections or at least one link failing", + "multiSelect": true, + "quote": "", + "delimiter": "", + "value": [], + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"Only Malicious Connections\",\r\n \"value\": \" | where MaliciousConnectionsCount >= 1\"\r\n },\r\n {\r\n \"label\": \"Only Links Failed\",\r\n \"value\": \" | where LinksFailed >= 1\"\r\n }\r\n]", + "label": "Table Filter" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "{resourceType}" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "parameters - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{WorkbookResource}" + ], + "parameters": [ + { + "id": "5e335a1b-7f99-4647-854a-d7b5cb489bb2", + "version": "KqlParameterItem/1.0", + "name": "ServiceMapComputers", + "type": 1, + "isRequired": true, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let computers = ServiceMapComputer_CL | summarize (TimeGenerated, Properties) = arg_max(TimeGenerated, pack_all()) by Computer;'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let computers = ServiceMapComputer_CL | summarize (TimeGenerated, Properties) = arg_max(TimeGenerated, pack_all()) by Computer;" + } + } + ] + }, + { + "id": "c69fbaae-4fd2-4527-acdd-a2c358eebffa", + "version": "KqlParameterItem/1.0", + "name": "MaliciousIpData", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let maliciousIpData = VMConnection {vmSnippet} | where Direction == '{Direction}' | where MaliciousIp != '' | summarize by Computer, ProcessName, MaliciousIp, DestinationPort, RemoteIp, IsActive, IndicatorThreatType, RemoteCountry, RemoteLongitude, RemoteLatitude, Confidence, Severity, FirstReportedDateTime, LastReportedDateTime | project MaliciousIp = strcat(Computer, '-', ProcessName, '-', MaliciousIp), MaliciousPort = strcat(Computer, '-', ProcessName, '-', DestinationPort), MaliciousPortIp = strcat(Computer, '-', ProcessName, '-', DestinationPort, '-', RemoteIp), Computer = Computer, Process = strcat(Computer, '-', ProcessName), MaliciousIpInfo = pack('Malicious IP', MaliciousIp, 'Is Active', IsActive, 'Indicator Threat Type', IndicatorThreatType, 'Remote Country', RemoteCountry, 'Longitude', RemoteLongitude, 'Latitude', RemoteLatitude, 'Confidence', Confidence, 'Severity', Severity, 'First Reported DateTime', FirstReportedDateTime, 'Last Reported DateTime', LastReportedDateTime, 'Destination Port', DestinationPort, 'Remote IP', RemoteIp);'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let maliciousIpData = VMConnection {vmSnippet} | where Direction == '{Direction}' | where MaliciousIp != '' | summarize by Computer, ProcessName, MaliciousIp, DestinationPort, RemoteIp, IsActive, IndicatorThreatType, RemoteCountry, RemoteLongitude, RemoteLatitude, Confidence, Severity, FirstReportedDateTime, LastReportedDateTime | project MaliciousIp = strcat(Computer, '-', ProcessName, '-', MaliciousIp), MaliciousPort = strcat(Computer, '-', ProcessName, '-', DestinationPort), MaliciousPortIp = strcat(Computer, '-', ProcessName, '-', DestinationPort, '-', RemoteIp), Computer = Computer, Process = strcat(Computer, '-', ProcessName), MaliciousIpInfo = pack('Malicious IP', MaliciousIp, 'Is Active', IsActive, 'Indicator Threat Type', IndicatorThreatType, 'Remote Country', RemoteCountry, 'Longitude', RemoteLongitude, 'Latitude', RemoteLatitude, 'Confidence', Confidence, 'Severity', Severity, 'First Reported DateTime', FirstReportedDateTime, 'Last Reported DateTime', LastReportedDateTime, 'Destination Port', DestinationPort, 'Remote IP', RemoteIp);" + } + } + ] + }, + { + "id": "dd933ac8-1273-48fe-8d09-bd65d857ce83", + "version": "KqlParameterItem/1.0", + "name": "ComputerData", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let computerData = VMConnection {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Name = strcat('🖥️ ', Computer), ComputerName = Computer, Type = 'Computer', TypeKey = 1, Key = Computer, ParentKey = '---' | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Computer) on $left.Key == $right.Computer | project-away Computer | order by Name asc;'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let computerData = VMConnection {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Name = strcat('🖥️ ', Computer), ComputerName = Computer, Type = 'Computer', TypeKey = 1, Key = Computer, ParentKey = '---' | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Computer) on $left.Key == $right.Computer | project-away Computer | order by Name asc;" + } + } + ] + }, + { + "id": "fb879823-c082-4c53-af7e-18d044032f99", + "version": "KqlParameterItem/1.0", + "name": "RemoteIpDataInbound", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let remoteIpDataInbound = VMConnection {vmSnippet} | where Direction == 'inbound' | where 'inbound' == 'inbound' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort), '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), Id = strcat(Computer, '-', ProcessName, '-', RemoteIp), ComputerName = Computer | join kind=inner sourcePortData on $left.ParentKey == $right.Key | project-away AverageResponseTime1, Computer1, Key1, LinksFailed1, MaxLinksLive1, ParentKey1, ProcessName1, Responses1, TotalBytesReceived1, TotalBytesSent1, Type1, TypeKey1 | order by Name asc | join kind=leftouter ipComputerMapping on $left.RemoteIp == $right.Ipv4 | extend Name = iff(RemoteIp == '', 'Unknown', strcat('🌐 External (', RemoteIp, ')')) | project-away Computer, Ipv4 | order by Name desc | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPortIp | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIp, Computer, Process, Computer1, MaliciousIpInfo1, Id;'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let remoteIpDataInbound = VMConnection {vmSnippet} | where Direction == 'inbound' | where 'inbound' == 'inbound' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort), '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), Id = strcat(Computer, '-', ProcessName, '-', RemoteIp), ComputerName = Computer | join kind=inner sourcePortData on $left.ParentKey == $right.Key | project-away AverageResponseTime1, Computer1, Key1, LinksFailed1, MaxLinksLive1, ParentKey1, ProcessName1, Responses1, TotalBytesReceived1, TotalBytesSent1, Type1, TypeKey1 | order by Name asc | join kind=leftouter ipComputerMapping on $left.RemoteIp == $right.Ipv4 | extend Name = iff(RemoteIp == '', 'Unknown', strcat('🌐 External (', RemoteIp, ')')) | project-away Computer, Ipv4 | order by Name desc | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPortIp | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIp, Computer, Process, Computer1, MaliciousIpInfo1, Id;" + } + } + ] + }, + { + "id": "3ad60c70-b530-49c0-a59b-8df690dffbc8", + "version": "KqlParameterItem/1.0", + "name": "ProcessName", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let processData = VMConnection {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, Name = strcat('🎫 ', ProcessName), Type = 'Process', TypeKey = 2, Key = strcat(Computer, '-', ProcessName), ParentKey = Computer, ComputerName = Computer | join kind=inner computerData on $left.ParentKey == $right.Key | project-away Name1, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Process) on $left.Key == $right.Process | project-away Process, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | order by Name asc;'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let processData = VMConnection {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, Name = strcat('🎫 ', ProcessName), Type = 'Process', TypeKey = 2, Key = strcat(Computer, '-', ProcessName), ParentKey = Computer, ComputerName = Computer | join kind=inner computerData on $left.ParentKey == $right.Key | project-away Name1, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Process) on $left.Key == $right.Process | project-away Process, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | order by Name asc;" + } + } + ] + }, + { + "id": "c9eea7db-3d14-4fbf-8ae6-b7507ec1d43f", + "version": "KqlParameterItem/1.0", + "name": "RemoteIpData", + "type": 1, + "isRequired": true, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let remoteIpData = VMConnection {vmSnippet} | where '{Direction}' == 'outbound' | where Direction == '{Direction}' | extend RemoteIp = iff(Direction == 'outbound', DestinationIp, SourceIp) | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=inner processData on $left.ParentKey == $right.Key | project-away Name, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousIp | project-away MaliciousIp, Computer, Process, Computer1, Computer2, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | join kind = leftouter (ipComputerMapping) on $left.RemoteIp == $right.Ipv4 | extend Name = iff(Computer == '', iff(RemoteIp == '127.0.0.1', '🌐 Localhost', strcat('🌐 External (', RemoteIp, ')')), strcat('🖥️ ', Computer)) | project-away Computer, Ipv4 | order by Name desc;'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let remoteIpData = VMConnection {vmSnippet} | where '{Direction}' == 'outbound' | where Direction == '{Direction}' | extend RemoteIp = iff(Direction == 'outbound', DestinationIp, SourceIp) | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=inner processData on $left.ParentKey == $right.Key | project-away Name, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousIp | project-away MaliciousIp, Computer, Process, Computer1, Computer2, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | join kind = leftouter (ipComputerMapping) on $left.RemoteIp == $right.Ipv4 | extend Name = iff(Computer == '', iff(RemoteIp == '127.0.0.1', '🌐 Localhost', strcat('🌐 External (', RemoteIp, ')')), strcat('🖥️ ', Computer)) | project-away Computer, Ipv4 | order by Name desc;" + } + } + ] + }, + { + "id": "4a9ed59b-002e-4c81-b437-8456faeef6a6", + "version": "KqlParameterItem/1.0", + "name": "SourcePortData", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let sourcePortData = VMConnection {vmSnippet} | where Direction == '{Direction}' | where '{Direction}' == 'inbound' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPort | extend MaliciousIpInfo = tostring(MaliciousIpInfo) | project-away Computer1, MaliciousIp, MaliciousPort, MaliciousPortIp, Process; {RemoteIpDataInbound}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let sourcePortData = VMConnection {vmSnippet} | where Direction == '{Direction}' | where '{Direction}' == 'inbound' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPort | extend MaliciousIpInfo = tostring(MaliciousIpInfo) | project-away Computer1, MaliciousIp, MaliciousPort, MaliciousPortIp, Process; {RemoteIpDataInbound}" + } + } + ] + }, + { + "id": "e31a8d21-e24b-45ec-9806-e6c45bca15aa", + "version": "KqlParameterItem/1.0", + "name": "DestinationPortData", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let destinationPortData = VMConnection {vmSnippet} | where Direction == '{Direction}' | where '{Direction}' == 'outbound' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', DestinationIp, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName, '-', DestinationIp), ComputerName = Computer | join kind=inner remoteIpData on $left.ParentKey == $right.Key | project-away Name1, Responses1, Type1, Key1, ParentKey1 | order by Name asc;'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let destinationPortData = VMConnection {vmSnippet} | where Direction == '{Direction}' | where '{Direction}' == 'outbound' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', DestinationIp, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName, '-', DestinationIp), ComputerName = Computer | join kind=inner remoteIpData on $left.ParentKey == $right.Key | project-away Name1, Responses1, Type1, Key1, ParentKey1 | order by Name asc;" + } + } + ] + }, + { + "id": "a54f3df8-c872-4a19-a280-84b203987ec8", + "version": "KqlParameterItem/1.0", + "name": "QueryProject", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '| extend MaliciousConnectionsCount = iff(MaliciousIpInfo == '', 0, iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', tolong(MaliciousIpInfo), 1)) | project ComputerName, ProcessName, RemoteIp, DestinationPort, Name = iff(Name == '🎫 ', '🎫 ', Name), Type, MaliciousConnections = iff(MaliciousIpInfo == '', '✅ No Malicious Connections', iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', iff(MaliciousConnectionsCount > 1, strcat('❌ ', MaliciousIpInfo, ' Malicious Connections'), strcat('❌ ', MaliciousIpInfo, ' Malicious Connection')), '❌ Malicious Connection')), Responses, MaxLinksLive, LinksFailed, AverageResponseTime, TotalBytesSent, TotalBytesReceived, Info = iff(MaliciousIpInfo != '', MaliciousIpInfo, ''), Key, ParentKey, TypeKey, MaliciousConnectionsCount | order by TypeKey asc, MaliciousConnectionsCount desc, LinksFailed desc, AverageResponseTime desc, Responses desc, MaxLinksLive desc, Name asc | project-away TypeKey'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| extend MaliciousConnectionsCount = iff(MaliciousIpInfo == '', 0, iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', tolong(MaliciousIpInfo), 1)) | project ComputerName, ProcessName, RemoteIp, DestinationPort, Name = iff(Name == '🎫 ', '🎫 ', Name), Type, MaliciousConnections = iff(MaliciousIpInfo == '', '✅ No Malicious Connections', iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', iff(MaliciousConnectionsCount > 1, strcat('❌ ', MaliciousIpInfo, ' Malicious Connections'), strcat('❌ ', MaliciousIpInfo, ' Malicious Connection')), '❌ Malicious Connection')), Responses, MaxLinksLive, LinksFailed, AverageResponseTime, TotalBytesSent, TotalBytesReceived, Info = iff(MaliciousIpInfo != '', MaliciousIpInfo, ''), Key, ParentKey, TypeKey, MaliciousConnectionsCount | order by TypeKey asc, MaliciousConnectionsCount desc, LinksFailed desc, AverageResponseTime desc, Responses desc, MaxLinksLive desc, Name asc | project-away TypeKey" + } + } + ] + }, + { + "id": "9789ead5-eae5-4f52-86c2-ac197da62f30", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process_IP_Port", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} {RemoteIpData} {DestinationPortData} {SourcePortData} let overalldata = VMConnection {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; computerData | union processData | union remoteIpData | union destinationPortData | union remoteIpDataInbound | union sourcePortData | union overalldata\t{QueryProject}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} {RemoteIpData} {DestinationPortData} {SourcePortData} let overalldata = VMConnection {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; computerData | union processData | union remoteIpData | union destinationPortData | union remoteIpDataInbound | union sourcePortData | union overalldata\t{QueryProject}" + } + } + ] + }, + { + "id": "0d6a320e-2cef-44fd-ac0b-ad833f8d0c03", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process_IP", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} {RemoteIpData} {SourcePortData} let overalldata = VMConnection {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; computerData | union processData | union remoteIpData | union sourcePortData | union overalldata {QueryProject}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} {RemoteIpData} {SourcePortData} let overalldata = VMConnection {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; computerData | union processData | union remoteIpData | union sourcePortData | union overalldata {QueryProject}" + } + } + ] + }, + { + "id": "2de0d685-4382-4822-a8aa-f3583ff11b66", + "version": "KqlParameterItem/1.0", + "name": "QueryPadDestinationPortTable", + "type": 1, + "isRequired": true, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let destinationPortPadding = datatable (DestinationPort: string) [];'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let destinationPortPadding = datatable (DestinationPort: string) [];" + } + } + ] + }, + { + "id": "df8a6322-511e-40e0-a258-fe717099a072", + "version": "KqlParameterItem/1.0", + "name": "QueryPadRemoteIpTable", + "type": 1, + "isRequired": true, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let remoteIpPadding = datatable (RemoteIp: string) [];'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let remoteIpPadding = datatable (RemoteIp: string) [];" + } + } + ] + }, + { + "id": "e8f2c394-18e8-4d6d-8f5e-8453cb67128c", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} let overalldata = VMConnection {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; {QueryPadDestinationPortTable} {QueryPadRemoteIpTable} computerData | union remoteIpPadding | union destinationPortPadding | union processData | union overalldata {QueryProject}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} {ProcessName} let overalldata = VMConnection {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; {QueryPadDestinationPortTable} {QueryPadRemoteIpTable} computerData | union remoteIpPadding | union destinationPortPadding | union processData | union overalldata {QueryProject}" + } + } + ] + }, + { + "id": "084fb5fc-e8e4-42df-8a9f-ac1001950ba2", + "version": "KqlParameterItem/1.0", + "name": "QueryPadProcessNameTable", + "type": 1, + "isRequired": true, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = 'let processNamePadding = datatable (ProcessName: string) [];'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "let processNamePadding = datatable (ProcessName: string) [];" + } + } + ] + }, + { + "id": "a4b0e146-7c89-40bb-ade2-ed2e392e9311", + "version": "KqlParameterItem/1.0", + "name": "Computer", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} let overalldata = VMConnection {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; {QueryPadDestinationPortTable} {QueryPadRemoteIpTable} {QueryPadProcessNameTable} computerData | union remoteIpPadding | union processNamePadding | union destinationPortPadding | union overalldata {QueryProject}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{ServiceMapComputers} let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); {MaliciousIpData} let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; {ComputerData} let overalldata = VMConnection {vmSnippet} | where Direction == '{Direction}' | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; {QueryPadDestinationPortTable} {QueryPadRemoteIpTable} {QueryPadProcessNameTable} computerData | union remoteIpPadding | union processNamePadding | union destinationPortPadding | union overalldata {QueryProject}" + } + } + ] + }, + { + "id": "a08757da-e72b-474d-a1d2-65fb7020cc14", + "version": "KqlParameterItem/1.0", + "name": "FinalQuery", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Hierarchy == '0'), result = '{Computer_Process_IP_Port} {TableFilter}'", + "criteriaContext": { + "leftOperand": "Hierarchy", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "static", + "resultVal": "{Computer_Process_IP_Port} {TableFilter}" + } + }, + { + "condition": "if (Hierarchy == '1'), result = '{Computer_Process_IP} {TableFilter}'", + "criteriaContext": { + "leftOperand": "Hierarchy", + "operator": "==", + "rightValType": "static", + "rightVal": "1", + "resultValType": "static", + "resultVal": "{Computer_Process_IP} {TableFilter}" + } + }, + { + "condition": "if (Hierarchy == '2'), result = '{Computer_Process} {TableFilter}'", + "criteriaContext": { + "leftOperand": "Hierarchy", + "operator": "==", + "rightValType": "static", + "rightVal": "2", + "resultValType": "static", + "resultVal": "{Computer_Process} {TableFilter}" + } + }, + { + "condition": "if (Hierarchy == '3'), result = '{Computer} {TableFilter}'", + "criteriaContext": { + "leftOperand": "Hierarchy", + "operator": "==", + "rightValType": "static", + "rightVal": "3", + "resultValType": "static", + "resultVal": "{Computer} {TableFilter}" + } + }, + { + "condition": "else result = '{Computer} {TableFilter}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{Computer} {TableFilter}" + } + } + ] + }, + { + "id": "874eeebe-2ea2-4c04-a3b9-ab3b30e95573", + "version": "KqlParameterItem/1.0", + "name": "ConnectionGrid", + "type": 1, + "description": "Table placeholder", + "isHiddenWhenLocked": true + }, + { + "id": "7d229be6-fe1e-4b68-9a88-e7a53e639198", + "version": "KqlParameterItem/1.0", + "name": "GridComputerName", + "type": 1, + "description": "Table placeholder", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "e1562f78-bdb1-4bae-9cfd-5120e2061f5d", + "version": "KqlParameterItem/1.0", + "name": "GridProcessName", + "type": 1, + "description": "Table placeholder", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "5423665b-218d-44fb-9cd5-0891168fd542", + "version": "KqlParameterItem/1.0", + "name": "GridRemoteIp", + "type": 1, + "description": "Table placeholder", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "9a543572-e7dd-4332-8db3-7f039b06148a", + "version": "KqlParameterItem/1.0", + "name": "GridDestinationPort", + "type": 1, + "description": "Table placeholder", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "{resourceType}" + }, + "name": "parameters - 4" + }, + { + "type": 1, + "content": { + "json": "💡 Select a row from the table below to view connection details for that entry." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "text - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{FinalQuery:value}", + "size": 1, + "noDataMessage": "No data to be shown for this particular scope combination, please adjust the time range, table filters, etc.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportedParameters": [ + { + "parameterName": "ConnectionGrid", + "parameterType": 1, + "defaultValue": "{}" + }, + { + "fieldName": "ComputerName", + "parameterName": "GridComputerName", + "parameterType": 1 + }, + { + "fieldName": "ProcessName", + "parameterName": "GridProcessName", + "parameterType": 1 + }, + { + "fieldName": "RemoteIp", + "parameterName": "GridRemoteIp", + "parameterType": 1, + "defaultValue": "" + }, + { + "fieldName": "DestinationPort", + "parameterName": "GridDestinationPort", + "parameterType": 1, + "defaultValue": "" + } + ], + "queryType": 0, + "resourceType": "{resourceType}", + "crossComponentResources": [ + "{WorkbookResource}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Computer", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ProcessName", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "RemoteIp", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DestinationPort", + "formatter": 5, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "MaliciousConnections", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Responses", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "MaxLinksLive", + "formatter": 4, + "formatOptions": { + "palette": "lightBlue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "LinksFailed", + "formatter": 4, + "formatOptions": { + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "AverageResponseTime", + "formatter": 4, + "formatOptions": { + "palette": "purple", + "showIcon": true + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalBytesSent", + "formatter": 4, + "formatOptions": { + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalBytesReceived", + "formatter": 4, + "formatOptions": { + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Info", + "formatter": 5, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info", + "showIcon": true + } + }, + { + "columnMatch": "Key", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ParentKey", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "MaliciousConnectionsCount", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "idColumn": "Key", + "parentColumn": "ParentKey", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": false + } + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "KPIValue", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "showPin": true, + "name": "query - 5" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "dcf5f274-fbbf-4fb8-8c35-6b528a08cac9", + "version": "KqlParameterItem/1.0", + "name": "ShowDetail", + "type": 1, + "isRequired": true, + "value": "False", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ConnectionGrid != '{}'), result = 'True'", + "criteriaContext": { + "leftOperand": "ConnectionGrid", + "operator": "!=", + "rightValType": "static", + "rightVal": "{}", + "resultValType": "static", + "resultVal": "True" + } + }, + { + "condition": "else result = 'False'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "False" + } + } + ] + }, + { + "id": "9a8b4514-a921-48d6-be63-f053286a2acb", + "version": "KqlParameterItem/1.0", + "name": "Blank", + "type": 1, + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "" + }, + { + "id": "0e3e1001-dbf6-4ee8-8235-b8e19451a30d", + "version": "KqlParameterItem/1.0", + "name": "GridDestinationPort", + "type": 1, + "description": "Force blank if ", + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '{GridDestinationPort}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{GridDestinationPort}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "28944bf4-98f9-42ce-8f1f-b2a6e077347a", + "version": "KqlParameterItem/1.0", + "name": "HeadingDestinationPort", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridDestinationPort != Blank), result = ' > 🔸 {GridDestinationPort}'", + "criteriaContext": { + "leftOperand": "GridDestinationPort", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": " > 🔸 {GridDestinationPort}" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "" + }, + { + "id": "02d4b80c-fc1f-4a4e-8fc7-c35ce670ace7", + "version": "KqlParameterItem/1.0", + "name": "HeadingRemoteIp", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridRemoteIp != Blank), result = ' > 🌐 {GridRemoteIp}'", + "criteriaContext": { + "leftOperand": "GridRemoteIp", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": " > 🌐 {GridRemoteIp}" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "" + }, + { + "id": "7a5e3753-c1ae-4a94-b8f9-82c71ca46198", + "version": "KqlParameterItem/1.0", + "name": "HeadingDirection", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Direction == 'outbound'), result = '{HeadingRemoteIp} {HeadingDestinationPort}'", + "criteriaContext": { + "leftOperand": "Direction", + "operator": "==", + "rightValType": "static", + "rightVal": "outbound", + "resultValType": "static", + "resultVal": "{HeadingRemoteIp} {HeadingDestinationPort}" + } + }, + { + "condition": "else result = '{HeadingDestinationPort} {HeadingRemoteIp}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{HeadingDestinationPort} {HeadingRemoteIp}" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "" + }, + { + "id": "e8d8beb6-0109-454f-a4e2-6c79addce3b0", + "version": "KqlParameterItem/1.0", + "name": "HeadingProcess", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridProcessName != Blank), result = ' > 🎫 {GridProcessName}'", + "criteriaContext": { + "leftOperand": "GridProcessName", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": " > 🎫 {GridProcessName}" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "value": "" + }, + { + "id": "1ce27926-6842-497b-ac53-70c006e11231", + "version": "KqlParameterItem/1.0", + "name": "Heading", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = '💻 {GridComputerName} {HeadingProcess} {HeadingDirection}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "💻 {GridComputerName} {HeadingProcess} {HeadingDirection}" + } + } + ], + "value": "" + }, + { + "id": "4a155a6b-f28a-49c4-b3e3-a975316dcf20", + "version": "KqlParameterItem/1.0", + "name": "QueryProcessName", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridProcessName != Blank), result = ' | where ProcessName == \"{GridProcessName}\"'", + "criteriaContext": { + "leftOperand": "GridProcessName", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": " | where ProcessName == \"{GridProcessName}\"" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "128e1c98-bae2-431c-99b7-ed214988e02b", + "version": "KqlParameterItem/1.0", + "name": "QueryRemoteIp", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridRemoteIp != Blank), result = ' | where RemoteIp == \"{GridRemoteIp}\"'", + "criteriaContext": { + "leftOperand": "GridRemoteIp", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": " | where RemoteIp == \"{GridRemoteIp}\"" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "87897941-a28b-479d-a03b-921cdd1d36f5", + "version": "KqlParameterItem/1.0", + "name": "QueryDestinationPort", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridDestinationPort != Blank), result = ' | where DestinationPort == \"{GridDestinationPort}\"'", + "criteriaContext": { + "leftOperand": "GridDestinationPort", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": " | where DestinationPort == \"{GridDestinationPort}\"" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "b44edb14-76ad-48b3-9921-b5dfb5a6db60", + "version": "KqlParameterItem/1.0", + "name": "QueryFilter", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (GridComputerName != Blank), result = '| where Computer == \"{GridComputerName}\" {QueryDestinationPort} {QueryRemoteIp} {QueryProcessName}'", + "criteriaContext": { + "leftOperand": "GridComputerName", + "operator": "!=", + "rightValType": "param", + "rightVal": "Blank", + "resultValType": "static", + "resultVal": "| where Computer == \"{GridComputerName}\" {QueryDestinationPort} {QueryRemoteIp} {QueryProcessName}" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ] + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 6" + }, + { + "type": 1, + "content": { + "json": "

{Heading}

" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "text - 8" + }, + { + "type": 1, + "content": { + "json": "### Responses" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 9" + }, + { + "type": 1, + "content": { + "json": "### Latency" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 10" + }, + { + "type": 1, + "content": { + "json": "### Network" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 11" + }, + { + "type": 1, + "content": { + "json": "### Links" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection {vmSnippet}\r\n{QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize Responses = sum(Responses) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "{resourceType}", + "crossComponentResources": [ + "{WorkbookResource}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection {vmSnippet}\r\n{QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize P50 = percentiles(ResponseTimeSum, 50), P90 = percentiles(ResponseTimeSum, 90), P95 = percentiles(ResponseTimeSum, 95) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "aggregation": 3, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "{resourceType}", + "crossComponentResources": [ + "{WorkbookResource}" + ], + "visualization": "linechart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection {vmSnippet}\r\n{QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize Sent = sum(BytesSent), Received = sum(BytesReceived) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "{resourceType}", + "crossComponentResources": [ + "{WorkbookResource}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 14" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection {vmSnippet}\r\n{QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize MaxOpenPorts = max(LinksLive), SumFailed = sum(LinksFailed) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "aggregation": 3, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "{resourceType}", + "crossComponentResources": [ + "{WorkbookResource}" + ], + "visualization": "areachart" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 15" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Connections Overview - Single VM/settings.json b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview - Single VM/settings.json new file mode 100644 index 0000000..6650c4c --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview - Single VM/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Connections Overview", + "author": "Microsoft", + "galleries": [ + { "type": "performance-vm", "resourceType": "microsoft.compute/virtualmachines", "order": 200 }, + { "type": "insights", "resourceType": "microsoft.compute/virtualmachines", "order": 200 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Connections Overview/Connections Overview.workbook b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview/Connections Overview.workbook new file mode 100644 index 0000000..dccc330 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview/Connections Overview.workbook @@ -0,0 +1,1233 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "80a15801-7442-49f3-a82f-6e55849ec7fb", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "90119d28-e9c1-4c0d-8715-1f601d337f5c", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "7da21a07-10f4-4455-9105-c37132dcee0d", + "version": "KqlParameterItem/1.0", + "name": "ContextSelection", + "type": 1, + "query": "// {DefaultWorkspace}\r\nwhere strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7324c544-2fd2-4d61-b529-481a0f5fd286", + "version": "KqlParameterItem/1.0", + "name": "HybridMode", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ContextSelection is empty ), result = 'false'", + "criteriaContext": { + "leftOperand": "ContextSelection", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ] + }, + { + "id": "2942e38e-232e-4d89-9ada-12f9863b3c5b", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {DefaultSubscription}\r\nsummarize by subscriptionId\r\n| project strcat('/subscriptions/', subscriptionId), selected = iff({HybridMode} == true, iff(subscriptionId == todynamic('{ContextSelection}').sub, true, false), iff(strcat('/subscriptions/', subscriptionId) == '{DefaultSubscription}', true, false))", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2bc1e5fc-cc2d-4eb5-bead-5f7d96664dec", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {Subscriptions}\r\nwhere type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| order by tolower(name) asc\r\n| extend Row = row_number()\r\n| project id, selected = iff({HybridMode} == 'true', iff(id == todynamic('{ContextSelection}').ws, true, false), Row == 1)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "a9393837-8ef0-40e5-b223-4df1208a691e", + "version": "KqlParameterItem/1.0", + "name": "Test", + "type": 1, + "query": "VMConnection\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "label": "Not Onboarded" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "⚠ `VMConnection` table was either not detected or empty. Try the following:\r\n\r\n* Select a different time range\r\n* Try different scope selections\r\n* Onboard to Azure Monitor for VMs ([Azure Monitor for VMs GA FAQ](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-ga-release-faq))." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": "1" + }, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "addcec31-b7ac-4715-a78d-9b803f86af8a", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-01-28T23:37:45.024Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-01-28T23:37:45.025Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-01-28T23:37:45.026Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-01-28T23:37:45.026Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-01-28T23:37:45.026Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "label": "Time Range" + }, + { + "id": "db9b2f1d-188a-4dda-af4a-b39deeb34da3", + "version": "KqlParameterItem/1.0", + "name": "Direction", + "type": 2, + "description": "Direction of the network connection from the VMs", + "isRequired": true, + "value": "outbound", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"inbound\", \"label\":\"Inbound\" },\r\n { \"value\":\"outbound\", \"label\":\"Outbound\" }\r\n]" + }, + { + "id": "8744c427-f060-4725-95af-850af2fa08b1", + "version": "KqlParameterItem/1.0", + "name": "ComputerNameContains", + "type": 1, + "label": "Computer Name Contains" + }, + { + "id": "b141bd6c-cd8d-488e-a5f6-83ab00d31161", + "version": "KqlParameterItem/1.0", + "name": "Computers", + "type": 2, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "VMConnection\r\n| where Computer contains '{ComputerNameContains}'\r\n| summarize by Computer\r\n| project Value = Computer, Display = Computer, isSelected = false\r\n| order by Display asc\r\n| union (datatable(Value:string, Display:string, isSelected:boolean)['*', 'All',true])", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + }, + { + "id": "488d1f86-cabc-4fcc-8dc9-9a2e5803fb20", + "version": "KqlParameterItem/1.0", + "name": "ComputerFilter", + "type": 1, + "isRequired": true, + "query": "let computerFilter = iff('*' in ({Computers}), \"| where Computer contains '{ComputerNameContains}'\", \"| where Computer in ({Computers})\");\r\nprint(computerFilter)", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + }, + { + "id": "56ab6626-c12d-4de1-8a3d-8a6099db3cd3", + "version": "KqlParameterItem/1.0", + "name": "hierarchy", + "type": 1, + "isRequired": true, + "value": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Direction == 'inbound'), result = '[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Port -> Remote IP\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Port\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]'", + "criteriaContext": { + "leftOperand": "Direction", + "operator": "==", + "rightValType": "static", + "rightVal": "inbound", + "resultValType": "static", + "resultVal": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Port -> Remote IP\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Port\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]" + } + }, + { + "condition": "else result = '[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "[ { \"value\": \"0\", \"label\": \"Computer -> Process -> Remote IP -> Port\" }, { \"value\": \"1\", \"label\": \"Computer -> Process -> Remote IP\" }, { \"value\": \"2\", \"label\": \"Computer -> Process\", \t\t\"selected\": true }, { \"value\": \"3\", \"label\": \"Computer\" } ]" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "8be4bd82-b145-4602-af53-52c9e8f8d51e", + "version": "KqlParameterItem/1.0", + "name": "Hierarchy", + "type": 2, + "description": "Select the level of detail to be shown in the table below", + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"{hierarchy}\",\"transformers\":[{\"type\":\"jsonpath\"}]}", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "5526f711-6d04-469e-8d06-351508f1014e", + "version": "KqlParameterItem/1.0", + "name": "TableFilter", + "type": 2, + "description": "Filter table based on presence of malicious connections or at least one link failing", + "multiSelect": true, + "quote": "", + "delimiter": "", + "value": [], + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"Only Malicious Connections\",\r\n \"value\": \" | where MaliciousConnectionsCount >= 1\"\r\n },\r\n {\r\n \"label\": \"Only Links Failed\",\r\n \"value\": \" | where LinksFailed >= 1\"\r\n }\r\n]", + "label": "Table Filter" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "parameters - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "5e335a1b-7f99-4647-854a-d7b5cb489bb2", + "version": "KqlParameterItem/1.0", + "name": "ServiceMapComputers", + "type": 1, + "isRequired": true, + "query": "print(\"let computers = ServiceMapComputer_CL | summarize (TimeGenerated, Properties) = arg_max(TimeGenerated, pack_all()) by Computer;\");", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "c69fbaae-4fd2-4527-acdd-a2c358eebffa", + "version": "KqlParameterItem/1.0", + "name": "MaliciousIpData", + "type": 1, + "query": "print(\"let maliciousIpData = VMConnection | where Direction == '{Direction}' {ComputerFilter} | where MaliciousIp != '' | summarize by Computer, ProcessName, MaliciousIp, DestinationPort, RemoteIp, IsActive, IndicatorThreatType, RemoteCountry, RemoteLongitude, RemoteLatitude, Confidence, Severity, FirstReportedDateTime, LastReportedDateTime | project MaliciousIp = strcat(Computer, '-', ProcessName, '-', MaliciousIp), MaliciousPort = strcat(Computer, '-', ProcessName, '-', DestinationPort), MaliciousPortIp = strcat(Computer, '-', ProcessName, '-', DestinationPort, '-', RemoteIp), Computer = Computer, Process = strcat(Computer, '-', ProcessName), MaliciousIpInfo = pack('Malicious IP', MaliciousIp, 'Is Active', IsActive, 'Indicator Threat Type', IndicatorThreatType, 'Remote Country', RemoteCountry, 'Longitude', RemoteLongitude, 'Latitude', RemoteLatitude, 'Confidence', Confidence, 'Severity', Severity, 'First Reported DateTime', FirstReportedDateTime, 'Last Reported DateTime', LastReportedDateTime, 'Destination Port', DestinationPort, 'Remote IP', RemoteIp);\");", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "dd933ac8-1273-48fe-8d09-bd65d857ce83", + "version": "KqlParameterItem/1.0", + "name": "ComputerData", + "type": 1, + "query": "print(\"let computerData = VMConnection | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Name = strcat('🖥️ ', Computer), ComputerName = Computer, Type = 'Computer', TypeKey = 1, Key = Computer, ParentKey = '---' | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Computer) on $left.Key == $right.Computer | project-away Computer | order by Name asc;\");", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "fb879823-c082-4c53-af7e-18d044032f99", + "version": "KqlParameterItem/1.0", + "name": "RemoteIpDataInbound", + "type": 1, + "query": "print(\"let remoteIpDataInbound = VMConnection | where Direction == 'inbound' | where 'inbound' == 'inbound' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort), '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), Id = strcat(Computer, '-', ProcessName, '-', RemoteIp), ComputerName = Computer | join kind=inner sourcePortData on $left.ParentKey == $right.Key | project-away AverageResponseTime1, Computer1, Key1, LinksFailed1, MaxLinksLive1, ParentKey1, ProcessName1, Responses1, TotalBytesReceived1, TotalBytesSent1, Type1, TypeKey1 | order by Name asc | join kind=leftouter ipComputerMapping on $left.RemoteIp == $right.Ipv4 | extend Name = iff(RemoteIp == '', 'Unknown', strcat('🌐 External (', RemoteIp, ')')) | project-away Computer, Ipv4 | order by Name desc | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPortIp | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIp, Computer, Process, Computer1, MaliciousIpInfo1, Id;\");", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "3ad60c70-b530-49c0-a59b-8df690dffbc8", + "version": "KqlParameterItem/1.0", + "name": "ProcessName", + "type": 1, + "query": "print(\"let processData = VMConnection | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, Name = strcat('🎫 ', ProcessName), Type = 'Process', TypeKey = 2, Key = strcat(Computer, '-', ProcessName), ParentKey = Computer, ComputerName = Computer | join kind=inner computerData on $left.ParentKey == $right.Key | project-away Name1, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter (maliciousIpData | summarize MaliciousIpInfo = tostring(count()) by Process) on $left.Key == $right.Process | project-away Process, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | order by Name asc;\");", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "c9eea7db-3d14-4fbf-8ae6-b7507ec1d43f", + "version": "KqlParameterItem/1.0", + "name": "RemoteIpData", + "type": 1, + "isRequired": true, + "query": "print(\"let remoteIpData = VMConnection | where '{Direction}' == 'outbound' | where Direction == '{Direction}' {ComputerFilter} | extend RemoteIp = iff(Direction == 'outbound', DestinationIp, SourceIp) | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, RemoteIp, Type = 'Remote Computer', TypeKey = 3, Key = strcat(Computer, '-', ProcessName, '-', RemoteIp), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=inner processData on $left.ParentKey == $right.Key | project-away Name, Responses1, LinksFailed1, MaxLinksLive1, TotalBytesSent1, TotalBytesReceived1, AverageResponseTime1, Type1, Key1, ParentKey1 | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousIp | project-away MaliciousIp, Computer, Process, Computer1, Computer2, MaliciousIpInfo | extend MaliciousIpInfo = tostring(MaliciousIpInfo1) | project-away MaliciousIpInfo1 | join kind = leftouter (ipComputerMapping) on $left.RemoteIp == $right.Ipv4 | extend Name = iff(Computer == '', iff(RemoteIp == '127.0.0.1', '🌐 Localhost', strcat('🌐 External (', RemoteIp, ')')), strcat('🖥️ ', Computer)) | project-away Computer, Ipv4 | order by Name desc;\")", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "4a9ed59b-002e-4c81-b437-8456faeef6a6", + "version": "KqlParameterItem/1.0", + "name": "SourcePortData", + "type": 1, + "query": "print(\"let sourcePortData = VMConnection | where Direction == '{Direction}' | where '{Direction}' == 'inbound' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName), ComputerName = Computer | join kind=leftouter maliciousIpData on $left.Key == $right.MaliciousPort | extend MaliciousIpInfo = tostring(MaliciousIpInfo) | project-away Computer1, MaliciousIp, MaliciousPort, MaliciousPortIp, Process; {RemoteIpDataInbound}\");", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "e31a8d21-e24b-45ec-9806-e6c45bca15aa", + "version": "KqlParameterItem/1.0", + "name": "DestinationPortData", + "type": 1, + "query": "print(\"let destinationPortData = VMConnection | where Direction == '{Direction}' | where '{Direction}' == 'outbound' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) by Computer, ProcessName, DestinationIp, DestinationPort, Name = strcat('🔶 ', DestinationPort), Type = 'Remote Port', TypeKey = 4, Key = strcat(Computer, '-', ProcessName, '-', DestinationIp, '-', tostring(DestinationPort)), ParentKey = strcat(Computer, '-', ProcessName, '-', DestinationIp), ComputerName = Computer | join kind=inner remoteIpData on $left.ParentKey == $right.Key | project-away Name1, Responses1, Type1, Key1, ParentKey1 | order by Name asc;\");", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "a54f3df8-c872-4a19-a280-84b203987ec8", + "version": "KqlParameterItem/1.0", + "name": "QueryProject", + "type": 1, + "query": "print(\"| extend MaliciousConnectionsCount = iff(MaliciousIpInfo == '', 0, iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', tolong(MaliciousIpInfo), 1)) | project ComputerName, ProcessName, RemoteIp, DestinationPort, Name = iff(Name == '🎫 ', '🎫 ', Name), Type, MaliciousConnections = iff(MaliciousIpInfo == '', '✅ No Malicious Connections', iff(Type == 'Computer' or Type == 'Process' or Type == 'Overall', iff(MaliciousConnectionsCount > 1, strcat('❌ ', MaliciousIpInfo, ' Malicious Connections'), strcat('❌ ', MaliciousIpInfo, ' Malicious Connection')), '❌ Malicious Connection')), Responses, MaxLinksLive, LinksFailed, AverageResponseTime, TotalBytesSent, TotalBytesReceived, Info = iff(MaliciousIpInfo != '', MaliciousIpInfo, ''), Key, ParentKey, TypeKey, MaliciousConnectionsCount | order by TypeKey asc, MaliciousConnectionsCount desc, LinksFailed desc, AverageResponseTime desc, Responses desc, MaxLinksLive desc, Name asc | project-away TypeKey\");", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "9789ead5-eae5-4f52-86c2-ac197da62f30", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process_IP_Port", + "type": 1, + "query": "print(strcat(\"{ServiceMapComputers}\", \" let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); \", \"{MaliciousIpData}\", \" let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; \", \"{ComputerData}\", \"{ProcessName}\", \"{RemoteIpData}\", \"{DestinationPortData}\", \"{SourcePortData}\", \" let overalldata = VMConnection | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1; computerData | union processData | union remoteIpData | union destinationPortData | union remoteIpDataInbound | union sourcePortData | union overalldata\t\", \"{QueryProject}\"));", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "0d6a320e-2cef-44fd-ac0b-ad833f8d0c03", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process_IP", + "type": 1, + "query": "print(strcat(\"{ServiceMapComputers}\", \" let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); \", \"{MaliciousIpData}\", \" let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; \", \"{ComputerData}\", \"{ProcessName}\", \"{RemoteIpData}\", \"{SourcePortData}\", \" let overalldata = VMConnection | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1;\" ,\" computerData | union processData | union remoteIpData | union sourcePortData | union overalldata \", \"{QueryProject}\"));", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "2de0d685-4382-4822-a8aa-f3583ff11b66", + "version": "KqlParameterItem/1.0", + "name": "QueryPadDestinationPortTable", + "type": 1, + "isRequired": true, + "query": "print(\"let destinationPortPadding = datatable (DestinationPort: string) [];\");", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "df8a6322-511e-40e0-a258-fe717099a072", + "version": "KqlParameterItem/1.0", + "name": "QueryPadRemoteIpTable", + "type": 1, + "isRequired": true, + "query": "print(\"let remoteIpPadding = datatable (RemoteIp: string) [];\");", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "e8f2c394-18e8-4d6d-8f5e-8453cb67128c", + "version": "KqlParameterItem/1.0", + "name": "Computer_Process", + "type": 1, + "query": "print(strcat(\"{ServiceMapComputers}\", \" let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); \", \"{MaliciousIpData}\", \" let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; \", \"{ComputerData}\", \"{ProcessName}\", \" let overalldata = VMConnection | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1;\", \"{QueryPadDestinationPortTable}\", \"{QueryPadRemoteIpTable}\",\" computerData | union remoteIpPadding | union destinationPortPadding | union processData | union overalldata \", \"{QueryProject}\"));", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "084fb5fc-e8e4-42df-8a9f-ac1001950ba2", + "version": "KqlParameterItem/1.0", + "name": "QueryPadProcessNameTable", + "type": 1, + "isRequired": true, + "query": "print(\"let processNamePadding = datatable (ProcessName: string) [];\");", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "a4b0e146-7c89-40bb-ade2-ed2e392e9311", + "version": "KqlParameterItem/1.0", + "name": "Computer", + "type": 1, + "query": "print(strcat(\"{ServiceMapComputers}\", \" let ipComputerMapping = computers | project Computer, Ipv4 = todynamic(tostring(Properties.Ipv4Addresses_s)) | mvexpand Ipv4 to typeof(string); \", \"{MaliciousIpData}\", \" let totalMaliciousConnectionsCount = maliciousIpData | summarize MaliciousIpInfo = count() | extend Type = 'Overall'; \", \"{ComputerData}\", \" let overalldata = VMConnection | where Direction == '{Direction}' {ComputerFilter} | summarize Responses = sum(Responses), LinksFailed = sum(LinksFailed), MaxLinksLive = max(LinksLive), TotalBytesSent = sum(BytesSent), TotalBytesReceived = sum(BytesReceived), AverageResponseTime = 1.0 * sum(ResponseTimeSum) / sum(Responses) | extend Name = '🔵 Overall', Type = 'Overall', TypeKey = 0, Key = '--Overall--', ParentKey = '----' | join kind=leftouter totalMaliciousConnectionsCount on Type | extend MaliciousIpInfo = iff(MaliciousIpInfo == '0', '', tostring(MaliciousIpInfo)) | project-away Type1;\", \"{QueryPadDestinationPortTable}\", \"{QueryPadRemoteIpTable}\", \"{QueryPadProcessNameTable}\",\" computerData | union remoteIpPadding | union processNamePadding | union destinationPortPadding | union overalldata \", \"{QueryProject}\"));", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "a08757da-e72b-474d-a1d2-65fb7020cc14", + "version": "KqlParameterItem/1.0", + "name": "FinalQuery", + "type": 1, + "query": "print(strcat(\r\niff({Hierarchy} == 0, \"{Computer_Process_IP_Port}\", \r\niff({Hierarchy} == 1, \"{Computer_Process_IP}\",\r\niff({Hierarchy} == 2, \"{Computer_Process}\",\r\niff({Hierarchy} == 3, \"{Computer}\", \"{Computer}\")))),'{TableFilter:value}'));", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "874eeebe-2ea2-4c04-a3b9-ab3b30e95573", + "version": "KqlParameterItem/1.0", + "name": "ConnectionGrid", + "type": 1, + "value": "{}", + "isHiddenWhenLocked": true + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "parameters - 3" + }, + { + "type": 1, + "content": { + "json": "💡 Select a row from the table below to view connection details for that entry." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "text - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{FinalQuery:value}", + "size": 0, + "showAnalytics": true, + "noDataMessage": "No data to be shown for this particular scope combination, please adjust the time range, table filters, etc.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportParameterName": "ConnectionGrid", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Computer", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "ProcessName", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "RemoteIp", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "DestinationPort", + "formatter": 5, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Responses", + "formatter": 4, + "formatOptions": { + "palette": "blueDark" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "MaxLinksLive", + "formatter": 4, + "formatOptions": { + "palette": "lightBlue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "LinksFailed", + "formatter": 4, + "formatOptions": { + "palette": "red" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "AverageResponseTime", + "formatter": 4, + "formatOptions": { + "palette": "purple" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalBytesSent", + "formatter": 4, + "formatOptions": { + "palette": "orange" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalBytesReceived", + "formatter": 4, + "formatOptions": { + "palette": "green" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Info", + "formatter": 5, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info" + } + }, + { + "columnMatch": "Key", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "ParentKey", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "MaliciousConnectionsCount", + "formatter": 5, + "formatOptions": {} + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "idColumn": "Key", + "parentColumn": "ParentKey", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": false + } + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "KPIValue", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "showPin": true, + "name": "query - 5" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "7e4c3d29-2be6-4288-903b-95502ddab577", + "version": "KqlParameterItem/1.0", + "name": "ComputerName", + "type": 1, + "query": "let row = dynamic({ConnectionGrid});\r\nlet computerName = row.ComputerName;\r\nprint computerName", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "3bda15ac-c4ea-487f-acf5-2c14c8d33038", + "version": "KqlParameterItem/1.0", + "name": "ProcessName", + "type": 1, + "query": "let row = dynamic({ConnectionGrid});\r\nlet ProcessName = row.ProcessName;\r\nprint ProcessName", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "e424020b-8c6e-4a06-9639-ed696192442a", + "version": "KqlParameterItem/1.0", + "name": "RemoteIp", + "type": 1, + "query": "let row = dynamic({ConnectionGrid});\r\nlet RemoteIp = row.RemoteIp;\r\nprint RemoteIp", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "a479367c-f99b-4c93-b18c-51f07ce5069d", + "version": "KqlParameterItem/1.0", + "name": "DestinationPort", + "type": 1, + "query": "let row = dynamic({ConnectionGrid});\r\nlet destinationPort = row.DestinationPort;\r\nprint destinationPort", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "dcf5f274-fbbf-4fb8-8c35-6b528a08cac9", + "version": "KqlParameterItem/1.0", + "name": "ShowDetail", + "type": 1, + "isRequired": true, + "query": "print(strcat('{ComputerName}{ProcessName}{RemoteIp}{DestinationPort}' != ''))", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "1ce27926-6842-497b-ac53-70c006e11231", + "version": "KqlParameterItem/1.0", + "name": "Heading", + "type": 1, + "query": "print(strcat('💻 {ComputerName}',iff('{ProcessName}' != '',' > 🎫 {ProcessName}',''),iff('{Direction}' == 'outbound',strcat(iff('{RemoteIp}' != '',' > 🌐 {RemoteIp}',''),iff('{DestinationPort}' != '',' > 🔸 {DestinationPort}','')),strcat(iff('{DestinationPort}' != '',' > 🔸 {DestinationPort}',''),iff('{RemoteIp}' != '',' > 🌐 {RemoteIp}','')))))", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "b44edb14-76ad-48b3-9921-b5dfb5a6db60", + "version": "KqlParameterItem/1.0", + "name": "QueryFilter", + "type": 1, + "query": "print(strcat(' where Computer == \"{ComputerName}\"',iff('{ProcessName}' != '', ' | where ProcessName == \"{ProcessName}\"', ''),iff('{RemoteIp}' != '',' | where RemoteIp == \"{RemoteIp}\"',''),iff('{DestinationPort}' != '',' | where DestinationPort == \"{DestinationPort}\"','')));", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "parameters - 6" + }, + { + "type": 1, + "content": { + "json": "

{Heading}

" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "### Responses" + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 8" + }, + { + "type": 1, + "content": { + "json": "### Latency" + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 9" + }, + { + "type": 1, + "content": { + "json": "### Network" + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 10" + }, + { + "type": 1, + "content": { + "json": "### Links" + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "text - 11" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| {QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize Responses = sum(Responses) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "areachart" + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| {QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize P50 = percentiles(ResponseTimeSum, 50), P90 = percentiles(ResponseTimeSum, 90), P95 = percentiles(ResponseTimeSum, 95) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "aggregation": 3, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| {QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize Sent = sum(BytesSent), Received = sum(BytesReceived) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "areachart" + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 14" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let SourceMachineData = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| {QueryFilter}\r\n| where Direction == '{Direction}'\r\n| summarize MaxOpenPorts = max(LinksLive), SumFailed = sum(LinksFailed) by bin(TimeGenerated, time('{TimeRange:grain}'));\r\nSourceMachineData", + "size": 1, + "aggregation": 3, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "areachart" + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "25", + "name": "query - 15" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Connections Overview/settings.json b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview/settings.json new file mode 100644 index 0000000..1db6efa --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Connections Overview/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Connections Overview", + "author": "Microsoft", + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 100 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Failed Connections/Failed Connections.workbook b/Virtual Machines - Network Dependencies/Workbooks/Failed Connections/Failed Connections.workbook new file mode 100644 index 0000000..f465d03 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Failed Connections/Failed Connections.workbook @@ -0,0 +1,452 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "80a15801-7442-49f3-a82f-6e55849ec7fb", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "90119d28-e9c1-4c0d-8715-1f601d337f5c", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "7da21a07-10f4-4455-9105-c37132dcee0d", + "version": "KqlParameterItem/1.0", + "name": "ContextSelection", + "type": 1, + "query": "// {DefaultWorkspace}\r\nwhere strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7324c544-2fd2-4d61-b529-481a0f5fd286", + "version": "KqlParameterItem/1.0", + "name": "HybridMode", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ContextSelection is empty ), result = 'false'", + "criteriaContext": { + "leftOperand": "ContextSelection", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ] + }, + { + "id": "2942e38e-232e-4d89-9ada-12f9863b3c5b", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {DefaultSubscription}\r\nsummarize by subscriptionId\r\n| project strcat('/subscriptions/', subscriptionId), selected = iff({HybridMode} == true, iff(subscriptionId == todynamic('{ContextSelection}').sub, true, false), iff(strcat('/subscriptions/', subscriptionId) == '{DefaultSubscription}', true, false))", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2bc1e5fc-cc2d-4eb5-bead-5f7d96664dec", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {Subscriptions}\r\nwhere type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| order by tolower(name) asc\r\n| extend Row = row_number()\r\n| project id, selected = iff({HybridMode} == 'true', iff(id == todynamic('{ContextSelection}').ws, true, false), Row == 1)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d0f502a4-2f0f-4d3d-af70-5198d41f3e0c", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "48e2b8b9-e618-480c-80e6-5cf1cee85ee9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "label": "Not Onboarded", + "type": 1, + "query": "VMConnection\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "⚠ `VMConnection` table was either not detected or empty. Try the following:\r\n\r\n* Select a different time range\r\n* Try different scope selections\r\n* Onboard to Azure Monitor for VMs ([Azure Monitor for VMs GA FAQ](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-ga-release-faq))." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": "1" + }, + "name": "text - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let overallData = VMConnection\n| summarize Established = sum(LinksEstablished), Failed = sum(LinksFailed)\n| extend PercentFailed = (todouble(Failed)/todouble(Failed+Established))*100.0\n| extend Computer = '🔵 Overall', Type = '1';\nVMConnection\n| summarize Established = sum(LinksEstablished), Failed = sum(LinksFailed) by Computer\n| extend PercentFailed = (todouble(Failed)/todouble(Failed+Established))*100.0, Type = '2'\n| union overallData\n| order by Type asc, PercentFailed desc\n| project-away Type", + "size": 1, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "Computer", + "exportParameterName": "Computer", + "exportDefaultValue": "🔵 Overall", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Established", + "formatter": 4, + "formatOptions": { + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "Failed", + "formatter": 4, + "formatOptions": { + "palette": "purple", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "PercentFailed", + "formatter": 4, + "formatOptions": { + "palette": "lightBlue", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "minimumFractionDigits": 2, + "maximumFractionDigits": 2 + } + } + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "query - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "ac3dc2cc-de39-4fe9-ba0c-bc722f953ffa", + "version": "KqlParameterItem/1.0", + "name": "ComputerName", + "type": 1, + "value": "*", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Computer == '🔵 Overall'), result = '*'", + "criteriaContext": { + "leftOperand": "Computer", + "operator": "==", + "rightValType": "static", + "rightVal": "🔵 Overall", + "resultValType": "static", + "resultVal": "*" + } + }, + { + "condition": "else result = Computer", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Computer" + } + } + ], + "timeContextFromParameter": "TimeRange" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "parameters - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMConnection\n| where Computer in (\"{ComputerName}\") or '*' in (\"{ComputerName}\") \n| summarize Established = sum(LinksEstablished), Failed = sum(LinksFailed) by bin(TimeGenerated, {TimeRange:grain})", + "size": 0, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMConnection\r\n| where Computer in (\"{ComputerName}\") or '*' in (\"{ComputerName}\") \r\n| summarize Established = sum(LinksEstablished), Failed = sum(LinksFailed) by bin(TimeGenerated, {TimeRange:grain})\r\n| project TimeGenerated, PercentFailed = (todouble(Failed)/todouble(Failed+Established))*100", + "size": 0, + "aggregation": 3, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "query - 4" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Failed Connections/settings.json b/Virtual Machines - Network Dependencies/Workbooks/Failed Connections/settings.json new file mode 100644 index 0000000..a0b6c65 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Failed Connections/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Failed Connections", + "author": "Microsoft", + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 200 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Open Ports/Open Ports.workbook b/Virtual Machines - Network Dependencies/Workbooks/Open Ports/Open Ports.workbook new file mode 100644 index 0000000..6eaa845 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Open Ports/Open Ports.workbook @@ -0,0 +1,504 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "80a15801-7442-49f3-a82f-6e55849ec7fb", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "90119d28-e9c1-4c0d-8715-1f601d337f5c", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "7da21a07-10f4-4455-9105-c37132dcee0d", + "version": "KqlParameterItem/1.0", + "name": "ContextSelection", + "type": 1, + "query": "// {DefaultWorkspace}\r\nwhere strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7324c544-2fd2-4d61-b529-481a0f5fd286", + "version": "KqlParameterItem/1.0", + "name": "HybridMode", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ContextSelection is empty ), result = 'false'", + "criteriaContext": { + "leftOperand": "ContextSelection", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ] + }, + { + "id": "2942e38e-232e-4d89-9ada-12f9863b3c5b", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {DefaultSubscription}\r\nsummarize by subscriptionId\r\n| project strcat('/subscriptions/', subscriptionId), selected = iff({HybridMode} == true, iff(subscriptionId == todynamic('{ContextSelection}').sub, true, false), iff(strcat('/subscriptions/', subscriptionId) == '{DefaultSubscription}', true, false))", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2bc1e5fc-cc2d-4eb5-bead-5f7d96664dec", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {Subscriptions}\r\nwhere type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| order by tolower(name) asc\r\n| extend Row = row_number()\r\n| project id, selected = iff({HybridMode} == 'true', iff(id == todynamic('{ContextSelection}').ws, true, false), Row == 1)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d0f502a4-2f0f-4d3d-af70-5198d41f3e0c", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "48e2b8b9-e618-480c-80e6-5cf1cee85ee9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "label": "Not Onboarded", + "type": 1, + "query": "VMBoundPort\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "⚠ `VMBoundPort` table was either not detected or empty. Try the following:\r\n\r\n* Select a different time range\r\n* Try different scope selections\r\n* Onboard to Azure Monitor for VMs ([Azure Monitor for VMs GA FAQ](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-ga-release-faq))." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": "1" + }, + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "💡 Select a row from the table below to view port details for that entry." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "text - 1" + }, + { + "type": 1, + "content": { + "json": "

List of Open Ports for all Computers in the Workspace

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "text - 2" + }, + { + "type": 1, + "content": { + "json": "

Ports in use by Processes on the Selected Computer

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "text - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMBoundPort\n| where Ip != \"127.0.0.1\"\n| summarize by Computer, Port, Protocol\n| summarize OpenPorts=dcount(Port) by Computer\n| project Computer, [\"Number of Open Ports\"] = OpenPorts\n| order by [\"Number of Open Ports\"] desc", + "size": 2, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "Computer", + "exportParameterName": "ComputerName", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Computer", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Open Ports", + "formatter": 4, + "formatOptions": { + "palette": "blueDark", + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "query - 4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "c0b61dbe-ba23-4de3-8304-ef4687456f53", + "version": "KqlParameterItem/1.0", + "name": "ShowDetail", + "type": 1, + "isRequired": true, + "query": "print(strcat('{ComputerName}' != ''))", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "_", + "comparison": "isEqualTo", + "value": "_" + }, + "name": "parameters - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMBoundPort\n| where Computer == '{ComputerName}'\n| summarize BytesSent=sum(BytesSent), BytesReceived=sum(BytesReceived), BytesTotal=sum(BytesSent + BytesReceived) by Port, ProcessName\n| project [\"Port Number\"] = Port, [\"Process Name\"] = ProcessName, [\"Bytes Sent\"] = BytesSent, [\"Bytes Received\"] = BytesReceived, [\"Bytes Total\"] = BytesTotal\n| order by [\"Bytes Total\"] desc", + "size": 2, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Port", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Bytes Sent", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Bytes Received", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Bytes Total", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isEqualTo", + "value": "True" + }, + "customWidth": "50", + "name": "query - 6" + }, + { + "type": 1, + "content": { + "json": "ℹ Select a computer from the table" + }, + "conditionalVisibility": { + "parameterName": "ShowDetail", + "comparison": "isNotEqualTo", + "value": "True" + }, + "customWidth": "50", + "name": "text - 8" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Open Ports/settings.json b/Virtual Machines - Network Dependencies/Workbooks/Open Ports/settings.json new file mode 100644 index 0000000..2789743 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Open Ports/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Open Ports", + "author": "Microsoft", + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 175 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Security and Audit/Security and Audit.workbook b/Virtual Machines - Network Dependencies/Workbooks/Security and Audit/Security and Audit.workbook new file mode 100644 index 0000000..df005ab --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Security and Audit/Security and Audit.workbook @@ -0,0 +1,896 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "80a15801-7442-49f3-a82f-6e55849ec7fb", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "90119d28-e9c1-4c0d-8715-1f601d337f5c", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "7da21a07-10f4-4455-9105-c37132dcee0d", + "version": "KqlParameterItem/1.0", + "name": "ContextSelection", + "type": 1, + "query": "// {DefaultWorkspace}\r\nwhere strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7324c544-2fd2-4d61-b529-481a0f5fd286", + "version": "KqlParameterItem/1.0", + "name": "HybridMode", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ContextSelection is empty ), result = 'false'", + "criteriaContext": { + "leftOperand": "ContextSelection", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ] + }, + { + "id": "2942e38e-232e-4d89-9ada-12f9863b3c5b", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {DefaultSubscription}\r\nsummarize by subscriptionId\r\n| project strcat('/subscriptions/', subscriptionId), selected = iff({HybridMode} == true, iff(subscriptionId == todynamic('{ContextSelection}').sub, true, false), iff(strcat('/subscriptions/', subscriptionId) == '{DefaultSubscription}', true, false))", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2bc1e5fc-cc2d-4eb5-bead-5f7d96664dec", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {Subscriptions}\r\nwhere type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| order by tolower(name) asc\r\n| extend Row = row_number()\r\n| project id, selected = iff({HybridMode} == 'true', iff(id == todynamic('{ContextSelection}').ws, true, false), Row == 1)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d0f502a4-2f0f-4d3d-af70-5198d41f3e0c", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "42d77513-54a6-435f-bc00-c9fa399992ca", + "version": "KqlParameterItem/1.0", + "name": "Test", + "type": 1, + "query": "VMConnection\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": null, + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "label": "Not Onboarded" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "⚠ `VMConnection` was not detected in this workspace. Please onboard to [Azure Monitor for VMs (preview)](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview) or wait until the data has been populated." + }, + "name": "text - 17" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "e1e4b971-e05b-4657-bb86-177000f363fe", + "version": "KqlParameterItem/1.0", + "name": "UniqueDestinationsCount", + "type": 1, + "query": "let friendlyUnit = (Count: string) {\r\n let iCount = toint(Count);\r\n iff(iCount >= 1000000000000, strcat(iCount / 1000000000000, 'T'),\r\n iff(iCount >= 1000000000, strcat(iCount / 1000000000, 'B'),\r\n iff(iCount >= 1000000, strcat(iCount / 1000000, 'M'), \r\n iff(iCount >= 1000, strcat(iCount / 1000, 'K'), Count)\r\n )\r\n )\r\n );\r\n};\r\nVMConnection\r\n| where TimeGenerated {TimeRange}\r\n| summarize by RemoteIp\r\n| summarize Count=count()\r\n| project Count=friendlyUnit(tostring(Count))", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": null, + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "5b030457-00c7-4ad5-a5b6-4699fe1bdac8", + "version": "KqlParameterItem/1.0", + "name": "ActiveComputersCount", + "type": 1, + "query": "let friendlyUnit = (Count: string) {\r\n let iCount = toint(Count);\r\n iff(iCount >= 1000000000000, strcat(iCount / 1000000000000, 'T'),\r\n iff(iCount >= 1000000000, strcat(iCount / 1000000000, 'B'),\r\n iff(iCount >= 1000000, strcat(iCount / 1000000, 'M'), \r\n iff(iCount >= 1000, strcat(iCount / 1000, 'K'), Count)\r\n )\r\n )\r\n );\r\n};\r\nVMConnection\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Computer\r\n| summarize Count=count()\r\n| project Count=friendlyUnit(tostring(Count))", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + }, + { + "id": "a4752c1b-f8cc-4b46-bb1e-2d98ceb0703f", + "version": "KqlParameterItem/1.0", + "name": "OutboundMaliciousTrafficCount", + "type": 1, + "query": "let friendlyUnit = (Count: string) {\r\n let iCount = toint(Count);\r\n iff(iCount >= 1000000000000, strcat(iCount / 1000000000000, 'T'),\r\n iff(iCount >= 1000000000, strcat(iCount / 1000000000, 'B'),\r\n iff(iCount >= 1000000, strcat(iCount / 1000000, 'M'), \r\n iff(iCount >= 1000, strcat(iCount / 1000, 'K'), Count)\r\n )\r\n )\r\n );\r\n};\r\nunion isfuzzy=true (VMConnection\r\n| where Direction == 'outbound'\r\n| extend Country=RemoteCountry, MaliciousIP=MaliciousIp), (WindowsFirewall\r\n| where CommunicationDirection == 'SEND'\r\n| extend Country=MaliciousIPCountry), (CommonSecurityLog\r\n| where CommunicationDirection == 'Outbound'\r\n| extend Country=MaliciousIPCountry)\r\n| where isnotempty(MaliciousIP) and isnotempty(Country)\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Computer\r\n| summarize Count=count()\r\n| project Count=friendlyUnit(tostring(Count))", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "73672024-a6c4-49c6-b4cc-0cfbfd5daae0", + "version": "KqlParameterItem/1.0", + "name": "InboundCount", + "type": 1, + "query": "let friendlyUnit = (Count: string) {\r\n let iCount = toint(Count);\r\n iff(iCount >= 1000000000000, strcat(iCount / 1000000000000, 'T'),\r\n iff(iCount >= 1000000000, strcat(iCount / 1000000000, 'B'),\r\n iff(iCount >= 1000000, strcat(iCount / 1000000, 'M'), \r\n iff(iCount >= 1000, strcat(iCount / 1000, 'K'), Count)\r\n )\r\n )\r\n );\r\n};\r\nVMConnection\r\n| where Direction == 'inbound'\r\n| summarize Count=count()\r\n| project Count=friendlyUnit(tostring(Count))", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + }, + { + "id": "15e4ef79-1abe-49df-8c0a-d719e2635038", + "version": "KqlParameterItem/1.0", + "name": "OutboundCount", + "type": 1, + "query": "let friendlyUnit = (Count: string) {\r\n let iCount = toint(Count);\r\n iff(iCount >= 1000000000000, strcat(iCount / 1000000000000, 'T'),\r\n iff(iCount >= 1000000000, strcat(iCount / 1000000000, 'B'),\r\n iff(iCount >= 1000000, strcat(iCount / 1000000, 'M'), \r\n iff(iCount >= 1000, strcat(iCount / 1000, 'K'), Count)\r\n )\r\n )\r\n );\r\n};\r\nVMConnection\r\n| where TimeGenerated {TimeRange}\r\n| where Direction == 'outbound'\r\n| summarize Count=count()\r\n| project Count=friendlyUnit(tostring(Count))", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + }, + { + "id": "0248fd53-f129-41b4-918f-b5dc6bfa4cb1", + "version": "KqlParameterItem/1.0", + "name": "DistinctMaliciousIPAddressesCount", + "type": 1, + "query": "let friendlyUnit = (Count: string) {\r\n let iCount = toint(Count);\r\n iff(iCount >= 1000000000000, strcat(iCount / 1000000000000, 'T'),\r\n iff(iCount >= 1000000000, strcat(iCount / 1000000000, 'B'),\r\n iff(iCount >= 1000000, strcat(iCount / 1000000, 'M'), \r\n iff(iCount >= 1000, strcat(iCount / 1000, 'K'), Count)\r\n )\r\n )\r\n );\r\n};\r\nVMConnection\r\n| where TimeGenerated {TimeRange}\r\n| summarize Count=dcount(MaliciousIp)\r\n| project Count=friendlyUnit(tostring(Count))", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + }, + { + "id": "92eb52e0-055c-4263-b0e1-98c37e16e499", + "version": "KqlParameterItem/1.0", + "name": "AccountsLoggedOn", + "type": 1, + "query": "SecurityEvent\r\n| where EventID == 4624 and AccountType == 'User'\r\n| extend LowerAccount=tolower(Account)\r\n| summarize Logons = count() by LowerAccount\r\n| summarize count()", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "parameters - 16" + }, + { + "type": 1, + "content": { + "json": "## Malicious Traffic\r\n💡 *Select either `MaliciousIp` or `Country` (or both) to filter traffic data in the tables below. Select `Overall` in both tables to revert back to the overall traffic view.*" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "text - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| extend workbookTrafficType = iff(isempty(MaliciousIp), 'Benign', 'Malicious')\r\n| summarize count() by workbookTrafficType", + "size": 0, + "showAnalytics": true, + "noDataMessage": "No malicious communications have been detected", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "barchart" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "33", + "name": "query - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let overall = VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| summarize MaliciousIp = 'Overall', Count = count(isnotempty(MaliciousIp));\r\nVMConnection\r\n| where TimeGenerated {TimeRange}\r\n| where isnotempty(MaliciousIp)\r\n| summarize Count=count() by MaliciousIp\r\n| union overall\r\n| order by Count desc", + "size": 1, + "showAnalytics": true, + "noDataMessage": "No malicious traffic detected", + "exportFieldName": "MaliciousIp", + "exportParameterName": "SelectedMaliciousIp", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "34", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let schemaColumns = datatable(RemoteIPCountry:string)[];\r\nlet datasource = union isfuzzy=true\r\n(VMConnection | project-rename MaliciousIP = MaliciousIp | project-rename RemoteIPCountry = RemoteCountry),\r\nschemaColumns, W3CIISLog, DnsEvents, WindowsFirewall, CommonSecurityLog;\r\nlet maliciousIps = datasource\r\n| where TimeGenerated {TimeRange}\r\n| where isnotempty(MaliciousIP) and (isnotempty(MaliciousIPCountry) or isnotempty(RemoteIPCountry));\r\nlet inboundConnections = maliciousIps\r\n| where Direction == 'inbound'\r\n| summarize InboundCount = count() by RemoteIPCountry\r\n| project RemoteIPCountry, InboundCount;\r\nlet outboundConnections = maliciousIps\r\n| where Direction != 'inbound'\r\n| summarize OutboundCount = count() by RemoteIPCountry\r\n| project RemoteIPCountry, OutboundCount;\r\nlet nullToZero = (Count: int) {\r\n iff(isnull(Count), 0, Count);\r\n};\r\nlet overallConnections = maliciousIps\r\n| summarize Country = 'Overall', InboundCount = count(Direction == 'inbound'), OutboundCount = count(Direction != 'inbound');\r\ninboundConnections\r\n| join kind=fullouter outboundConnections on RemoteIPCountry\r\n| project Country=RemoteIPCountry, InboundCount=nullToZero(InboundCount), OutboundCount=nullToZero(OutboundCount)\r\n| union overallConnections", + "size": 1, + "showAnalytics": true, + "noDataMessage": "No threats found", + "exportFieldName": "Country", + "exportParameterName": "SelectedCountry", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "InboundCount", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "OutboundCount", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "33", + "name": "query - 4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "28039c82-abee-45f0-8f3a-da3755fcbf64", + "version": "KqlParameterItem/1.0", + "name": "CurrentCountry", + "type": 1, + "query": "let selectedCountry = \"{SelectedCountry}\";\r\nlet output = iff(selectedCountry == \"\" or selectedCountry == \"Overall\", \"\", selectedCountry);\r\nprint output", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "fb0c4176-5126-42fd-94f5-885e1b2c8e4e", + "version": "KqlParameterItem/1.0", + "name": "CountryName", + "type": 1, + "query": "let country = \"{CurrentCountry}\";\r\nlet countryText = iff(country == \"\", \"\", strcat(\" - \", country));\r\nprint countryText", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "683cc77e-2f92-441a-baba-14ab23d86e23", + "version": "KqlParameterItem/1.0", + "name": "QueryCountryFilter", + "type": 1, + "query": "let country = \"{CountryName}\";\r\nlet query = iff(country == \"\", \"\", \" | where RemoteCountry == '{CurrentCountry}'\");\r\nprint query", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "e2d8c284-82cb-44fe-b9a3-068c87b202a4", + "version": "KqlParameterItem/1.0", + "name": "CurrentMaliciousIp", + "type": 1, + "query": "let selectedMaliciousIp = \"{SelectedMaliciousIp}\";\r\nlet output = iff(selectedMaliciousIp == \"\" or selectedMaliciousIp == \"Overall\", \"\", selectedMaliciousIp);\r\nprint output", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "fe7338f5-e988-47f2-a79f-185142fae87e", + "version": "KqlParameterItem/1.0", + "name": "MaliciousIpText", + "type": 1, + "query": "let maliciousIp = \"{CurrentMaliciousIp}\";\r\nlet maliciousIpText = iff(maliciousIp == \"\", \"\", \" - {CurrentMaliciousIp}\");\r\nprint maliciousIpText", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "23c218e9-9941-47eb-9ca8-69aefc86ad6d", + "version": "KqlParameterItem/1.0", + "name": "QueryMaliciousIp", + "type": 1, + "query": "let query = iff(\"{MaliciousIpText}\" == \"\", \"\", \" | where RemoteIp == '{CurrentMaliciousIp}'\");\r\nprint query", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "parameters - 5" + }, + { + "type": 1, + "content": { + "json": "## Overall Traffic{MaliciousIpText}{CountryName}" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "text - 6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMConnection\r\n{QueryMaliciousIp}\r\n{QueryCountryFilter}\r\n| where TimeGenerated {TimeRange}\r\n| summarize count() by Direction, bin(TimeGenerated, {TimeRange:grain})", + "size": 0, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "barchart" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "query - 7" + }, + { + "type": 1, + "content": { + "json": "## Top VMs (Network Traffic){MaliciousIpText}{CountryName}" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "text - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMConnection\r\n{QueryMaliciousIp}\r\n{QueryCountryFilter}\r\n| where TimeGenerated {TimeRange}\r\n| summarize Data=sum(BytesReceived + BytesSent ), Sent=sum(BytesSent), Received=sum(BytesReceived) by Computer\r\n| project Computer=strcat('💻 ', Computer), Data, Received, Sent\r\n| sort by Data desc", + "size": 0, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Data", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Sent", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Received", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "query - 9" + }, + { + "type": 1, + "content": { + "json": "## Top Destinations (Remote IPs){MaliciousIpText}{CountryName}" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "text - 10" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMConnection\r\n{QueryMaliciousIp}\r\n{QueryCountryFilter}\r\n| where TimeGenerated {TimeRange}\r\n| summarize Data=sum(BytesReceived + BytesSent), Received=sum(BytesReceived), Sent=sum(BytesSent), Sessions=dcount(ConnectionId) by RemoteIp, RemoteCountry\r\n| project RemoteIp=strcat('🌐 ', RemoteIp), Data, Received, Sent, Sessions, RemoteCountry\r\n| sort by Data desc", + "size": 0, + "showAnalytics": true, + "noDataMessage": "No destination traffic found", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Data", + "formatter": 8, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Received", + "formatter": 8, + "formatOptions": { + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Sent", + "formatter": 8, + "formatOptions": { + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Sessions", + "formatter": 8, + "formatOptions": { + "palette": "purple", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "query - 11" + }, + { + "type": 1, + "content": { + "json": "## Security Detection" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "text - 12" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspace}" + ], + "parameters": [ + { + "id": "237850e7-685d-43a2-b43c-f0f1d5e4c2df", + "version": "KqlParameterItem/1.0", + "name": "SecurityDetectionTest", + "type": 1, + "query": "SecurityDetection\r\n| take 1", + "crossComponentResources": [ + "{Workspace}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "_", + "comparison": "isEqualTo", + "value": "_" + }, + "name": "parameters - 13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityDetection\r\n| where AlertSeverity == 'High' or AlertSeverity == 'Medium' or AlertSeverity == 'Low'\r\n| where TimeGenerated {TimeRange}\r\n| summarize count() by AlertSeverity, bin(TimeGenerated, {TimeRange:grain})\r\n| order by TimeGenerated", + "size": 0, + "showAnalytics": true, + "noDataMessage": "No security detections found", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "categoricalbar" + }, + "conditionalVisibility": { + "parameterName": "SecurityDetectionTest", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "query - 14" + }, + { + "type": 1, + "content": { + "json": "⚠ `SecurityDetection` was not detected in this workspace. Please either onboard Security Detection or wait until data has been populated." + }, + "conditionalVisibility": { + "parameterName": "SecurityDetectionTest", + "comparison": "isEqualTo", + "value": null + }, + "name": "text - 15" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Security and Audit/settings.json b/Virtual Machines - Network Dependencies/Workbooks/Security and Audit/settings.json new file mode 100644 index 0000000..171cbbf --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Security and Audit/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Security and Audit", + "author": "Microsoft", + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 300 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/TCP Traffic/TCP Traffic.workbook b/Virtual Machines - Network Dependencies/Workbooks/TCP Traffic/TCP Traffic.workbook new file mode 100644 index 0000000..d2997e8 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/TCP Traffic/TCP Traffic.workbook @@ -0,0 +1,424 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "80a15801-7442-49f3-a82f-6e55849ec7fb", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "90119d28-e9c1-4c0d-8715-1f601d337f5c", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "7da21a07-10f4-4455-9105-c37132dcee0d", + "version": "KqlParameterItem/1.0", + "name": "ContextSelection", + "type": 1, + "query": "// {DefaultWorkspace}\r\nwhere strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7324c544-2fd2-4d61-b529-481a0f5fd286", + "version": "KqlParameterItem/1.0", + "name": "HybridMode", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ContextSelection is empty ), result = 'false'", + "criteriaContext": { + "leftOperand": "ContextSelection", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ] + }, + { + "id": "2942e38e-232e-4d89-9ada-12f9863b3c5b", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {DefaultSubscription}\r\nsummarize by subscriptionId\r\n| project strcat('/subscriptions/', subscriptionId), selected = iff({HybridMode} == true, iff(subscriptionId == todynamic('{ContextSelection}').sub, true, false), iff(strcat('/subscriptions/', subscriptionId) == '{DefaultSubscription}', true, false))", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2bc1e5fc-cc2d-4eb5-bead-5f7d96664dec", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {Subscriptions}\r\nwhere type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| order by tolower(name) asc\r\n| extend Row = row_number()\r\n| project id, selected = iff({HybridMode} == 'true', iff(id == todynamic('{ContextSelection}').ws, true, false), Row == 1)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d0f502a4-2f0f-4d3d-af70-5198d41f3e0c", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "48e2b8b9-e618-480c-80e6-5cf1cee85ee9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "label": "Not Onboarded", + "type": 1, + "query": "VMConnection\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "⚠ `VMConnection` table was either not detected or empty. Try the following:\r\n\r\n* Select a different time range\r\n* Try different scope selections\r\n* Onboard to Azure Monitor for VMs ([Azure Monitor for VMs GA FAQ](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-ga-release-faq))." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": "1" + }, + "name": "text - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let overallData = VMConnection\n| summarize Sent = sum(BytesSent), Received = sum(BytesReceived)\n| extend Total = todouble(Sent)+todouble(Received)\n| extend Computer = '🔵 Overall', Type = '1';\nVMConnection\n| summarize Sent = sum(BytesSent), Received = sum(BytesReceived) by Computer\n| extend Total = todouble(Sent)+todouble(Received), Type = '2'\n| union overallData\n| order by Type asc, Total desc\n| project-away Type", + "size": 1, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "Computer", + "exportParameterName": "Computer", + "exportDefaultValue": "🔵 Overall", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Sent", + "formatter": 4, + "formatOptions": { + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "Received", + "formatter": 4, + "formatOptions": { + "palette": "purple", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true + } + } + }, + { + "columnMatch": "Total", + "formatter": 4, + "formatOptions": { + "palette": "turquoise", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true + } + } + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "query - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "29398687-fa75-4afa-806c-89a376bd0c21", + "version": "KqlParameterItem/1.0", + "name": "ComputerName", + "type": 1, + "value": null, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Computer == '🔵 Overall'), result = '*'", + "criteriaContext": { + "leftOperand": "Computer", + "operator": "==", + "rightValType": "static", + "rightVal": "🔵 Overall", + "resultValType": "static", + "resultVal": "*" + } + }, + { + "condition": "else result = Computer", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Computer" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "parameters - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMConnection\n| where Computer in (\"{ComputerName}\") or '*' in (\"{ComputerName}\") \n| summarize Sent = sum(BytesSent), Received = sum(BytesReceived) by bin(TimeGenerated, {TimeRange:grain})", + "size": 0, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "query - 3" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/TCP Traffic/settings.json b/Virtual Machines - Network Dependencies/Workbooks/TCP Traffic/settings.json new file mode 100644 index 0000000..2dfad4a --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/TCP Traffic/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"TCP Traffic", + "author": "Microsoft", + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 200 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Traffic Comparison/Traffic Comparison.workbook b/Virtual Machines - Network Dependencies/Workbooks/Traffic Comparison/Traffic Comparison.workbook new file mode 100644 index 0000000..f9f794a --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Traffic Comparison/Traffic Comparison.workbook @@ -0,0 +1,667 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "80a15801-7442-49f3-a82f-6e55849ec7fb", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "90119d28-e9c1-4c0d-8715-1f601d337f5c", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "7da21a07-10f4-4455-9105-c37132dcee0d", + "version": "KqlParameterItem/1.0", + "name": "ContextSelection", + "type": 1, + "query": "// {DefaultWorkspace}\r\nwhere strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7324c544-2fd2-4d61-b529-481a0f5fd286", + "version": "KqlParameterItem/1.0", + "name": "HybridMode", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ContextSelection is empty ), result = 'false'", + "criteriaContext": { + "leftOperand": "ContextSelection", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ] + }, + { + "id": "2942e38e-232e-4d89-9ada-12f9863b3c5b", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {DefaultSubscription}\r\nsummarize by subscriptionId\r\n| project strcat('/subscriptions/', subscriptionId), selected = iff({HybridMode} == true, iff(subscriptionId == todynamic('{ContextSelection}').sub, true, false), iff(strcat('/subscriptions/', subscriptionId) == '{DefaultSubscription}', true, false))", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2bc1e5fc-cc2d-4eb5-bead-5f7d96664dec", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "// {DefaultWorkspace} {ContextSelection} {Subscriptions}\r\nwhere type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| order by tolower(name) asc\r\n| extend Row = row_number()\r\n| project id, selected = iff({HybridMode} == 'true', iff(id == todynamic('{ContextSelection}').ws, true, false), Row == 1)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d0f502a4-2f0f-4d3d-af70-5198d41f3e0c", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "48e2b8b9-e618-480c-80e6-5cf1cee85ee9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "label": "Not Onboarded", + "type": 1, + "query": "VMConnection\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "⚠ `VMConnection` table was either not detected or empty. Try the following:\r\n\r\n* Select a different time range\r\n* Try different scope selections\r\n* Onboard to Azure Monitor for VMs ([Azure Monitor for VMs GA FAQ](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-ga-release-faq))." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": "1" + }, + "name": "text - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "483bfb9d-aa94-4968-9ea7-1aab10f9d8c2", + "version": "KqlParameterItem/1.0", + "name": "Computer", + "type": 2, + "isRequired": true, + "query": "VMConnection\r\n| distinct Computer", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": "value::1", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "Compare traffic between two times periods for machine `{Computer}` in workspace `{Workspace:label}`\r\n\r\n---" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "text - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "f387f0ee-cbd6-4767-8e11-731857ef795e", + "version": "KqlParameterItem/1.0", + "name": "StartDate", + "type": 1, + "description": "Use the format yyy-MM-DD to denote at which date to start network data", + "isRequired": true, + "query": "print strcat(format_datetime(now(), 'yyyy-MM-dd'))", + "crossComponentResources": [ + "{Workspaces}" + ], + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "0f5798db-d43b-49eb-8e0d-a66c266ef557", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 1, + "description": "Use kusto timespan format to specify the length of time to retrieve network data", + "isRequired": true, + "value": "24h" + }, + { + "id": "6ca7a031-ad7a-4af6-8d84-26795a09ede0", + "version": "KqlParameterItem/1.0", + "name": "TimeGrain", + "type": 1, + "description": "Use kusto timespan format to specify the bin size of the chart", + "isRequired": true, + "value": "15m" + }, + { + "id": "1b5c6bd9-07dc-4ab8-b92b-1e5d5c56badc", + "version": "KqlParameterItem/1.0", + "name": "StartDateA", + "type": 1, + "query": "print '{StartDate}'", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "647c61bb-b614-443e-8c63-e05f7c4ebca7", + "version": "KqlParameterItem/1.0", + "name": "TimeRangeA", + "type": 1, + "query": "print '{TimeRange}'", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "c63b78d2-5831-4a93-aee3-64ee50e0b226", + "version": "KqlParameterItem/1.0", + "name": "TimeGrainA", + "type": 1, + "query": "print '{TimeGrain}'", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "parameters - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "89810243-7323-42b1-8bde-970df46c4da1", + "version": "KqlParameterItem/1.0", + "name": "StartDate", + "type": 1, + "description": "Use the format yyyy-MM-DD to denote at which date to start network data", + "isRequired": true, + "query": "print strcat(format_datetime(now()-1d, 'yyyy-MM-dd'))", + "crossComponentResources": [ + "{Workspaces}" + ], + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "876c9ba0-1e2c-4bb8-aa8e-c6fe54be3f7e", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 1, + "description": "Use kusto timespan format to specify the length of time to retrieve network data", + "isRequired": true, + "value": "24h" + }, + { + "id": "fbe95517-035f-4476-8a47-e5eb8cea82b7", + "version": "KqlParameterItem/1.0", + "name": "TimeGrain", + "type": 1, + "description": "Use kusto timespan format to specify the bin size of the chart", + "isRequired": true, + "value": "15m" + }, + { + "id": "03ec8961-833c-4396-99ae-b4ec3703ed3f", + "version": "KqlParameterItem/1.0", + "name": "StartDateB", + "type": 1, + "query": "print '{StartDate}'", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6cc71fe8-0014-403b-ba21-c08d23d0329d", + "version": "KqlParameterItem/1.0", + "name": "TimeRangeB", + "type": 1, + "query": "print '{TimeRange}'", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "d632d1d8-37e1-4f03-b725-28b93abc6369", + "version": "KqlParameterItem/1.0", + "name": "TimeGrainB", + "type": 1, + "query": "print '{TimeGrain}'", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "parameters - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let Computer = \"{Computer}\";\r\nlet TimeRange = time(\"{TimeRangeA}\");\r\nlet BinSize = time(\"{TimeGrainA}\");\r\nlet StartTime = datetime(\"{StartDateA}\");\r\nlet EndTime = StartTime + TimeRange;\r\nVMConnection​\r\n| where Computer == Computer\r\n| where TimeGenerated between( StartTime .. EndTime )\r\n| summarize BytesSent = sum(BytesSent), ByteReceived = sum(BytesReceived) by bin(TimeGenerated, BinSize)​\r\n| render timechart", + "size": 0, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ] + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "query - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let Computer = \"{Computer}\";\r\nlet TimeRange = time(\"{TimeRangeB}\");\r\nlet BinSize = time(\"{TimeGrainB}\");\r\nlet StartTime = datetime(\"{StartDateB}\");\r\nlet EndTime = StartTime + TimeRange;\r\nVMConnection​\r\n| where Computer == Computer\r\n| where TimeGenerated between( StartTime .. EndTime )\r\n| summarize BytesSent = sum(BytesSent), ByteReceived = sum(BytesReceived) by bin(TimeGenerated, BinSize)​\r\n| render timechart", + "size": 0, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ] + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "query - 6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let Computer = \"{Computer}\";\r\nlet TimeRange = time(\"{TimeRangeA}\");\r\nlet BinSize = time(\"{TimeGrainA}\");\r\nlet StartTime = datetime(\"{StartDateA}\");\r\nlet EndTime = StartTime + TimeRange;\r\nVMConnection​\r\n| where Computer == Computer\r\n| where TimeGenerated between( StartTime .. EndTime )\r\n| summarize BytesSent = sum(BytesSent), BytesReceived = sum(BytesReceived) by ProcessName\r\n| order by BytesSent desc", + "size": 0, + "showAnalytics": true, + "exportParameterName": "ProcessA", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "BytesSent", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "BytesReceived", + "formatter": 8, + "formatOptions": { + "palette": "purple", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + } + ], + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "query - 7" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let Computer = \"{Computer}\";\r\nlet TimeRange = time(\"{TimeRangeB}\");\r\nlet BinSize = time(\"{TimeGrainB}\");\r\nlet StartTime = datetime(\"{StartDateB}\");\r\nlet EndTime = StartTime + TimeRange;\r\nVMConnection​\r\n| where Computer == Computer\r\n| where TimeGenerated between( StartTime .. EndTime )\r\n| summarize BytesSent = sum(BytesSent), BytesReceived = sum(BytesReceived) by ProcessName\r\n| order by BytesSent desc", + "size": 0, + "showAnalytics": true, + "exportParameterName": "ProcessB", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "BytesSent", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "BytesReceived", + "formatter": 8, + "formatOptions": { + "palette": "purple", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + } + ], + "rowLimit": 10000 + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "50", + "name": "query - 8" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/Traffic Comparison/settings.json b/Virtual Machines - Network Dependencies/Workbooks/Traffic Comparison/settings.json new file mode 100644 index 0000000..ce51d74 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/Traffic Comparison/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Traffic Comparison", + "author": "Microsoft", + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 200 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/VM Events/VM Events.workbook b/Virtual Machines - Network Dependencies/Workbooks/VM Events/VM Events.workbook new file mode 100644 index 0000000..beee105 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/VM Events/VM Events.workbook @@ -0,0 +1,592 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "💡 You will need to install [MMA Agent](https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows) on your Windows machine in order to view _Unexpected VM Reboots_ or _VM Crashes_ from the `Events` table" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "e41c2177-932a-4c58-ba24-03ef070eb197", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + "value::1" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": null + }, + { + "id": "5f8cce4b-9c4c-47da-8683-7e5ccc9faed3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": false, + "value": { + "durationMs": 14400000 + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Unexpected VM Reboots" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## VM Crashes" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Event​\r\n| where TimeGenerated {TimeRange}\r\n| where EventLog == \"System\" and Source == \"Microsoft-Windows-Kernel-Power\"​\r\n| where EventID == 41​\r\n| summarize KPIValue = count() by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), Computer", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "noDataMessage": "No unexpected reboots.", + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "KPIValue", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Event​\r\n| where TimeGenerated {TimeRange}\r\n| where EventLog == \"System\" and Source == \"Microsoft-Windows-WER-SystemErrorReporting\" and EventLevelName == \"Error\"​\r\n| where EventID == 1001​​\r\n| summarize KPIValue = count() by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), Computer", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "noDataMessage": "No VM crashes.", + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "KPIValue", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "## Outbound Connection Failures " + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMConnection\r\n| where TimeGenerated {TimeRange}\r\n| where LinksFailed > 0\r\n| summarize LinksFailed = sum(LinksFailed) by Computer, SourceIp, ProcessName, DestinationIp, DestinationPort\r\n| order by LinksFailed desc, Computer asc, SourceIp asc, ProcessName asc, DestinationIp asc, DestinationPort asc", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "DestinationPort", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "LinksFailed", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ] + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "KPIValue", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## VPN Tunnel Stats" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureDiagnostics\r\n| where TimeGenerated {TimeRange}\r\n| project TimeGenerated, instance_s = columnifexists('instance_s', ''), remoteIP_s = columnifexists('remoteIP_s', ''), status_s = columnifexists('status_s', ''), stateChangeReason_s = columnifexists('stateChangeReason_s', '')\r\n| where instance_s != '' or remoteIP_s != '' or status_s != '' or stateChangeReason_s != ''", + "showQuery": false, + "size": 0, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "noDataMessage": "No VPN Tunnel Stats. Please check if the workspace is configured to collect this data.", + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "KPIValue", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Successful Activities" + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 1, + "content": { + "json": "## Failed Activities" + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 1, + "content": { + "json": "## Remaining Activities" + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureActivity\r\n| where TimeGenerated {TimeRange}\r\n| where ActivityStatus =~ \"Succeeded\"\r\n| summarize Count = count() by OperationName\r\n| order by Count desc, OperationName asc", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ] + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "KPIValue", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureActivity\r\n| where TimeGenerated {TimeRange}\r\n| where ActivityStatus =~ \"Failed\"\r\n| summarize Count = count() by OperationName\r\n| order by Count desc, OperationName asc", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ] + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "KPIValue", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null, + "customWidth": "33" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureActivity\r\n| where TimeGenerated {TimeRange}\r\n| where ActivityStatus !~ \"Failed\"\r\n| where ActivityStatus !~ \"Succeeded\"\r\n| summarize Count = count() by OperationName, ActivityStatus\r\n| order by Count desc, OperationName asc, ActivityStatus asc", + "showQuery": false, + "size": 1, + "aggregation": 0, + "showAnnotations": false, + "showAnalytics": false, + "timeContextFromParameter": null, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + } + ] + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "KPIValue", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": null, + "customWidth": "33" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/VM Events/settings.json b/Virtual Machines - Network Dependencies/Workbooks/VM Events/settings.json new file mode 100644 index 0000000..61be793 --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/VM Events/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "VM Events (preview)", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 300 } + ] +} diff --git a/Virtual Machines - Network Dependencies/Workbooks/categoryResources.json b/Virtual Machines - Network Dependencies/Workbooks/categoryResources.json new file mode 100644 index 0000000..034cc6e --- /dev/null +++ b/Virtual Machines - Network Dependencies/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Network Dependencies", "description": "Look for network dependencies of your Virtual Machines.", "order": 200} +} diff --git a/Virtual Machines - Performance Analysis/Alerts/README b/Virtual Machines - Performance Analysis/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Virtual Machines - Performance Analysis/Queries/README b/Virtual Machines - Performance Analysis/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Virtual Machines - Performance Analysis/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Azure Preview)/Performance Analysis for a Group of VMs (Azure Preview).workbook b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Azure Preview)/Performance Analysis for a Group of VMs (Azure Preview).workbook new file mode 100644 index 0000000..a6d91d9 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Azure Preview)/Performance Analysis for a Group of VMs (Azure Preview).workbook @@ -0,0 +1,1763 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Performance Analysis" + }, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "10607c01-15dc-4df0-a70f-8d1823c41ac0", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "f95de9f8-8ce2-45d7-9515-c1396cb125eb", + "version": "KqlParameterItem/1.0", + "name": "DefaultResourceGroup", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/resourcegroups": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "54f9b46f-0363-425f-9411-d79d847caa21", + "version": "KqlParameterItem/1.0", + "name": "SelectedResourceGroup", + "type": 1, + "value": "false", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (DefaultResourceGroup != 'value::1'), result = 'false'", + "criteriaContext": { + "leftOperand": "DefaultResourceGroup", + "operator": "!=", + "rightValType": "static", + "rightVal": "value::1", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ], + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "6388d6d7-d4ca-4f3d-b581-42aeaa41e63f", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "1f191d03-002b-4b04-a4ee-c5bedb8e6527", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "query": "where type in~('microsoft.compute/virtualmachines', 'microsoft.compute/virtualmachinescalesets')\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| project value = subscriptionId, label = subscriptionId, selected = iff(strcat('/subscriptions/', subscriptionId) =~ '{DefaultSubscription}', true, false)", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "ebdc8ba1-90cc-4029-8df5-bf9deb31df0a", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroups", + "label": "Resource groups", + "type": 2, + "isRequired": true, + "query": "Resources\r\n| where type in~('microsoft.compute/virtualmachines', 'microsoft.compute/virtualmachinescalesets')\r\n| summarize Count = count() by ResourceGroup = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), ResourceGroupName = resourceGroup\r\n| order by Count desc\r\n| project value = ResourceGroup, label = ResourceGroupName, selected = iff(ResourceGroup =~ '{DefaultResourceGroup}', true, false)\r\n| union (datatable(value:string, label:string, selected:boolean)[\r\n'*', 'All resource groups', {SelectedResourceGroup}\r\n])", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "236186d0-04f4-4752-826b-239202ec9b44", + "version": "KqlParameterItem/1.0", + "name": "ArmPrefix", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ResourceGroups != '*'), result = '{ResourceGroups:unformatted}'", + "criteriaContext": { + "leftOperand": "ResourceGroups", + "operator": "!=", + "rightValType": "static", + "rightVal": "*", + "resultValType": "static", + "resultVal": "{ResourceGroups:unformatted}" + } + }, + { + "condition": "else result = '{Subscription}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{Subscription}" + } + } + ], + "timeContextFromParameter": "TimeRange", + "value": "", + "resourceType": "microsoft.insights/components" + }, + { + "id": "19132bc7-1624-4205-98d7-abc779dc1824", + "version": "KqlParameterItem/1.0", + "name": "ArmUrl", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{ArmPrefix}/providers/Microsoft.Insights/vmInsightsOnboardingStatuses?api-version=2018-11-27-preview\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "de30cdfe-fcab-4c1a-8e84-cf12e08fb804", + "version": "KqlParameterItem/1.0", + "name": "OnboardQueryResult", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{ArmUrl}\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 12 + }, + { + "id": "d0dc9f80-0be7-48cb-a4b3-fdb9f64932a1", + "version": "KqlParameterItem/1.0", + "name": "OnboardedVms", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "{\"version\":\"1.0.0\",\"content\":\"{OnboardQueryResult}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value.*\",\"columns\":[{\"path\":\"$.properties.resourceId\",\"columnid\":\"Workspaces\"}]}}]}", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "f3884e38-09d5-40cb-baa7-f5906e23d307", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachines", + "label": "Virtual machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| take 1\n| project ids = dynamic([{OnboardedVms}])\n| mvexpand ids limit 400\n| extend id = tolower(tostring(ids))\n| extend vmss = extract(@'(/subscriptions/.+/resourcegroups/.+/providers/microsoft.compute/virtualmachinescalesets/.+)/virtualmachines/.+', 1, id)\n| extend arc = extract(@'(/subscriptions/.+/resourcegroups/.+/providers/microsoft.hybridcompute/machines/.+)', 1, id)\n| project id = iff(vmss == '', id, vmss), group = iff(vmss == '', iff(arc == '', 'Virtual machine', 'Azure Arc machine'), 'Virtual machine scale sets')\n| summarize by id, group\n| project value = id, label = id, selected = false, group", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c50c67ca-3dba-4a7f-ad19-2d5d28185e12", + "version": "KqlParameterItem/1.0", + "name": "TargetWorkspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "\"", + "delimiter": ",", + "query": "{\"version\":\"1.0.0\",\"content\":\"{OnboardQueryResult}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value.*\",\"columns\":[{\"path\":\"$.properties.data.*.workspace.id\",\"columnid\":\"Workspaces\"}]}}]}", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "97011276-637b-46e6-9e9f-056c30389501", + "version": "KqlParameterItem/1.0", + "name": "DistinctTargetWorkspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| take 1\n| project ws = '{TargetWorkspaces}'\n| extend ws = replace(@'\"\\[', '', ws)\n| extend ws = replace(@'\\]\"', '', ws)\n| extend ws = todynamic(strcat('[', ws, ']'))\n| mvexpand ws limit 400\n| summarize by tolower(tostring(ws))", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "a40d5985-4da2-4c55-b73e-4cca93c8b560", + "version": "KqlParameterItem/1.0", + "name": "WorkspaceLocations", + "label": "Workspace locations", + "type": 8, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({DistinctTargetWorkspaces})\n| summarize Count = count() by location\n| order by Count desc\n| extend Row = row_number()\n| project value = location, label = location, selected = Row == 1", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2454837b-8bc8-4707-8245-0560c029b0ac", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({DistinctTargetWorkspaces}) and location in ({WorkspaceLocations})\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7b41836d-1da2-4f43-91fe-4edc728e87fa", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "905e418c-ddf2-4d5f-9821-66e15381ceed", + "version": "KqlParameterItem/1.0", + "name": "Test", + "label": "Not Onboarded", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{OnboardedVms}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "9711af09-11eb-4b4d-8de0-ea21677fae4d", + "version": "KqlParameterItem/1.0", + "name": "virtualMachinesSnippet", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"| where _ResourceId in ({VirtualMachines}) or _ResourceIdVmss in ({VirtualMachines})\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "c94a9f39-9d0c-406e-92e2-2dc0a3c2ac9b", + "version": "KqlParameterItem/1.0", + "name": "virtualMachinesValue", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{VirtualMachines}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "80df5c1e-5eaf-4f4a-bf40-8c81aaebcc19", + "version": "KqlParameterItem/1.0", + "name": "vmSnippet", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (virtualMachinesValue == '*'), result = '| where _ResourceId startswith \"{ArmPrefix}\"'", + "criteriaContext": { + "leftOperand": "virtualMachinesValue", + "operator": "==", + "rightValType": "static", + "rightVal": "*", + "resultValType": "static", + "resultVal": "| where _ResourceId startswith \"{ArmPrefix}\"" + } + }, + { + "condition": "else result = virtualMachinesSnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "virtualMachinesSnippet" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 8 + }, + "name": "top-level parameters" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Top 100 Machines", + "subTarget": "top100", + "style": "link" + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Top 10 Machines", + "subTarget": "top10", + "style": "link" + } + ] + }, + "name": "top-level tabs" + }, + { + "type": 1, + "content": { + "json": "⚠ No counters were detected. Try the following:\r\n\r\n* Select a different time range\r\n* Try different scope selections\r\n* Onboard to Azure Monitor for VMs ([Azure Monitor for VMs GA FAQ](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-ga-release-faq))." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": null + }, + "name": "onboarding prompt" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "description": "Select a VM performance counter for the table below", + "query": "InsightsMetrics\r\n| parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n{vmSnippet}\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Namespace, Name, CounterText = Name\r\n| order by Name asc, Namespace asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "9ad8858d-8ef3-4144-94b1-66a8bf9fa9c9", + "version": "KqlParameterItem/1.0", + "name": "Aggregators", + "type": 2, + "description": "Select one or more different aggregates to display in the table below", + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th\", \"label\":\"P95th\", \"selected\": true },\r\n { \"value\":\"Min\", \"label\":\"Min\", \"selected\": false },\r\n { \"value\":\"Max\", \"label\":\"Max\", \"selected\": true }\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TableTrend", + "type": 2, + "description": "Select a percentile to display in the Trend column in the table below", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\": false }\r\n]", + "label": "Table Trend", + "resourceType": "microsoft.insights/components" + }, + { + "id": "a31e3a83-360d-49a2-9fbd-928dd8e3ff35", + "version": "KqlParameterItem/1.0", + "name": "tableTrendLabel", + "type": 1, + "description": "Select a percentile to display in the Trend column in the table below", + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TableTrend:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "672b978e-5ee5-48c0-ba3a-fe6fc45d3f26", + "version": "KqlParameterItem/1.0", + "name": "tableTrendOrder", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TableTrend contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TableTrend", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TableTrend contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TableTrend", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "c2f05b6d-970d-4fde-88b0-868387c02250", + "version": "KqlParameterItem/1.0", + "name": "mergedAggregators", + "type": 1, + "value": "Average", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregators contains tableTrendLabel), result = Aggregators", + "criteriaContext": { + "leftOperand": "Aggregators", + "operator": "contains", + "rightValType": "param", + "rightVal": "tableTrendLabel", + "resultValType": "param", + "resultVal": "Aggregators" + } + }, + { + "condition": "else result = '{Aggregators},{tableTrendLabel}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{Aggregators},{tableTrendLabel}" + } + } + ], + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + } + ], + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "top-100 parameters" + }, + { + "type": 1, + "content": { + "json": "⚠ Select a `Counter`" + }, + "conditionalVisibilities": [ + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + }, + { + "parameterName": "Counter", + "comparison": "isEqualTo" + }, + { + "parameterName": "Test", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + }, + "name": "text - 23" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter}); \r\nlet timeRangeStart = {TimeRange:start};\r\nlet timeRangeEnd = {TimeRange:end};\r\nlet timeRangeGrain = {TimeRange:grain};\r\nlet maxResultCount = 100;\r\nlet summaryPerComputer = totable(InsightsMetrics | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where TimeGenerated {TimeRange} | where Namespace == metric.object and Name == metric.counter | summarize hint.shufflekey = Computer Average = avg(Val), Max = max(Val), Min = min(Val), percentiles(Val, 5, 10, 50, 80, 90, 95) by Computer | project Computer, Average, Max, Min, P5th = percentile_Val_5, P10th = percentile_Val_10, P50th = percentile_Val_50, P80th = percentile_Val_80, P90th = percentile_Val_90, P95th = percentile_Val_95 | order by {TableTrend:label} {tableTrendOrder}, Computer | limit maxResultCount); let computerList = summaryPerComputer | project Computer; let MachineSummary = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | project Computer, MachineSummary = pack('Fully Qualified Domain Name', Computer, 'OS Type', OperatingSystemFamily_s, 'Operating System', OperatingSystemFullName_s, 'Ipv4 Addresses', Ipv4Addresses_s, 'Ipv6 Addresses', Ipv6Addresses_s, 'Mac Addresses', MacAddresses_s, 'DNS Names', DnsNames_s, 'CPUs', strcat(Cpus_d, ' @ ', CpuSpeed_d, ' MHz'), 'Bitness', Bitness_s, 'Physcial Memory', strcat(PhysicalMemory_d, ' MB'), 'Virtualization State', VirtualizationState_s, 'VM Type', VirtualMachineType_s, 'OMS Agent', split(ResourceName_s, 'm-')[1]);let EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];let OmsNodeIdentityAndProps = computerList | extend NodeId = Computer | extend Priority = 1 | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);let ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), ' |', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), ' |', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId) | project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;let NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps | summarize arg_max(Priority, *) by Computer; let NodeIdentityAndPropsMin = NodeIdentityAndProps | extend Type = iff(NodeProps.type == 'StandAloneNode', iff(NodeProps.azureResourceId == '', 'Non-Azure Virtual Machine', 'Azure Virtual Machine'), NodeProps.type), ResourceId = iff(NodeProps.type == 'AzureScaleSetNode', NodeProps.vmScaleSetResourceId, iff(NodeProps.type == 'AzureCloudServiceNode', NodeProps.cloudServiceDeploymentId, Computer)), ResourceName = iff(NodeProps.type == 'AzureScaleSetNode', strcat(NodeProps.vmScaleSetName, ' | ', NodeProps.scaleSetInstanceId), iff(NodeProps.type == 'AzureCloudServiceNode', strcat(NodeProps.cloudServiceRoleName, ' | ', NodeProps.cloudServiceInstanceId), Computer)) | project Computer, Type, ResourceId, ResourceName;let trend = InsightsMetrics | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet} | where TimeGenerated {TimeRange} | where Computer in (computerList) | where Namespace == metric.object and Name == metric.counter | make-series {TableTrend} default = 0 on TimeGenerated in range(timeRangeStart, timeRangeEnd, timeRangeGrain) by Computer | project Computer, ['Trend ({TableTrend:label})'] = {TableTrend:label}; summaryPerComputer | join kind=leftouter (trend) on Computer | join kind=leftouter (NodeIdentityAndProps) on Computer | join kind=leftouter (NodeIdentityAndPropsMin) on Computer | join kind=leftouter (MachineSummary) on Computer | project ResourceName, Type, {mergedAggregators}, ['Trend ({TableTrend:label})'], Properties = MachineSummary | sort by {TableTrend:label} {tableTrendOrder}", + "size": 3, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Average", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P50th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (Average)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Properties", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info" + } + }, + { + "columnMatch": "P95th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P5th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P10th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P80th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P90th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Min", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Max", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (P95th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P5th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P90th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P80th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P50th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P10th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + } + ] + }, + "sortBy": [] + }, + "conditionalVisibilities": [ + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + }, + { + "parameterName": "Counter", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + }, + "name": "top-100 query" + }, + { + "type": 1, + "content": { + "json": "### CPU Utilization %" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 12" + }, + { + "type": 1, + "content": { + "json": "### Available Memory" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "92358ae0-d5e1-494b-b65b-6d904f1325c5", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "27345375-4376-4e2f-8ac4-59d4eab9d235", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregate contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (Aggregate contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "4d9ba0ec-9d22-4fec-9f85-4be334f42d91", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:value}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "50242f48-6c7d-449b-ad93-838c94e615a0", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:label}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + } + ], + "style": "above", + "queryType": 8 + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "cpu params" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "333837c2-d5a4-4173-9aad-3db1dca17e2a", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P5th = round(percentile(Val, 5), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "a23b29a5-5e4a-4d8e-ba73-bfdf27b2980e", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "value": "asc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregate contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (Aggregate contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "cc8dfabc-9eb9-4227-97bb-f5e9319030ec", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:value}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "ff7a79ff-742a-4c6e-8628-c52f45b3bf71", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:label}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + } + ], + "style": "above", + "queryType": 8 + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "memory params" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let cpuSummary=totable(InsightsMetrics \r\n | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n {vmSnippet}\r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n {vmSnippet}\r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 1, + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "cpu query" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * {vmSnippet}\r\n | where Namespace == 'Memory' and Name == 'AvailableMB'\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, Name\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics \r\n | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" * \r\n {vmSnippet}\r\n | where Namespace == 'Memory' and Name == 'AvailableMB'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 4, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "memory query" + }, + { + "type": 1, + "content": { + "json": "### Bytes Sent Rate" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "### Bytes Received Rate" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 19" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "360da4c1-97fa-4b15-a008-33a6110d0acd", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "31ccd4a1-d626-44bb-a5de-1780a33b37a5", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregate contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (Aggregate contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "4765abab-a682-49f6-bb41-d64852aba192", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:value}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "1d9b0ea9-09d4-4c73-8e59-fa7ab760b880", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:label}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + } + ], + "style": "above", + "queryType": 8 + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "bytes sent params" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "6772b281-d17d-4293-a227-1b2ed67f399e", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "5e2eef28-0528-406f-86b5-ceae535455f9", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregate contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (Aggregate contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ], + "resourceType": "microsoft.insights/components" + }, + { + "id": "586fa51c-1a45-4602-adcb-62eb0f619b7f", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:value}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "912085b6-f920-4a37-9ce3-f1ef86bd5df8", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:label}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + } + ], + "style": "above", + "queryType": 8 + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "bytes received params" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n {vmSnippet}\r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics \r\n | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n {vmSnippet}\r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "bytes sent query" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n {vmSnippet}\r\n | where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, Name\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics \r\n | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n {vmSnippet}\r\n | where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "bytes received query" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk Space Used %" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 24" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 25" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "5d6afbec-79f6-4cd1-b3a1-361503478304", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "1d5a805c-acce-4afe-a38b-c2740fb3ff26", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrder", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregate contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (Aggregate contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ], + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "logical disk space used params" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 27" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics \r\n | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n {vmSnippet}\r\n | where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n\t| extend Val = 100 - Val\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics \r\n | parse kind=regex _ResourceId with _ResourceIdVmss \"/virtualmachines/([0-9]+)\" *\r\n {vmSnippet}\r\n | where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n\t| extend Val = 100 - Val\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 1, + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "logical disk space used query" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Azure Preview)/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Azure Preview)/settings.json new file mode 100644 index 0000000..067c4db --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Azure Preview)/settings.json @@ -0,0 +1,10 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance (Azure Preview)", + "isPreview": true, + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorVirtualMachines", "order": 100 }, + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 200 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Dev)/Performance Analysis for a Group of VMs (Dev).workbook b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Dev)/Performance Analysis for a Group of VMs (Dev).workbook new file mode 100644 index 0000000..3a22608 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Dev)/Performance Analysis for a Group of VMs (Dev).workbook @@ -0,0 +1,1765 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Performance Analysis" + }, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "10607c01-15dc-4df0-a70f-8d1823c41ac0", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "f95de9f8-8ce2-45d7-9515-c1396cb125eb", + "version": "KqlParameterItem/1.0", + "name": "DefaultResourceGroup", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/resourcegroups": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "54f9b46f-0363-425f-9411-d79d847caa21", + "version": "KqlParameterItem/1.0", + "name": "SelectedResourceGroup", + "type": 1, + "value": "true", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (DefaultResourceGroup != 'value::1'), result = 'false'", + "criteriaContext": { + "leftOperand": "DefaultResourceGroup", + "operator": "!=", + "rightValType": "static", + "rightVal": "value::1", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ], + "timeContextFromParameter": "TimeRange" + }, + { + "id": "6388d6d7-d4ca-4f3d-b581-42aeaa41e63f", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "1f191d03-002b-4b04-a4ee-c5bedb8e6527", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "query": "where type in~('microsoft.compute/virtualmachines', 'microsoft.compute/virtualmachinescalesets')\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| project value = subscriptionId, label = subscriptionId, selected = iff(strcat('/subscriptions/', subscriptionId) =~ '{DefaultSubscription}', true, false)", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "ebdc8ba1-90cc-4029-8df5-bf9deb31df0a", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroups", + "label": "Resource groups", + "type": 2, + "isRequired": true, + "query": "Resources\r\n| where type in~('microsoft.compute/virtualmachines', 'microsoft.compute/virtualmachinescalesets')\r\n| summarize Count = count() by ResourceGroup = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), ResourceGroupName = resourceGroup\r\n| order by Count desc\r\n| project value = ResourceGroup, label = ResourceGroupName, selected = iff(ResourceGroup =~ '{DefaultResourceGroup}', true, false)\r\n| union (datatable(value:string, label:string, selected:boolean)[\r\n'*', 'All resource groups', {SelectedResourceGroup}\r\n])", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "236186d0-04f4-4752-826b-239202ec9b44", + "version": "KqlParameterItem/1.0", + "name": "ArmPrefix", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ResourceGroups != '*'), result = '{ResourceGroups:unformatted}'", + "criteriaContext": { + "leftOperand": "ResourceGroups", + "operator": "!=", + "rightValType": "static", + "rightVal": "*", + "resultValType": "static", + "resultVal": "{ResourceGroups:unformatted}" + } + }, + { + "condition": "else result = '{Subscription}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{Subscription}" + } + } + ], + "timeContextFromParameter": "TimeRange", + "value": "" + }, + { + "id": "19132bc7-1624-4205-98d7-abc779dc1824", + "version": "KqlParameterItem/1.0", + "name": "ArmUrl", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{ArmPrefix}/providers/Microsoft.Insights/vmInsightsOnboardingStatuses?api-version=2018-11-27-preview\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 8, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "de30cdfe-fcab-4c1a-8e84-cf12e08fb804", + "version": "KqlParameterItem/1.0", + "name": "OnboardQueryResult", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{ArmUrl}\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContextFromParameter": "TimeRange", + "queryType": 12, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "d0dc9f80-0be7-48cb-a4b3-fdb9f64932a1", + "version": "KqlParameterItem/1.0", + "name": "OnboardedVms", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "{\"version\":\"1.0.0\",\"content\":\"{OnboardQueryResult}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value.*\",\"columns\":[{\"path\":\"$.properties.resourceId\",\"columnid\":\"Workspaces\"}]}}]}", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "f3884e38-09d5-40cb-baa7-f5906e23d307", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachines", + "label": "Virtual machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| take 1\n| project ids = dynamic([{OnboardedVms}])\n| mvexpand ids limit 400\n| extend id = tolower(tostring(ids))\n| extend vmss = extract(@'(/subscriptions/.+/resourcegroups/.+/providers/microsoft.compute/virtualmachinescalesets/.+)/virtualmachines/.+', 1, id)\n| project id = iff(vmss == '', id, vmss), group = iff(vmss == '', 'Virtual machines', 'Virtual machine scale sets')\n| summarize by id, group\n| project value = id, label = id, selected = false, group", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c50c67ca-3dba-4a7f-ad19-2d5d28185e12", + "version": "KqlParameterItem/1.0", + "name": "TargetWorkspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "\"", + "delimiter": ",", + "query": "{\"version\":\"1.0.0\",\"content\":\"{OnboardQueryResult}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value.*\",\"columns\":[{\"path\":\"$.properties.data.*.workspace.id\",\"columnid\":\"Workspaces\"}]}}]}", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "97011276-637b-46e6-9e9f-056c30389501", + "version": "KqlParameterItem/1.0", + "name": "DistinctTargetWorkspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| take 1\n| project ws = '{TargetWorkspaces}'\n| extend ws = replace(@'\"\\[', '', ws)\n| extend ws = replace(@'\\]\"', '', ws)\n| extend ws = todynamic(strcat('[', ws, ']'))\n| mvexpand ws limit 400\n| summarize by tolower(tostring(ws))", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "a40d5985-4da2-4c55-b73e-4cca93c8b560", + "version": "KqlParameterItem/1.0", + "name": "WorkspaceLocations", + "label": "Workspace locations", + "type": 8, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({DistinctTargetWorkspaces})\n| summarize Count = count() by location\n| order by Count desc\n| extend Row = row_number()\n| project value = location, label = location, selected = Row == 1", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2454837b-8bc8-4707-8245-0560c029b0ac", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({DistinctTargetWorkspaces}) and location in ({WorkspaceLocations})\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7b41836d-1da2-4f43-91fe-4edc728e87fa", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + } + }, + { + "id": "905e418c-ddf2-4d5f-9821-66e15381ceed", + "version": "KqlParameterItem/1.0", + "name": "Test", + "label": "Not Onboarded", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{OnboardedVms}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "9711af09-11eb-4b4d-8de0-ea21677fae4d", + "version": "KqlParameterItem/1.0", + "name": "virtualMachinesSnippet", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"| where _ResourceId in ({VirtualMachines})\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "c94a9f39-9d0c-406e-92e2-2dc0a3c2ac9b", + "version": "KqlParameterItem/1.0", + "name": "virtualMachinesValue", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{VirtualMachines}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 8 + }, + { + "id": "80df5c1e-5eaf-4f4a-bf40-8c81aaebcc19", + "version": "KqlParameterItem/1.0", + "name": "vmSnippet", + "type": 1, + "value": "", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (virtualMachinesValue == '*'), result = virtualMachinesSnippet", + "criteriaContext": { + "leftOperand": "virtualMachinesValue", + "operator": "==", + "rightValType": "static", + "rightVal": "*", + "resultValType": "param", + "resultVal": "virtualMachinesSnippet" + } + }, + { + "condition": "else result = '| where _ResourceId startswith \"{ArmPrefix}\"'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where _ResourceId startswith \"{ArmPrefix}\"" + } + } + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "top-level parameters" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Top 100 Machines", + "subTarget": "top100", + "style": "link" + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Top 10 Machines", + "subTarget": "top10", + "style": "link" + } + ] + }, + "name": "top-level tabs" + }, + { + "type": 1, + "content": { + "json": "⚠ No counters were detected. Try the following:\r\n\r\n* Select a different time range\r\n* Try different scope selections\r\n* Onboard to Azure Monitor for VMs ([Azure Monitor for VMs GA FAQ](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-ga-release-faq))." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": null + }, + "name": "onboarding prompt" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "description": "Select a VM performance counter for the table below", + "query": "InsightsMetrics\r\n{vmSnippet}\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Namespace, Name, CounterText = Name\r\n| order by Name asc, Namespace asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "9ad8858d-8ef3-4144-94b1-66a8bf9fa9c9", + "version": "KqlParameterItem/1.0", + "name": "Aggregators", + "type": 2, + "description": "Select one or more different aggregates to display in the table below", + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th\", \"label\":\"P95th\", \"selected\": true },\r\n { \"value\":\"Min\", \"label\":\"Min\", \"selected\": false },\r\n { \"value\":\"Max\", \"label\":\"Max\", \"selected\": true }\r\n]" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TableTrend", + "type": 2, + "description": "Select a percentile to display in the Trend column in the table below", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\": false }\r\n]", + "label": "Table Trend" + }, + { + "id": "a31e3a83-360d-49a2-9fbd-928dd8e3ff35", + "version": "KqlParameterItem/1.0", + "name": "tableTrendLabel", + "type": 1, + "description": "Select a percentile to display in the Trend column in the table below", + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TableTrend:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "672b978e-5ee5-48c0-ba3a-fe6fc45d3f26", + "version": "KqlParameterItem/1.0", + "name": "tableTrendOrder", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TableTrend contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TableTrend", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TableTrend contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TableTrend", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "c2f05b6d-970d-4fde-88b0-868387c02250", + "version": "KqlParameterItem/1.0", + "name": "mergedAggregators", + "type": 1, + "value": "Average", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregators contains tableTrendLabel), result = Aggregators", + "criteriaContext": { + "leftOperand": "Aggregators", + "operator": "contains", + "rightValType": "param", + "rightVal": "tableTrendLabel", + "resultValType": "param", + "resultVal": "Aggregators" + } + }, + { + "condition": "else result = '{Aggregators},{tableTrendLabel}'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "{Aggregators},{tableTrendLabel}" + } + } + ] + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + } + ], + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "top-100 parameters" + }, + { + "type": 1, + "content": { + "json": "⚠ Select a `Counter`" + }, + "conditionalVisibilities": [ + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + }, + { + "parameterName": "Counter", + "comparison": "isEqualTo" + }, + { + "parameterName": "Test", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + }, + "name": "text - 23" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter}); \r\nlet timeRangeStart = {TimeRange:start};\r\nlet timeRangeEnd = {TimeRange:end};\r\nlet timeRangeGrain = {TimeRange:grain};\r\nlet maxResultCount = 100;\r\nlet summaryPerComputer = totable(InsightsMetrics {vmSnippet} | where TimeGenerated {TimeRange} | where Namespace == metric.object and Name == metric.counter | summarize hint.shufflekey = Computer Average = avg(Val), Max = max(Val), Min = min(Val), percentiles(Val, 5, 10, 50, 80, 90, 95) by Computer | project Computer, Average, Max, Min, P5th = percentile_Val_5, P10th = percentile_Val_10, P50th = percentile_Val_50, P80th = percentile_Val_80, P90th = percentile_Val_90, P95th = percentile_Val_95 | order by {TableTrend:label} {tableTrendOrder}, Computer | limit maxResultCount); let computerList = summaryPerComputer | project Computer; let MachineSummary = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | project Computer, MachineSummary = pack('Fully Qualified Domain Name', Computer, 'OS Type', OperatingSystemFamily_s, 'Operating System', OperatingSystemFullName_s, 'Ipv4 Addresses', Ipv4Addresses_s, 'Ipv6 Addresses', Ipv6Addresses_s, 'Mac Addresses', MacAddresses_s, 'DNS Names', DnsNames_s, 'CPUs', strcat(Cpus_d, ' @ ', CpuSpeed_d, ' MHz'), 'Bitness', Bitness_s, 'Physcial Memory', strcat(PhysicalMemory_d, ' MB'), 'Virtualization State', VirtualizationState_s, 'VM Type', VirtualMachineType_s, 'OMS Agent', split(ResourceName_s, 'm-')[1]);let EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];let OmsNodeIdentityAndProps = computerList | extend NodeId = Computer | extend Priority = 1 | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);let ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), ' |', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), ' |', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId) | project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;let NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps | summarize arg_max(Priority, *) by Computer; let NodeIdentityAndPropsMin = NodeIdentityAndProps | extend Type = iff(NodeProps.type == 'StandAloneNode', iff(NodeProps.azureResourceId == '', 'Non-Azure Virtual Machine', 'Azure Virtual Machine'), NodeProps.type), ResourceId = iff(NodeProps.type == 'AzureScaleSetNode', NodeProps.vmScaleSetResourceId, iff(NodeProps.type == 'AzureCloudServiceNode', NodeProps.cloudServiceDeploymentId, Computer)), ResourceName = iff(NodeProps.type == 'AzureScaleSetNode', strcat(NodeProps.vmScaleSetName, ' | ', NodeProps.scaleSetInstanceId), iff(NodeProps.type == 'AzureCloudServiceNode', strcat(NodeProps.cloudServiceRoleName, ' | ', NodeProps.cloudServiceInstanceId), Computer)) | project Computer, Type, ResourceId, ResourceName;let trend = InsightsMetrics {vmSnippet} | where TimeGenerated {TimeRange} | where Computer in (computerList) | where Namespace == metric.object and Name == metric.counter | make-series {TableTrend} default = 0 on TimeGenerated in range(timeRangeStart, timeRangeEnd, timeRangeGrain) by Computer | project Computer, ['Trend ({TableTrend:label})'] = {TableTrend:label}; summaryPerComputer | join kind=leftouter (trend) on Computer | join kind=leftouter (NodeIdentityAndProps) on Computer | join kind=leftouter (NodeIdentityAndPropsMin) on Computer | join kind=leftouter (MachineSummary) on Computer | project ResourceName, Type, {mergedAggregators}, ['Trend ({TableTrend:label})'], Properties = MachineSummary | sort by {TableTrend:label} {tableTrendOrder}", + "size": 3, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Average", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P50th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (Average)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Properties", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info" + } + }, + { + "columnMatch": "P95th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P5th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P10th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P80th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P90th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Min", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Max", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (P95th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P5th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P90th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P80th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P50th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P10th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + } + ] + }, + "sortBy": [] + }, + "conditionalVisibilities": [ + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + }, + { + "parameterName": "Counter", + "comparison": "isNotEqualTo" + } + ], + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + }, + "name": "top-100 query" + }, + { + "type": 1, + "content": { + "json": "### CPU Utilization %" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 12" + }, + { + "type": 1, + "content": { + "json": "### Available Memory" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "92358ae0-d5e1-494b-b65b-6d904f1325c5", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "27345375-4376-4e2f-8ac4-59d4eab9d235", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregate contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (Aggregate contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "4d9ba0ec-9d22-4fec-9f85-4be334f42d91", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:value}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "50242f48-6c7d-449b-ad93-838c94e615a0", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:label}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + } + ], + "style": "above", + "queryType": 8, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "cpu params" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "333837c2-d5a4-4173-9aad-3db1dca17e2a", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P5th = round(percentile(Val, 5), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "a23b29a5-5e4a-4d8e-ba73-bfdf27b2980e", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "value": "asc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregate contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (Aggregate contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "cc8dfabc-9eb9-4227-97bb-f5e9319030ec", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:value}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "ff7a79ff-742a-4c6e-8628-c52f45b3bf71", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:label}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + } + ], + "style": "above", + "queryType": 8, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "memory params" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let cpuSummary=totable(InsightsMetrics {vmSnippet}\r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics {vmSnippet}\r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 1, + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "cpu query" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics {vmSnippet}\r\n | where Namespace == 'Memory' and Name == 'AvailableMB'\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, Name\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics {vmSnippet}\r\n | where Namespace == 'Memory' and Name == 'AvailableMB'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 4, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "memory query" + }, + { + "type": 1, + "content": { + "json": "### Bytes Sent Rate" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "### Bytes Received Rate" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 19" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "360da4c1-97fa-4b15-a008-33a6110d0acd", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "31ccd4a1-d626-44bb-a5de-1780a33b37a5", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregate contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (Aggregate contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "4765abab-a682-49f6-bb41-d64852aba192", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:value}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "1d9b0ea9-09d4-4c73-8e59-fa7ab760b880", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:label}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + } + ], + "style": "above", + "queryType": 8, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "bytes sent params" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "6772b281-d17d-4293-a227-1b2ed67f399e", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "5e2eef28-0528-406f-86b5-ceae535455f9", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregate contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (Aggregate contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "586fa51c-1a45-4602-adcb-62eb0f619b7f", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:value}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "912085b6-f920-4a37-9ce3-f1ef86bd5df8", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Aggregate:label}\\\"\",\"transformers\":null}", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + } + ], + "style": "above", + "queryType": 8, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "bytes received params" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics {vmSnippet}\r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics {vmSnippet}\r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "bytes sent query" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics {vmSnippet}\r\n | where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, Name\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics {vmSnippet}\r\n | where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "bytes received query" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk Space Used %" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 24" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 25" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "5d6afbec-79f6-4cd1-b3a1-361503478304", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "1d5a805c-acce-4afe-a38b-c2740fb3ff26", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrder", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Aggregate contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (Aggregate contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "Aggregate", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "logical disk space used params" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 27" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics {vmSnippet}\r\n | where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n\t| extend Val = 100 - Val\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics {vmSnippet}\r\n | where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n\t| extend Val = 100 - Val\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 1, + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "logical disk space used query" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Dev)/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Dev)/settings.json new file mode 100644 index 0000000..f8d2732 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Dev)/settings.json @@ -0,0 +1,10 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Performance (Dev)", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorVirtualMachines", "order": 100 }, + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 200 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Perf)/Performance Analysis for a Group of VMs.workbook b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Perf)/Performance Analysis for a Group of VMs.workbook new file mode 100644 index 0000000..668fb00 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Perf)/Performance Analysis for a Group of VMs.workbook @@ -0,0 +1,1653 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "688dc7cb-bea3-41ae-ae94-32d22e09568c", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "c11b5651-cf86-4865-b23d-9ecc4f16b712", + "version": "KqlParameterItem/1.0", + "name": "ContextFree", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{DefaultWorkspace}\\\"\"}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "bbbc300a-6f91-4b2b-b4b5-842b4bf8577a", + "version": "KqlParameterItem/1.0", + "name": "Selection", + "type": 1, + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| extend match = strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| order by match desc, name asc\r\n| take 1\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "_", + "comparison": "isEqualTo", + "value": "_" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "# Performance Analysis" + }, + "conditionalVisibility": { + "parameterName": "ContextFree", + "comparison": "isEqualTo", + "value": "value::1" + }, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "1db5ee15-fe52-458b-91d1-7ee39d8c2cd3", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "summarize by subscriptionId\r\n| project value = strcat('/subscriptions/', subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ todynamic('{Selection}').sub, true, false)", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "9732eff8-fb57-4cbd-8ade-5ae746f33760", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| project id, selected = iff(id =~ todynamic('{Selection}').ws, true, false)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "5f8cce4b-9c4c-47da-8683-7e5ccc9faed3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "e36a2c69-a3c1-4b0c-b758-b37bc16b4669", + "version": "KqlParameterItem/1.0", + "name": "Test", + "type": 1, + "query": "let perf = Perf\r\n| where TimeGenerated {TimeRange}\r\n| take 1;\r\nlet servicemap = ServiceMapComputer_CL\r\n| where TimeGenerated {TimeRange}\r\n| take 1;\r\nperf\r\n| union servicemap", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "_", + "comparison": "isEqualTo", + "value": "_" + }, + "name": "parameters - 30" + }, + { + "type": 1, + "content": { + "json": "⚠ A subscription has not yet been selected. Select a subscription under the `Subscriptions` dropdown or refresh the workbook." + }, + "conditionalVisibility": { + "parameterName": "Subscriptions", + "comparison": "isEqualTo", + "value": null + }, + "name": "text - 29" + }, + { + "type": 1, + "content": { + "json": "⚠ No performance counters were detected in the selected workspace for the specified time period (`{TimeRange:label}`). Either try a broader time range, select a different workspace, or onboard virtual machines to the selected workspace `{Workspaces:label}`.\r\n\r\nIf you choose to onboard virtual machines to workspace `{Workspaces:label}`, follow the instruction in the following link: [Azure Monitor for VMs (preview)](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview)." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": null + }, + "name": "text - 3" + }, + { + "type": 1, + "content": { + "json": "---" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "text - 4" + }, + { + "type": 1, + "content": { + "json": "

Top 100 Machines

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "text - 5" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "41bb3710-5e9e-4b66-91fd-e11435899880", + "version": "KqlParameterItem/1.0", + "name": "ComputerNameContains", + "label": "Computer Name Contains", + "type": 1, + "description": "This will filter the computers whose name contains the keyword. This will query all the machines in the workspace.", + "value": "" + }, + { + "id": "b533865a-3539-42b1-8dcd-33ca0d481c2a", + "version": "KqlParameterItem/1.0", + "name": "ComputerFilter", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\": \\\"| where Computer contains '{ComputerNameContains}'\\\"}\"}", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "description": "Select a VM performance counter for the table below", + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| summarize by CounterName, ObjectName, CounterText = CounterName\r\n| order by ObjectName asc, CounterText asc\r\n| project Counter = pack('counter', CounterName, 'object', ObjectName), CounterText, group = ObjectName", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": "{\"counter\":\"% Processor Time\",\"object\":\"Processor\"}", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "974d5ac2-4fc5-48e7-a8f7-16fc9dddc4ac", + "version": "KqlParameterItem/1.0", + "name": "CounterText", + "type": 1, + "query": "let metric = dynamic({Counter});\r\nrange Steps from 1 to 1 step 1\r\n| project strcat(metric.object, \" > \", metric.counter)", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "ce228deb-88eb-4438-9dce-6c6d1972ff09", + "version": "KqlParameterItem/1.0", + "name": "IsNetworkCounter", + "type": 1, + "query": "let metric = dynamic({Counter});\r\nprint tostring((metric.object == 'Network Adapter' and (metric.counter == 'Bytes Received/sec' or metric.counter == 'Bytes Sent/sec')) or (metric.object == 'Network' and (metric.counter == 'Total Bytes Received' or metric.counter == 'Total Bytes Transmitted')))", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "3b23aa7a-2afd-40ba-a710-0e2cc73c764b", + "version": "KqlParameterItem/1.0", + "name": "NetworkDirection", + "type": 1, + "query": "let metric = dynamic({Counter});\r\nprint(iff(metric.counter == 'Bytes Received/sec' or metric.counter == 'Total Bytes Received', 'Received', 'Sent'))", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "9ad8858d-8ef3-4144-94b1-66a8bf9fa9c9", + "version": "KqlParameterItem/1.0", + "name": "Aggregators", + "type": 2, + "description": "Select one or more different aggregates to display in the table below", + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th\", \"label\":\"P95th\", \"selected\": true },\r\n { \"value\":\"Min\", \"label\":\"Min\", \"selected\": false },\r\n { \"value\":\"Max\", \"label\":\"Max\", \"selected\": true }\r\n]" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TableTrend", + "type": 2, + "description": "Select a percentile to display in the Trend column in the table below", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\": false }\r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "tableTrendOrder", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{TableTrend}' contains 'P5th' or '{TableTrend}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "c2f05b6d-970d-4fde-88b0-868387c02250", + "version": "KqlParameterItem/1.0", + "name": "mergedAggregators", + "type": 1, + "query": "let aggregators = iff('{Aggregators}' contains '{TableTrend:label}', '{Aggregators}', '{Aggregators},{TableTrend:label}');\r\nrange Steps from 1 to 1 step 1\r\n| project aggregators", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "69c79551-68b9-4c84-bf57-202540482a02", + "version": "KqlParameterItem/1.0", + "name": "ShowTable", + "type": 1, + "query": "print iff(\"{Test:value}\" == \"\", \"False\", iff(\"{IsNetworkCounter:value}\" == \"False\", \"True\", \"False\"))", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6b664a24-d9a3-47b0-9d94-9cada9ddb8ce", + "version": "KqlParameterItem/1.0", + "name": "ShowNetworkTable", + "type": 1, + "query": "print iff(\"{Test:value}\" == \"\", \"False\", \"{IsNetworkCounter:value}\")", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "343c4eae-e482-4678-a936-c4ad43b2ec19", + "version": "KqlParameterItem/1.0", + "name": "CounterTest", + "type": 1, + "query": "Perf\r\n| take 1", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "parameters - 6" + }, + { + "type": 1, + "content": { + "json": "There are no performance counters, either onboard machines to this workspace or enable performance counters." + }, + "conditionalVisibility": { + "parameterName": "CounterTest", + "comparison": "isEqualTo", + "value": "" + }, + "name": "text - 7" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let maxResultCount = 100; \r\nlet metric = dynamic({Counter}); \r\nlet summaryPerComputer = totable(Perf | where TimeGenerated {TimeRange} {ComputerFilter} | where ObjectName == metric.object and CounterName == metric.counter | summarize hint.shufflekey = Computer Average = avg(CounterValue), Max = max(CounterValue), Min = min(CounterValue), percentiles(CounterValue, 5, 10, 50, 80, 90, 95) by Computer | project Computer, Average, Max, Min, P5th = percentile_CounterValue_5, P10th = percentile_CounterValue_10, P50th = percentile_CounterValue_50, P80th = percentile_CounterValue_80, P90th = percentile_CounterValue_90, P95th = percentile_CounterValue_95 | order by {TableTrend:label} {tableTrendOrder}, Computer | limit maxResultCount); let computerList = summaryPerComputer | project Computer; let MachineSummary = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | project Computer, MachineSummary = pack('Fully Qualified Domain Name', Computer, 'OS Type', OperatingSystemFamily_s, 'Operating System', OperatingSystemFullName_s, 'Ipv4 Addresses', Ipv4Addresses_s, 'Ipv6 Addresses', Ipv6Addresses_s, 'Mac Addresses', MacAddresses_s, 'DNS Names', DnsNames_s, 'CPUs', strcat(Cpus_d, ' @ ', CpuSpeed_d, ' MHz'), 'Bitness', Bitness_s, 'Physcial Memory', strcat(PhysicalMemory_d, ' MB'), 'Virtualization State', VirtualizationState_s, 'VM Type', VirtualMachineType_s, 'OMS Agent', split(ResourceName_s, 'm-')[1]); let EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) []; let OmsNodeIdentityAndProps = computerList | extend NodeId = Computer | extend Priority = 1 | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer); let ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2; let NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps | summarize arg_max(Priority, *) by Computer; let NodeIdentityAndPropsMin = NodeIdentityAndProps | extend Type = iff(NodeProps.type == 'StandAloneNode', iff(NodeProps.azureResourceId == '', 'Non-Azure Virtual Machine', 'Azure Virtual Machine'), NodeProps.type), ResourceId = iff(NodeProps.type == 'AzureScaleSetNode', NodeProps.vmScaleSetResourceId, iff(NodeProps.type == 'AzureCloudServiceNode', NodeProps.cloudServiceDeploymentId, Computer)), ResourceName = iff(NodeProps.type == 'AzureScaleSetNode', strcat(NodeProps.vmScaleSetName, ' | ', NodeProps.scaleSetInstanceId), iff(NodeProps.type == 'AzureCloudServiceNode', strcat(NodeProps.cloudServiceRoleName, ' | ', NodeProps.cloudServiceInstanceId), Computer)) | project Computer, Type, ResourceId, ResourceName; let trend = Perf | where TimeGenerated {TimeRange} | where Computer in (computerList) | where ObjectName == metric.object and CounterName == metric.counter | make-series {TableTrend} default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Computer | project Computer, ['Trend ({TableTrend:label})'] = {TableTrend:label}; summaryPerComputer | join kind=leftouter (trend) on Computer | join kind=leftouter (NodeIdentityAndProps) on Computer | join kind=leftouter (NodeIdentityAndPropsMin) on Computer | join kind=leftouter (MachineSummary) on Computer | project ResourceName, Type, {mergedAggregators}, ['Trend ({TableTrend:label})'], Properties = MachineSummary | sort by {TableTrend:label} {tableTrendOrder} | limit maxResultCount", + "size": 0, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Average", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P50th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (Average)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Properties", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info" + } + }, + { + "columnMatch": "P95th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P5th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P10th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P80th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P90th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Min", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Max", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (P95th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P5th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P90th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P80th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P50th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P10th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + } + ], + "labelSettings": [ + { + "columnId": "ResourceName", + "label": "ResourceName" + }, + { + "columnId": "Type", + "label": "Type" + }, + { + "columnId": "Average", + "label": "Average" + }, + { + "columnId": "P95th", + "label": "P95th" + }, + { + "columnId": "Max", + "label": "Max" + }, + { + "columnId": "Trend (Average)", + "label": "Trend (Average)" + }, + { + "columnId": "Properties", + "label": "Properties" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "ShowTable", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 8" + }, + { + "type": 1, + "content": { + "json": "#### ℹ `Total Bytes {NetworkDirection}` and `Bytes {NetworkDirection}/sec` counters are both being utilized to display the network table. The delta of `Total Bytes {NetworkDirection}` over a time period is being calculated to match up with the `Bytes {NetworkDirection}/sec` counter to display an accurate representation of network activity over all machines" + }, + "conditionalVisibility": { + "parameterName": "ShowNetworkTable", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "text - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRangeStart = {TimeRange:start};\r\nlet timeRangeEnd = {TimeRange:end};\r\nlet timeRangeGrain = {TimeRange:grain}; \r\nlet maxResultCount = 100; \r\nlet linuxMetric = iff('{NetworkDirection}' == 'Received', dynamic({'object': 'Network', 'counter': 'Total Bytes Received'}), dynamic({'object': 'Network', 'counter': 'Total Bytes Transmitted'}));\r\nlet windowsMetric = iff('{NetworkDirection}' == 'Received', dynamic({\"counter\":\"Bytes Received/sec\",\"object\":\"Network Adapter\"}), dynamic({\"counter\":\"Bytes Sent/sec\",\"object\":\"Network Adapter\"}));\r\nlet Network = materialize(Perf \r\n| where TimeGenerated {TimeRange} {ComputerFilter} \r\n| where ObjectName == linuxMetric.object and CounterName == linuxMetric.counter \r\n| extend ComputerId = iff(isempty(_ResourceId), Computer, _ResourceId) \r\n| order by CounterName asc, InstanceName, ComputerId asc, TimeGenerated asc \r\n| extend prev_ComputerId=prev(ComputerId), prev_Value=prev(CounterValue), prev_t=prev(TimeGenerated), prev_instance=prev(InstanceName) \r\n| project TimeGenerated, ComputerId, Computer, _ResourceId, cValue = iff(prev_ComputerId == ComputerId and prev_instance == InstanceName and CounterValue >= prev_Value and TimeGenerated > prev_t, (CounterValue-prev_Value)/((TimeGenerated-prev_t)/1s), real(0)) \r\n| summarize CounterValue = sum(cValue) by ComputerId, Computer, _ResourceId, bin(TimeGenerated, 2s) \r\n| union (Perf \r\n| where TimeGenerated {TimeRange} {ComputerFilter} \r\n| where ObjectName == windowsMetric.object and CounterName == windowsMetric.counter \r\n| extend ComputerId = iff(isempty(_ResourceId), Computer, _ResourceId)) \r\n| summarize CounterValue = sum(CounterValue) by ComputerId, Computer, _ResourceId, bin(TimeGenerated, 2s)); \r\nlet summaryPerComputer = totable(Network \r\n| summarize hint.shufflekey = ComputerId Average = avg(CounterValue), Max = max(CounterValue), percentiles(CounterValue, 50, 90, 95) by ComputerId, Computer, _ResourceId \r\n| project ComputerId, Computer, Average, Max, P50th = percentile_CounterValue_50, P90th = percentile_CounterValue_90, P95th = percentile_CounterValue_95, ResourceId = _ResourceId \r\n| order by {TableTrend:label} {tableTrendOrder}, Computer \r\n| limit maxResultCount); \r\nlet computerList = summaryPerComputer \r\n| project ComputerId, Computer;\r\nlet MachineSummary = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | extend ComputerId = iff(isempty(_ResourceId), Computer, _ResourceId) | where ComputerId in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | project Computer, MachineSummary = pack('Fully Qualified Domain Name', Computer, 'OS Type', OperatingSystemFamily_s, 'Operating System', OperatingSystemFullName_s, 'Ipv4 Addresses', Ipv4Addresses_s, 'Ipv6 Addresses', Ipv6Addresses_s, 'Mac Addresses', MacAddresses_s, 'DNS Names', DnsNames_s, 'CPUs', strcat(Cpus_d, ' @ ', CpuSpeed_d, ' MHz'), 'Bitness', Bitness_s, 'Physcial Memory', strcat(PhysicalMemory_d, ' MB'), 'Virtualization State', VirtualizationState_s, 'VM Type', VirtualMachineType_s, 'OMS Agent', split(ResourceName_s, 'm-')[1]); let EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) []; let OmsNodeIdentityAndProps = computerList | extend NodeId = Computer | extend Priority = 1 | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer); let ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2; let NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps | summarize arg_max(Priority, *) by Computer; let NodeIdentityAndPropsMin = NodeIdentityAndProps | extend Type = iff(NodeProps.type == 'StandAloneNode', iff(NodeProps.azureResourceId == '', 'Non-Azure Virtual Machine', 'Azure Virtual Machine'), NodeProps.type), ResourceId = iff(NodeProps.type == 'AzureScaleSetNode', NodeProps.vmScaleSetResourceId, iff(NodeProps.type == 'AzureCloudServiceNode', NodeProps.cloudServiceDeploymentId, Computer)), ResourceName = iff(NodeProps.type == 'AzureScaleSetNode', strcat(NodeProps.vmScaleSetName, ' | ', NodeProps.scaleSetInstanceId), iff(NodeProps.type == 'AzureCloudServiceNode', strcat(NodeProps.cloudServiceRoleName, ' | ', NodeProps.cloudServiceInstanceId), Computer)) | project Computer, Type, ResourceId, ResourceName; \r\nlet trend = Network \r\n| where ComputerId in (computerList) \r\n| summarize hint.shufflekey = ComputerId {TableTrend} by ComputerId, Computer, bin(TimeGenerated, timeRangeGrain) \r\n| project ComputerId, Computer, {TableTrend:label} \r\n| summarize hint.shufflekey = ComputerId trendList = makelist({TableTrend:label}) by ComputerId, Computer; \r\nsummaryPerComputer \r\n| join (trend) on Computer \r\n| join (NodeIdentityAndProps) on Computer \r\n| join kind=leftouter (NodeIdentityAndPropsMin) on Computer \r\n| join kind=leftouter (MachineSummary) on Computer\r\n| project ResourceName, Type, {mergedAggregators}, ['Trend ({TableTrend:label})'] = trendList, Properties = MachineSummary\r\n| sort by {TableTrend:label} {tableTrendOrder} | limit maxResultCount", + "size": 0, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "ResourceName", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Type", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Average", + "formatter": 1, + "formatOptions": { + "palette": "greenRed", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P95th", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Max", + "formatter": 1, + "formatOptions": { + "palette": "greenRed", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (Average)", + "formatter": 10, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Properties", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "️️️ℹ Info", + "showIcon": true + } + }, + { + "columnMatch": "P10th", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P50th", + "formatter": 1, + "formatOptions": { + "palette": "greenRed", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (P95th)", + "formatter": 10, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "P5th", + "formatter": 8, + "formatOptions": { + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P80th", + "formatter": 1, + "formatOptions": { + "palette": "greenRed", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P90th", + "formatter": 1, + "formatOptions": { + "palette": "greenRed", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Min", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (P5th)", + "formatter": 10, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Trend (P90th)", + "formatter": 10, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Trend (P80th)", + "formatter": 10, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Trend (P50th)", + "formatter": 10, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "Trend (P10th)", + "formatter": 10, + "formatOptions": { + "palette": "blue", + "showIcon": true + } + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "ShowNetworkTable", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 10" + }, + { + "type": 1, + "content": { + "json": "---\r\n## Top 10 Machines" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "name": "text - 11" + }, + { + "type": 1, + "content": { + "json": "### CPU Utilization %" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "text - 12" + }, + { + "type": 1, + "content": { + "json": "### Available Memory" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "text - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "92358ae0-d5e1-494b-b65b-6d904f1325c5", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(CounterValue, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "27345375-4376-4e2f-8ac4-59d4eab9d235", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "4d9ba0ec-9d22-4fec-9f85-4be334f42d91", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "50242f48-6c7d-449b-ad93-838c94e615a0", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "parameters - 14" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "333837c2-d5a4-4173-9aad-3db1dca17e2a", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(CounterValue, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "a23b29a5-5e4a-4d8e-ba73-bfdf27b2980e", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "cc8dfabc-9eb9-4227-97bb-f5e9319030ec", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "ff7a79ff-742a-4c6e-8628-c52f45b3bf71", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "parameters - 15" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let cpuSummary=totable(Perf\r\n | where TimeGenerated {TimeRange} \r\n | where (ObjectName == 'Processor' and InstanceName == '_Total' and CounterName == '% Processor Time')\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, CounterName\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where (ObjectName == 'Processor' and InstanceName == '_Total' and CounterName == '% Processor Time')\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "query - 16" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(Perf\r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == 'Memory' and CounterName in ('Available MBytes', 'Available MBytes Memory')\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, CounterName\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where ObjectName == 'Memory' and CounterName in ('Available MBytes', 'Available MBytes Memory')\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "query - 17" + }, + { + "type": 1, + "content": { + "json": "### Bytes Sent Rate" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "### Bytes Received Rate" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "text - 19" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "360da4c1-97fa-4b15-a008-33a6110d0acd", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(CounterValue, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "31ccd4a1-d626-44bb-a5de-1780a33b37a5", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "4765abab-a682-49f6-bb41-d64852aba192", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "1d9b0ea9-09d4-4c73-8e59-fa7ab760b880", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "parameters - 20" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "6772b281-d17d-4293-a227-1b2ed67f399e", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(CounterValue, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "5e2eef28-0528-406f-86b5-ceae535455f9", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "586fa51c-1a45-4602-adcb-62eb0f619b7f", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "912085b6-f920-4a37-9ce3-f1ef86bd5df8", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "parameters - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let linuxNetworkSend=Perf \r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == 'Network' and CounterName == 'Total Bytes Transmitted'\r\n | order by CounterName asc, InstanceName, Computer asc, TimeGenerated asc\r\n | extend prev_Computer=prev(Computer), prev_Value=prev(CounterValue), prev_t=prev(TimeGenerated), prev_counter=prev(CounterName), prev_instance=prev(InstanceName)\r\n | project TimeGenerated, Computer, CounterValue = iff(prev_Computer == Computer and prev_instance == InstanceName and prev_counter == CounterName and CounterValue >= prev_Value and TimeGenerated > prev_t, (CounterValue-prev_Value)/((TimeGenerated-prev_t)/1s), real(0))\r\n | summarize hint.shufflekey=Computer CounterValue = sum(CounterValue) by Computer, bin(TimeGenerated, 2s);\r\nlet windowsNetworkSend = Perf \r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == 'Network Adapter' and CounterName == 'Bytes Sent/sec'\r\n | summarize hint.shufflekey=Computer CounterValue = sum(CounterValue) by Computer, bin(TimeGenerated, 2s);\r\nlet networkDataSend = union linuxNetworkSend, windowsNetworkSend;\r\nlet networkSendSummary = totable(networkDataSend\r\n | where TimeGenerated {TimeRange}\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(networkSendSummary | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nnetworkDataSend\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "query - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let linuxNetworkReceive=Perf \r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == 'Network' and CounterName == 'Total Bytes Received'\r\n | order by CounterName asc, InstanceName, Computer asc, TimeGenerated asc\r\n | extend prev_Computer=prev(Computer), prev_Value=prev(CounterValue), prev_t=prev(TimeGenerated), prev_counter=prev(CounterName), prev_instance=prev(InstanceName)\r\n | project TimeGenerated, Computer, CounterValue = iff(prev_Computer == Computer and prev_instance == InstanceName and prev_counter == CounterName and CounterValue >= prev_Value and TimeGenerated > prev_t, (CounterValue-prev_Value)/((TimeGenerated-prev_t)/1s), real(0))\r\n | summarize hint.shufflekey=Computer CounterValue = sum(CounterValue) by Computer, bin(TimeGenerated, 2s);\r\nlet windowsNetworkReceive = Perf \r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == 'Network Adapter' and CounterName == 'Bytes Received/sec'\r\n | summarize hint.shufflekey=Computer CounterValue = sum(CounterValue) by Computer, bin(TimeGenerated, 2s);\r\nlet networkDataReceive = union linuxNetworkReceive, windowsNetworkReceive;\r\nlet networkReceiveSummary = totable(networkDataReceive\r\n | where TimeGenerated {TimeRange}\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(networkReceiveSummary | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nnetworkDataReceive\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "query - 23" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk Space Used %" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "text - 24" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "text - 25" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "5d6afbec-79f6-4cd1-b3a1-361503478304", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(CounterValue, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "1d5a805c-acce-4afe-a38b-c2740fb3ff26", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrder", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "parameters - 26" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "text - 27" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let diskSummary=totable(Perf\r\n | where TimeGenerated {TimeRange} \r\n | where (ObjectName == 'LogicalDisk' and InstanceName != '_Total' and CounterName in ('% Free Space')) or (ObjectName == 'Logical Disk' and InstanceName != '_Total' and CounterName in ('% Used Space'))\r\n | project TimeGenerated, Computer, CounterName = '% Used Space', CounterValue = case(ObjectName == 'LogicalDisk' and CounterName == '% Free Space', 100 - CounterValue, CounterValue < 0, real(0), CounterValue)\r\n | summarize hint.shufflekey=Computer {Aggregate} by Computer, CounterName\r\n | top 10 by {Aggregate:label} {aggregateOrder});\r\nlet computerList=(diskSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where (ObjectName == 'LogicalDisk' and InstanceName != '_Total' and CounterName in ('% Free Space')) or (ObjectName == 'Logical Disk' and InstanceName != '_Total' and CounterName in ('% Used Space'))\r\n | where Computer in (computerList)\r\n | project TimeGenerated, Computer, CounterName = '% Used Space', CounterValue = case(ObjectName == 'LogicalDisk' and CounterName == '% Free Space', 100 - CounterValue, CounterValue < 0, real(0), CounterValue)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {Aggregate} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo" + }, + "customWidth": "50", + "name": "query - 28" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Perf)/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Perf)/settings.json new file mode 100644 index 0000000..7077a2d --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Perf)/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorVirtualMachinesPerf", "order": 100 }, + { "type": "vm-insights", "resourceType": "Azure Monitor", "categoryKey": "vmInsightsVirtualMachinesPerf", "order": 200 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Preview)/Performance Analysis for a Group of VMs (Preview).workbook b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Preview)/Performance Analysis for a Group of VMs (Preview).workbook new file mode 100644 index 0000000..bc93b74 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Preview)/Performance Analysis for a Group of VMs (Preview).workbook @@ -0,0 +1,1421 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "688dc7cb-bea3-41ae-ae94-32d22e09568c", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "c11b5651-cf86-4865-b23d-9ecc4f16b712", + "version": "KqlParameterItem/1.0", + "name": "ContextFree", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{DefaultWorkspace}\\\"\"}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "bbbc300a-6f91-4b2b-b4b5-842b4bf8577a", + "version": "KqlParameterItem/1.0", + "name": "Selection", + "type": 1, + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| extend match = strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| order by match desc, name asc\r\n| take 1\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "_", + "comparison": "isEqualTo", + "value": "_" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "# Performance Analysis" + }, + "conditionalVisibility": { + "parameterName": "ContextFree", + "comparison": "isEqualTo", + "value": "value::1" + }, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "1db5ee15-fe52-458b-91d1-7ee39d8c2cd3", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "summarize by subscriptionId\r\n| project value = strcat('/subscriptions/', subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ todynamic('{Selection}').sub, true, false)", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "9732eff8-fb57-4cbd-8ade-5ae746f33760", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| project id, selected = iff(id =~ todynamic('{Selection}').ws, true, false)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "5f8cce4b-9c4c-47da-8683-7e5ccc9faed3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "label": "Time Range" + }, + { + "id": "d6de19ff-cde4-41c2-9fba-b441312ea5c9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "type": 1, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| take 1", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 2" + }, + { + "type": 1, + "content": { + "json": "⚠ A subscription has not yet been selected. Select a subscription under the `Subscriptions` dropdown or refresh the workbook." + }, + "conditionalVisibility": { + "parameterName": "Subscriptions", + "comparison": "isEqualTo", + "value": null + }, + "name": "text - 29" + }, + { + "type": 1, + "content": { + "json": "⚠ No performance counters were detected in the selected workspace for the specified time period (`{TimeRange:label}`). Either try a broader time range, select a different workspace, or onboard virtual machines to the selected workspace `{Workspaces:label}`.\r\n\r\nIf you choose to onboard virtual machines to workspace `{Workspaces:label}`, follow the instruction in the following link: [Azure Monitor for VMs (preview)](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview)." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": null + }, + "name": "text - 3" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Top 100 Machines", + "subTarget": "top100", + "style": "link" + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Top 10 Machines", + "subTarget": "top10", + "style": "link" + } + ] + }, + "name": "links - 28" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "41bb3710-5e9e-4b66-91fd-e11435899880", + "version": "KqlParameterItem/1.0", + "name": "ComputerNameContains", + "label": "Computer Name Contains", + "type": 1, + "description": "This will filter the computers whose name contains the keyword. This will query all the machines in the workspace.", + "value": "" + }, + { + "id": "b533865a-3539-42b1-8dcd-33ca0d481c2a", + "version": "KqlParameterItem/1.0", + "name": "ComputerFilter", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\": \\\"| where Computer contains '{ComputerNameContains}'\\\"}\"}", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "description": "Select a VM performance counter for the table below", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Namespace, Name, CounterText = Name\r\n| order by Name asc, Namespace asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "974d5ac2-4fc5-48e7-a8f7-16fc9dddc4ac", + "version": "KqlParameterItem/1.0", + "name": "CounterText", + "type": 1, + "query": "let metric = dynamic({Counter});\r\nrange Steps from 1 to 1 step 1\r\n| project strcat(metric.object, \" > \", metric.counter)", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "9ad8858d-8ef3-4144-94b1-66a8bf9fa9c9", + "version": "KqlParameterItem/1.0", + "name": "Aggregators", + "type": 2, + "description": "Select one or more different aggregates to display in the table below", + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th\", \"label\":\"P95th\", \"selected\": true },\r\n { \"value\":\"Min\", \"label\":\"Min\", \"selected\": false },\r\n { \"value\":\"Max\", \"label\":\"Max\", \"selected\": true }\r\n]" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TableTrend", + "type": 2, + "description": "Select a percentile to display in the Trend column in the table below", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\": false }\r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "tableTrendOrder", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{TableTrend}' contains 'P5th' or '{TableTrend}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "c2f05b6d-970d-4fde-88b0-868387c02250", + "version": "KqlParameterItem/1.0", + "name": "mergedAggregators", + "type": 1, + "query": "let aggregators = iff('{Aggregators}' contains '{TableTrend:label}', '{Aggregators}', '{Aggregators},{TableTrend:label}');\r\nrange Steps from 1 to 1 step 1\r\n| project aggregators", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "69c79551-68b9-4c84-bf57-202540482a02", + "version": "KqlParameterItem/1.0", + "name": "ShowTable", + "type": 1, + "query": "print iff(\"{Test:value}\" == \"\", \"False\", \"True\")", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "343c4eae-e482-4678-a936-c4ad43b2ec19", + "version": "KqlParameterItem/1.0", + "name": "CounterTest", + "type": 1, + "query": "InsightsMetrics\r\n| take 1", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + } + ], + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "parameters - 6" + }, + { + "type": 1, + "content": { + "json": "There are no performance counters, either onboard machines to this workspace or enable performance counters." + }, + "conditionalVisibilities": [ + { + "parameterName": "CounterTest", + "comparison": "isEqualTo", + "value": "" + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + } + ], + "conditionalVisibility": { + "parameterName": "CounterTest", + "comparison": "isEqualTo", + "value": "" + }, + "name": "text - 7" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let maxResultCount = 100; \r\nlet metric = dynamic({Counter});\r\nlet summaryPerComputer = totable(InsightsMetrics | where TimeGenerated {TimeRange} {ComputerFilter} | where Namespace == metric.object and Name == metric.counter | summarize hint.shufflekey = Computer Average = avg(Val), Max = max(Val), Min = min(Val), percentiles(Val, 5, 10, 50, 80, 90, 95) by Computer | project Computer, Average, Max, Min, P5th = percentile_Val_5, P10th = percentile_Val_10, P50th = percentile_Val_50, P80th = percentile_Val_80, P90th = percentile_Val_90, P95th = percentile_Val_95 | order by {TableTrend:label} {tableTrendOrder}, Computer | limit maxResultCount); let computerList = summaryPerComputer | project Computer; let MachineSummary = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | project Computer, MachineSummary = pack('Fully Qualified Domain Name', Computer, 'OS Type', OperatingSystemFamily_s, 'Operating System', OperatingSystemFullName_s, 'Ipv4 Addresses', Ipv4Addresses_s, 'Ipv6 Addresses', Ipv6Addresses_s, 'Mac Addresses', MacAddresses_s, 'DNS Names', DnsNames_s, 'CPUs', strcat(Cpus_d, ' @ ', CpuSpeed_d, ' MHz'), 'Bitness', Bitness_s, 'Physcial Memory', strcat(PhysicalMemory_d, ' MB'), 'Virtualization State', VirtualizationState_s, 'VM Type', VirtualMachineType_s, 'OMS Agent', split(ResourceName_s, 'm-')[1]); let EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) []; let OmsNodeIdentityAndProps = computerList | extend NodeId = Computer | extend Priority = 1 | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer); let ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2; let NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps | summarize arg_max(Priority, *) by Computer; let NodeIdentityAndPropsMin = NodeIdentityAndProps | extend Type = iff(NodeProps.type == 'StandAloneNode', iff(NodeProps.azureResourceId == '', 'Non-Azure Virtual Machine', 'Azure Virtual Machine'), NodeProps.type), ResourceId = iff(NodeProps.type == 'AzureScaleSetNode', NodeProps.vmScaleSetResourceId, iff(NodeProps.type == 'AzureCloudServiceNode', NodeProps.cloudServiceDeploymentId, Computer)), ResourceName = iff(NodeProps.type == 'AzureScaleSetNode', strcat(NodeProps.vmScaleSetName, ' | ', NodeProps.scaleSetInstanceId), iff(NodeProps.type == 'AzureCloudServiceNode', strcat(NodeProps.cloudServiceRoleName, ' | ', NodeProps.cloudServiceInstanceId), Computer)) | project Computer, Type, ResourceId, ResourceName; let trend = InsightsMetrics | where TimeGenerated {TimeRange} | where Computer in (computerList) | where Namespace == metric.object and Name == metric.counter | make-series {TableTrend} default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Computer | project Computer, ['Trend ({TableTrend:label})'] = {TableTrend:label}; summaryPerComputer | join kind=leftouter (trend) on Computer | join kind=leftouter (NodeIdentityAndProps) on Computer | join kind=leftouter (NodeIdentityAndPropsMin) on Computer | join kind=leftouter (MachineSummary) on Computer | project ResourceName, Type, {mergedAggregators}, ['Trend ({TableTrend:label})'], Properties = MachineSummary | sort by {TableTrend:label} {tableTrendOrder}", + "size": 0, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Average", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P50th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (Average)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Properties", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info" + } + }, + { + "columnMatch": "P95th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P5th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P10th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P80th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P90th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Min", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Max", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (P95th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P5th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P90th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P80th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P50th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P10th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + } + ], + "labelSettings": [ + { + "columnId": "ResourceName", + "label": "ResourceName" + }, + { + "columnId": "Type", + "label": "Type" + }, + { + "columnId": "Average", + "label": "Average" + }, + { + "columnId": "P95th", + "label": "P95th" + }, + { + "columnId": "Max", + "label": "Max" + }, + { + "columnId": "Trend (Average)", + "label": "Trend (Average)" + }, + { + "columnId": "Properties", + "label": "Properties" + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowTable", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + } + ], + "conditionalVisibility": { + "parameterName": "ShowTable", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 8" + }, + { + "type": 1, + "content": { + "json": "### CPU Utilization %" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 12" + }, + { + "type": 1, + "content": { + "json": "### Available Memory" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "92358ae0-d5e1-494b-b65b-6d904f1325c5", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "27345375-4376-4e2f-8ac4-59d4eab9d235", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "4d9ba0ec-9d22-4fec-9f85-4be334f42d91", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "50242f48-6c7d-449b-ad93-838c94e615a0", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 14" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "333837c2-d5a4-4173-9aad-3db1dca17e2a", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P5th = round(percentile(Val, 5), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "a23b29a5-5e4a-4d8e-ba73-bfdf27b2980e", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "cc8dfabc-9eb9-4227-97bb-f5e9319030ec", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "ff7a79ff-742a-4c6e-8628-c52f45b3bf71", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 15" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 1, + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 16" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'Memory' and Name == 'AvailableMB'\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, Name\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'Memory' and Name == 'AvailableMB'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 4, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 17" + }, + { + "type": 1, + "content": { + "json": "### Bytes Sent Rate" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "### Bytes Received Rate" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 19" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "360da4c1-97fa-4b15-a008-33a6110d0acd", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "31ccd4a1-d626-44bb-a5de-1780a33b37a5", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "4765abab-a682-49f6-bb41-d64852aba192", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "1d9b0ea9-09d4-4c73-8e59-fa7ab760b880", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 20" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "6772b281-d17d-4293-a227-1b2ed67f399e", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "5e2eef28-0528-406f-86b5-ceae535455f9", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "586fa51c-1a45-4602-adcb-62eb0f619b7f", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "912085b6-f920-4a37-9ce3-f1ef86bd5df8", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, Name\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 23" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk Space Used %" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 24" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 25" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5d6afbec-79f6-4cd1-b3a1-361503478304", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]" + }, + { + "id": "1d5a805c-acce-4afe-a38b-c2740fb3ff26", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrder", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 26" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 27" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n\t| extend Val = 100 - Val\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n\t| extend Val = 100 - Val\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "exportToExcelOptions": "visible", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 1, + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 28" + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Preview)/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Preview)/settings.json new file mode 100644 index 0000000..0f7ecd6 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs (Preview)/settings.json @@ -0,0 +1,10 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance (Preview)", + "isPreview": true, + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorVirtualMachines", "order": 100 }, + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 200 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs/Performance Analysis for a Group of VMs.workbook b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs/Performance Analysis for a Group of VMs.workbook new file mode 100644 index 0000000..626ac83 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs/Performance Analysis for a Group of VMs.workbook @@ -0,0 +1,1396 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "688dc7cb-bea3-41ae-ae94-32d22e09568c", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "c11b5651-cf86-4865-b23d-9ecc4f16b712", + "version": "KqlParameterItem/1.0", + "name": "ContextFree", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{DefaultWorkspace}\\\"\"}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "bbbc300a-6f91-4b2b-b4b5-842b4bf8577a", + "version": "KqlParameterItem/1.0", + "name": "Selection", + "type": 1, + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| extend match = strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| order by match desc, name asc\r\n| take 1\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "_", + "comparison": "isEqualTo", + "value": "_" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "# Performance Analysis" + }, + "conditionalVisibility": { + "parameterName": "ContextFree", + "comparison": "isEqualTo", + "value": "value::1" + }, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "1db5ee15-fe52-458b-91d1-7ee39d8c2cd3", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "summarize by subscriptionId\r\n| project value = strcat('/subscriptions/', subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ todynamic('{Selection}').sub, true, false)", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "9732eff8-fb57-4cbd-8ade-5ae746f33760", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| project id, selected = iff(id =~ todynamic('{Selection}').ws, true, false)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "5f8cce4b-9c4c-47da-8683-7e5ccc9faed3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-10-04T22:01:18.372Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-10-04T22:01:18.374Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2018-10-04T22:01:18.375Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "label": "Time Range", + "resourceType": "microsoft.insights/components" + }, + { + "id": "d6de19ff-cde4-41c2-9fba-b441312ea5c9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "label": "Not Onboarded", + "type": 1, + "query": "let sm = ServiceMapComputer_CL\r\n| where TimeGenerated {TimeRange}\r\n| take 1;\r\nInsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| take 1\r\n| union sm\r\n| summarize count()", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": null, + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 2" + }, + { + "type": 1, + "content": { + "json": "⚠ A subscription has not yet been selected. Select a subscription under the `Subscriptions` dropdown or refresh the workbook." + }, + "conditionalVisibility": { + "parameterName": "Subscriptions", + "comparison": "isEqualTo", + "value": null + }, + "name": "text - 29" + }, + { + "type": 1, + "content": { + "json": "⚠ Your workspace `{Workspaces:label}` does not have the necessary information for the specified time period (`{TimeRange:label}`) to show performance metrics. Try a broader time range, select a different workspace, or onboard virtual machines to the selected workspace.\r\n\r\nIf you choose to onboard virtual machines to workspace `{Workspaces:label}`, follow the instruction in the following link: [Azure Monitor for VMs (preview)](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview)." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": null + }, + "name": "text - 3" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Top 100 Machines", + "subTarget": "top100", + "style": "link" + }, + { + "cellValue": "tab", + "linkTarget": "parameter", + "linkLabel": "Top 10 Machines", + "subTarget": "top10", + "style": "link" + } + ] + }, + "name": "links - 28" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "41bb3710-5e9e-4b66-91fd-e11435899880", + "version": "KqlParameterItem/1.0", + "name": "ComputerNameContains", + "label": "Computer Name Contains", + "type": 1, + "description": "This will filter the computers whose name contains the keyword. This will query all the machines in the workspace.", + "value": "", + "resourceType": "microsoft.insights/components" + }, + { + "id": "b533865a-3539-42b1-8dcd-33ca0d481c2a", + "version": "KqlParameterItem/1.0", + "name": "ComputerFilter", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"snippet\\\": \\\"| where Computer contains '{ComputerNameContains}'\\\"}\"}", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "description": "Select a VM performance counter for the table below", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Namespace, Name, CounterText = Name\r\n| order by Name asc, Namespace asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "974d5ac2-4fc5-48e7-a8f7-16fc9dddc4ac", + "version": "KqlParameterItem/1.0", + "name": "CounterText", + "type": 1, + "query": "let metric = dynamic({Counter});\r\nrange Steps from 1 to 1 step 1\r\n| project strcat(metric.object, \" > \", metric.counter)", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "9ad8858d-8ef3-4144-94b1-66a8bf9fa9c9", + "version": "KqlParameterItem/1.0", + "name": "Aggregators", + "type": 2, + "description": "Select one or more different aggregates to display in the table below", + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th\", \"label\":\"P95th\", \"selected\": true },\r\n { \"value\":\"Min\", \"label\":\"Min\", \"selected\": false },\r\n { \"value\":\"Max\", \"label\":\"Max\", \"selected\": true }\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TableTrend", + "type": 2, + "description": "Select a percentile to display in the Trend column in the table below", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\": true },\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\": false },\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\": false },\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\": false },\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\": false },\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\": false },\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\": false }\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "tableTrendOrder", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{TableTrend}' contains 'P5th' or '{TableTrend}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "c2f05b6d-970d-4fde-88b0-868387c02250", + "version": "KqlParameterItem/1.0", + "name": "mergedAggregators", + "type": 1, + "query": "let aggregators = iff('{Aggregators}' contains '{TableTrend:label}', '{Aggregators}', '{Aggregators},{TableTrend:label}');\r\nrange Steps from 1 to 1 step 1\r\n| project aggregators", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "69c79551-68b9-4c84-bf57-202540482a02", + "version": "KqlParameterItem/1.0", + "name": "ShowTable", + "type": 1, + "query": "print iff(\"{Test:value}\" == \"\", \"False\", \"True\")", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "343c4eae-e482-4678-a936-c4ad43b2ec19", + "version": "KqlParameterItem/1.0", + "name": "CounterTest", + "type": 1, + "query": "InsightsMetrics\r\n| take 1", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibilities": [ + { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + } + ], + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": null + }, + "name": "parameters - 6" + }, + { + "type": 1, + "content": { + "json": "There are no performance counters, either onboard machines to this workspace or enable performance counters." + }, + "conditionalVisibilities": [ + { + "parameterName": "CounterTest", + "comparison": "isEqualTo", + "value": "" + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + } + ], + "conditionalVisibility": { + "parameterName": "CounterTest", + "comparison": "isEqualTo", + "value": "" + }, + "name": "text - 7" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let maxResultCount = 100; let metric = dynamic({Counter}); let summaryPerComputer = totable(InsightsMetrics | where TimeGenerated {TimeRange} {ComputerFilter} | where Namespace == metric.object and Name == metric.counter | summarize hint.shufflekey = Computer Average = avg(Val), Max = max(Val), Min = min(Val), percentiles(Val, 5, 10, 50, 80, 90, 95) by Computer | project Computer, Average, Max, Min, P5th = percentile_Val_5, P10th = percentile_Val_10, P50th = percentile_Val_50, P80th = percentile_Val_80, P90th = percentile_Val_90, P95th = percentile_Val_95 | order by {TableTrend:label} {tableTrendOrder}, Computer | limit maxResultCount); let computerList = summaryPerComputer | project Computer; let MachineSummary = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | project Computer, MachineSummary = pack('Fully Qualified Domain Name', Computer, 'OS Type', OperatingSystemFamily_s, 'Operating System', OperatingSystemFullName_s, 'Ipv4 Addresses', Ipv4Addresses_s, 'Ipv6 Addresses', Ipv6Addresses_s, 'Mac Addresses', MacAddresses_s, 'DNS Names', DnsNames_s, 'CPUs', strcat(Cpus_d, ' @ ', CpuSpeed_d, ' MHz'), 'Bitness', Bitness_s, 'Physcial Memory', strcat(PhysicalMemory_d, ' MB'), 'Virtualization State', VirtualizationState_s, 'VM Type', VirtualMachineType_s, 'OMS Agent', split(ResourceName_s, 'm-')[1]); let EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) []; let OmsNodeIdentityAndProps = computerList | extend NodeId = Computer | extend Priority = 1 | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer); let ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL | where TimeGenerated {TimeRange} | where Computer in (computerList) | summarize arg_max(TimeGenerated, *) by Computer | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2; let NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps | summarize arg_max(Priority, *) by Computer; let NodeIdentityAndPropsMin = NodeIdentityAndProps | extend Type = iff(NodeProps.type == 'StandAloneNode', iff(NodeProps.azureResourceId == '', 'Non-Azure Virtual Machine', 'Azure Virtual Machine'), NodeProps.type), ResourceId = iff(NodeProps.type == 'AzureScaleSetNode', NodeProps.vmScaleSetResourceId, iff(NodeProps.type == 'AzureCloudServiceNode', NodeProps.cloudServiceDeploymentId, Computer)), ResourceName = iff(NodeProps.type == 'AzureScaleSetNode', strcat(NodeProps.vmScaleSetName, ' | ', NodeProps.scaleSetInstanceId), iff(NodeProps.type == 'AzureCloudServiceNode', strcat(NodeProps.cloudServiceRoleName, ' | ', NodeProps.cloudServiceInstanceId), Computer)) | project Computer, Type, ResourceId, ResourceName; let trend = InsightsMetrics | where TimeGenerated {TimeRange} | where Computer in (computerList) | where Namespace == metric.object and Name == metric.counter | make-series {TableTrend} default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer | project Computer, ['Trend ({TableTrend:label})'] = {TableTrend:label}; summaryPerComputer | join kind=leftouter (trend) on Computer | join kind=leftouter (NodeIdentityAndProps) on Computer | join kind=leftouter (NodeIdentityAndPropsMin) on Computer | join kind=leftouter (MachineSummary) on Computer | project ResourceName, Type, {mergedAggregators}, ['Trend ({TableTrend:label})'], Properties = MachineSummary | sort by {TableTrend:label} {tableTrendOrder}\r\n", + "size": 0, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Type", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Average", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P50th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (Average)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Properties", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "ℹ️ Info" + } + }, + { + "columnMatch": "P95th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P5th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P10th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P80th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "P90th", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Min", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Max", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Trend (P95th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P5th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P90th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P80th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P50th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Trend (P10th)", + "formatter": 10, + "formatOptions": { + "palette": "blue" + } + } + ] + } + }, + "conditionalVisibilities": [ + { + "parameterName": "ShowTable", + "comparison": "isEqualTo", + "value": "True" + }, + { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top100" + } + ], + "conditionalVisibility": { + "parameterName": "ShowTable", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 8" + }, + { + "type": 1, + "content": { + "json": "### CPU Utilization %" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 12" + }, + { + "type": 1, + "content": { + "json": "### Available Memory" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "92358ae0-d5e1-494b-b65b-6d904f1325c5", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "27345375-4376-4e2f-8ac4-59d4eab9d235", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "4d9ba0ec-9d22-4fec-9f85-4be334f42d91", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "50242f48-6c7d-449b-ad93-838c94e615a0", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 14" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "333837c2-d5a4-4173-9aad-3db1dca17e2a", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P5th = round(percentile(Val, 5), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "a23b29a5-5e4a-4d8e-ba73-bfdf27b2980e", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "cc8dfabc-9eb9-4227-97bb-f5e9319030ec", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "ff7a79ff-742a-4c6e-8628-c52f45b3bf71", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 15" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where (Namespace == 'Processor' and Name == 'UtilizationPercentage')\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 1, + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 16" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'Memory' and Name == 'AvailableMB'\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, Name\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'Memory' and Name == 'AvailableMB'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 4, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 17" + }, + { + "type": 1, + "content": { + "json": "### Bytes Sent Rate" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "### Bytes Received Rate" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 19" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "360da4c1-97fa-4b15-a008-33a6110d0acd", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "31ccd4a1-d626-44bb-a5de-1780a33b37a5", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderLeft", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "4765abab-a682-49f6-bb41-d64852aba192", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "1d9b0ea9-09d4-4c73-8e59-fa7ab760b880", + "version": "KqlParameterItem/1.0", + "name": "aggregateLeftLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 20" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "6772b281-d17d-4293-a227-1b2ed67f399e", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "5e2eef28-0528-406f-86b5-ceae535455f9", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrderRight", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "586fa51c-1a45-4602-adcb-62eb0f619b7f", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightValue", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:value}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "912085b6-f920-4a37-9ce3-f1ef86bd5df8", + "version": "KqlParameterItem/1.0", + "name": "aggregateRightLabel", + "type": 1, + "isRequired": true, + "query": "print \"{Aggregate:label}\"", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n | summarize hint.shufflekey=Computer {aggregateRightValue} by Computer, Name\r\n | top 10 by {aggregateRightLabel} {aggregateOrderRight});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateRightValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 2, + "min": 0, + "max": null + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 23" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk Space Used %" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 24" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 25" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5d6afbec-79f6-4cd1-b3a1-361503478304", + "version": "KqlParameterItem/1.0", + "name": "Aggregate", + "type": 2, + "isRequired": true, + "value": "P95th = round(percentile(Val, 95), 2)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\"},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\"},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\"},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\"},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\"},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\"},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\"}\r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "1d5a805c-acce-4afe-a38b-c2740fb3ff26", + "version": "KqlParameterItem/1.0", + "name": "aggregateOrder", + "type": 1, + "query": "range Steps from 1 to 1 step 1\r\n| project value = iff('{Aggregate}' contains 'P5th' or '{Aggregate}' contains 'P10th', 'asc', 'desc')", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "parameters - 26" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "text - 27" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let memorySummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n\t| extend Val = 100 - Val\r\n | summarize hint.shufflekey=Computer {aggregateLeftValue} by Computer, Name\r\n | top 10 by {aggregateLeftLabel} {aggregateOrderLeft});\r\nlet computerList=(memorySummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n\t| extend Val = 100 - Val\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {aggregateLeftValue} by bin(TimeGenerated, ({TimeRange:end} - {TimeRange:start})/100), ResourceName", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "There is no data for this counter, either enable the counter or onboard machines to this workspace", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "ySettings": { + "unit": 1, + "min": 0, + "max": 100 + } + } + }, + "conditionalVisibility": { + "parameterName": "tab", + "comparison": "isEqualTo", + "value": "top10" + }, + "customWidth": "50", + "name": "query - 28" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs/settings.json new file mode 100644 index 0000000..9a94add --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Group of VMs/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorVirtualMachines", "order": 100 }, + { "type": "vm-insights", "resourceType": "Azure Monitor", "categoryKey": "vmInsightsVirtualMachinesInsightsMetrics", "order": 200 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM (Perf)/Performance Analysis for a Single VM (Perf).workbook b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM (Perf)/Performance Analysis for a Single VM (Perf).workbook new file mode 100644 index 0000000..21ec286 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM (Perf)/Performance Analysis for a Single VM (Perf).workbook @@ -0,0 +1,754 @@ +{ + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Performance Analysis" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "4f883c2c-8e3d-4d52-8f71-30fd86a0f827", + "version": "KqlParameterItem/1.0", + "name": "Computer", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": null + }, + { + "id": "cb7fdad2-dd9c-4c53-b2cb-572351dbbb3d", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "timeContextFromParameter": null + } + ], + "style": "above", + "resourceType": "microsoft.compute/virtualmachines" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "---\n## Trend\n💡 In the graph below a default counter (`Counter`) has been selected, select the dropdown to choose a different counter." + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "d495f8c1-c6b2-490e-8eb6-43d151bc20c0", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "description": "Select a virtual machine performance counter to display in the chart below", + "isRequired": true, + "query": "// {Computer:label}\r\nPerf\r\n| where TimeGenerated {TimeRange}\r\n| summarize by CounterName, ObjectName, CounterText = CounterName\r\n| order by ObjectName asc, CounterText asc\r\n| project Counter = pack('counter', CounterName, 'object', ObjectName), CounterText, group = ObjectName", + "crossComponentResources": [ + "{Computer}" + ], + "value": "{\"counter\":\"% Processor Time\",\"object\":\"Processor\"}", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "31b68fb4-3740-406d-b8eb-ac29cb461c3f", + "version": "KqlParameterItem/1.0", + "name": "CounterText", + "type": 1, + "isRequired": false, + "query": "let metric = dynamic({Counter});\r\nrange Steps from 1 to 1 step 1\r\n| project strcat(metric.object, \" > \", metric.counter)", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "4bf4bd96-531d-4d30-b1ba-1aef067fbc6e", + "version": "KqlParameterItem/1.0", + "name": "grain", + "type": 1, + "isRequired": true, + "query": "print ({TimeRange:end} - {TimeRange:start})/100", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "dff91367-8a90-4d46-8a43-8595972eacc8", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "description": "Select one or more aggregates for the performance counter to display in the chart below", + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(CounterValue, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":false},\r\n { \"value\":\"P99th = round(percentile(CounterValue, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(CounterValue), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(CounterValue), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "timeContextFromParameter": null + } + ], + "style": "above", + "resourceType": "microsoft.compute/virtualmachines" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "// {Computer:label}\r\nlet metric = dynamic({Counter});\r\nPerf\r\n| where TimeGenerated {TimeRange}\r\n| where ObjectName == metric.object and CounterName == metric.counter\r\n| summarize {Aggregates} by bin(TimeGenerated, totimespan('{grain}'))", + "showQuery": false, + "size": 0, + "aggregation": 3, + "showAnnotations": false, + "showAnalytics": false, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "---\n## Performance Charts\n💡 *Customize or add your own charts below in edit mode or by using the advanced editor*" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### CPU Utilization %" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Available Memory MB" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "f4ab7159-2f3a-4720-96b2-2365a3e93617", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "isRequired": false, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(CounterValue, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":true},\r\n { \"value\":\"P99th = round(percentile(CounterValue, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(CounterValue), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(CounterValue), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "timeContextFromParameter": null + }, + { + "id": "069034ca-ed62-48e7-b6ae-d90d1d6d7aaf", + "version": "KqlParameterItem/1.0", + "name": "AggregatesLeft", + "type": 1, + "isRequired": false, + "query": "print \"{Aggregates}\"", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "resourceType": "microsoft.compute/virtualmachines" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "a1d2a8b9-9c5b-4d1f-b709-49dbd0fe94bd", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "isRequired": false, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(CounterValue, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":true},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":true},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":false},\r\n { \"value\":\"P99th = round(percentile(CounterValue, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(CounterValue), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(CounterValue), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "timeContextFromParameter": null + }, + { + "id": "1f360103-df10-41c7-8f82-13edd11461aa", + "version": "KqlParameterItem/1.0", + "name": "AggregatesRight", + "type": 1, + "isRequired": false, + "query": "print \"{Aggregates}\"", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "resourceType": "microsoft.compute/virtualmachines" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({\"counter\": \"% Processor Time\", \"object\": \"Processor\"});\nPerf\n| where TimeGenerated {TimeRange}\n| where (ObjectName == 'Processor' and InstanceName == '_Total' and CounterName == '% Processor Time')\n| where InstanceName == '_Total'\n| summarize {AggregatesLeft} by bin(TimeGenerated, totimespan('{grain}'))", + "showQuery": false, + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": false, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| where (ObjectName == 'Memory' and CounterName in ('Available MBytes', 'Available MBytes Memory'))\r\n| summarize {AggregatesRight} by bin(TimeGenerated, totimespan('{grain}'))", + "showQuery": false, + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": false, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "linechart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk IOPS" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk MB/s" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "547dae05-22bf-47a5-ad44-043a23995759", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "isRequired": false, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(CounterValue, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":true},\r\n { \"value\":\"P99th = round(percentile(CounterValue, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(CounterValue), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(CounterValue), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "timeContextFromParameter": null + }, + { + "id": "1af979b2-3131-4771-bf02-30193138c565", + "version": "KqlParameterItem/1.0", + "name": "AggregatesLeft", + "type": 1, + "isRequired": false, + "query": "print \"{Aggregates}\"", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "resourceType": "microsoft.compute/virtualmachines" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "8aaa181d-7182-4d9d-b74e-22f37e3acbce", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "isRequired": false, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(CounterValue, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":true},\r\n { \"value\":\"P99th = round(percentile(CounterValue, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(CounterValue), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(CounterValue), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "timeContextFromParameter": null + }, + { + "id": "c021b342-6bc8-4870-a88b-8ddf0b8b9cfa", + "version": "KqlParameterItem/1.0", + "name": "AggregatesRight", + "type": 1, + "isRequired": false, + "query": "print \"{Aggregates}\"", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "resourceType": "microsoft.compute/virtualmachines" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| where (ObjectName == 'Logical Disk' and InstanceName != '_Total' and CounterName == 'Disk Transfers/sec')\r\n| summarize {AggregatesLeft} by bin(TimeGenerated, totimespan('{grain}'))", + "showQuery": false, + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": false, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| where (ObjectName == 'Logical Disk' and InstanceName != '_Total' and CounterName == 'Logical Disk Bytes/sec')\r\n| summarize {AggregatesRight} by bin(TimeGenerated, totimespan('{grain}'))", + "showQuery": false, + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": false, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "linechart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Max Logical Disk Used %" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Bytes Sent Rate B/s" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [], + "style": "pills", + "resourceType": "microsoft.compute/virtualmachines" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "f963e52a-2099-4cd3-a3ad-0fdf78f38238", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "isRequired": false, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(CounterValue, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":false},\r\n { \"value\":\"P99th = round(percentile(CounterValue, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(CounterValue), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(CounterValue), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "timeContextFromParameter": null + }, + { + "id": "6c5d9373-5403-44e5-b496-7155c338f958", + "version": "KqlParameterItem/1.0", + "name": "AggregatesRight", + "type": 1, + "isRequired": false, + "query": "print \"{Aggregates}\"", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "resourceType": "microsoft.compute/virtualmachines" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let trendBinSize = totimespan('{grain}');\r\nlet MaxListSize = 1000;\r\nlet rawDataCached = materialize(Perf\r\n\t| where TimeGenerated {TimeRange}\r\n | where\r\n\t\t(ObjectName == 'Logical Disk' and InstanceName != '_Total' and CounterName == '% Used Space') or\r\n (ObjectName == 'LogicalDisk' and InstanceName != '_Total' and CounterName == '% Free Space')\r\n\t| project TimeGenerated,\r\n\t\tInstanceName,\r\n\t\tcValue = case(CounterName == '% Free Space', 100 - CounterValue, CounterValue < 0, real(0), CounterValue));\r\n\t\trawDataCached\r\n\t\t\t| summarize max(cValue) by InstanceName\r\n\t\t\t| top 8 by max_cValue\r\n\t\t\t| join (rawDataCached) on InstanceName\r\n\t\t\t| summarize max(cValue), global_Max=any(max_cValue) by bin(TimeGenerated, trendBinSize), InstanceName\r\n\t\t\t| sort by TimeGenerated asc\r\n\t\t\t| summarize makelist(TimeGenerated, MaxListSize), list_max_cValue=makelist(max_cValue, MaxListSize), max_cValue=any(global_Max) by InstanceName", + "showQuery": false, + "size": 0, + "aggregation": 2, + "showAnnotations": true, + "showAnalytics": false, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let grain = totimespan('{grain}');\r\nlet windowsNetwork=Perf\r\n| where TimeGenerated {TimeRange}\r\n| where ObjectName == 'Network Adapter' and CounterName == 'Bytes Sent/sec'\r\n| summarize CounterValue = sum(CounterValue) by bin(TimeGenerated, 2s);\r\nlet linuxNetwork=Perf\r\n| where TimeGenerated {TimeRange}\r\n| where ObjectName == 'Network' and CounterName == 'Total Bytes Transmitted'\r\n| order by InstanceName, TimeGenerated asc\r\n| extend prev_Value=prev(CounterValue), prev_t=prev(TimeGenerated), prev_instance=prev(InstanceName)\r\n| project TimeGenerated, CounterValue=iff(prev_instance == InstanceName and CounterValue >= prev_Value and TimeGenerated > prev_t, (CounterValue - prev_Value) / ((TimeGenerated - prev_t) / 1s), real(0))\r\n| summarize CounterValue = sum(CounterValue) by bin(TimeGenerated, 2s);\r\nlet networkDataSend = union windowsNetwork, linuxNetwork;\r\nnetworkDataSend\r\n| summarize {AggregatesRight} by bin(TimeGenerated, grain)", + "showQuery": false, + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": false, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Bytes Received Rate B/s" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "c0592d9a-edd4-4a69-86c0-098ac0c72cf2", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "isRequired": false, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(CounterValue, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":false},\r\n { \"value\":\"P99th = round(percentile(CounterValue, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(CounterValue), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(CounterValue), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "timeContextFromParameter": null + }, + { + "id": "d4795fc0-c995-4975-8bc6-e515dbad00be", + "version": "KqlParameterItem/1.0", + "name": "AggregatesLeft", + "type": 1, + "isRequired": false, + "query": "print \"{Aggregates}\"", + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "resourceType": "microsoft.compute/virtualmachines" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [], + "style": "pills", + "resourceType": "microsoft.compute/virtualmachines" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let grain = totimespan('{grain}');\r\nlet windowsNetwork=Perf\r\n| where TimeGenerated {TimeRange}\r\n| where ObjectName == 'Network Adapter' and CounterName == 'Bytes Received/sec'\r\n| summarize CounterValue = sum(CounterValue) by bin(TimeGenerated, 2s);\r\nlet linuxNetwork=Perf\r\n| where TimeGenerated {TimeRange}\r\n| where ObjectName == 'Network' and CounterName == 'Total Bytes Received'\r\n| order by InstanceName, TimeGenerated asc\r\n| extend prev_Value = prev(CounterValue), prev_t = prev(TimeGenerated), prev_instance = prev(InstanceName)\r\n| project TimeGenerated, CounterValue = iff(prev_instance == InstanceName and CounterValue >= prev_Value and TimeGenerated > prev_t, (CounterValue - prev_Value) / ((TimeGenerated - prev_t) / 1s), real(0))\r\n| summarize CounterValue = sum(CounterValue) by bin(TimeGenerated, 2s);\r\nlet networkDataReceive = union windowsNetwork, linuxNetwork;\r\nnetworkDataReceive\r\n| summarize {AggregatesLeft} by bin(TimeGenerated, grain)", + "showQuery": false, + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "showAnalytics": false, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "timeContextFromParameter": null, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM (Perf)/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM (Perf)/settings.json new file mode 100644 index 0000000..e396c6a --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM (Perf)/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance", + "author": "Microsoft", + "galleries": [ + { "type": "performance-vm", "resourceType": "microsoft.compute/virtualmachines", "categoryKey": "vmInsightsVirtualMachinesPerf", "order": 200 }, + { "type": "insights", "resourceType": "microsoft.compute/virtualmachines", "categoryKey": "vmInsightsVirtualMachinesPerf", "order": 200 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM (Preview)/Performance Analysis for a Single VM.workbook b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM (Preview)/Performance Analysis for a Single VM.workbook new file mode 100644 index 0000000..4f576f3 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM (Preview)/Performance Analysis for a Single VM.workbook @@ -0,0 +1,714 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Performance Analysis" + }, + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "4f883c2c-8e3d-4d52-8f71-30fd86a0f827", + "version": "KqlParameterItem/1.0", + "name": "Computer", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "cb7fdad2-dd9c-4c53-b2cb-572351dbbb3d", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "---\n## Trend\n💡 In the graph below a default counter (`Counter`) has been selected, select the dropdown to choose a different counter." + }, + "name": "text - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "d495f8c1-c6b2-490e-8eb6-43d151bc20c0", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "description": "Select a virtual machine performance counter to display in the chart below", + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Namespace, Name\r\n| order by Namespace asc, Name asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), Name, group = Namespace", + "crossComponentResources": [ + "{Computer}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "31b68fb4-3740-406d-b8eb-ac29cb461c3f", + "version": "KqlParameterItem/1.0", + "name": "CounterText", + "type": 1, + "query": "let metric = dynamic({Counter});\r\nrange Steps from 1 to 1 step 1\r\n| project strcat(metric.object, \" > \", metric.counter)", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "4bf4bd96-531d-4d30-b1ba-1aef067fbc6e", + "version": "KqlParameterItem/1.0", + "name": "grain", + "type": 1, + "isRequired": true, + "query": "print ({TimeRange:end} - {TimeRange:start})/100", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "dff91367-8a90-4d46-8a43-8595972eacc8", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "description": "Select one or more aggregates for the performance counter to display in the chart below", + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":false},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "name": "parameters - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter});\r\nInsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == metric.object and Name == metric.counter\r\n| summarize {Aggregates} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "name": "query - 4" + }, + { + "type": 1, + "content": { + "json": "---\n## Performance Charts\n💡 *Customize or add your own charts below in edit mode or by using the advanced editor*" + }, + "name": "text - 5" + }, + { + "type": 1, + "content": { + "json": "### CPU Utilization %" + }, + "customWidth": "50", + "name": "text - 6" + }, + { + "type": 1, + "content": { + "json": "### Available Memory MB" + }, + "customWidth": "50", + "name": "text - 7" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "f4ab7159-2f3a-4720-96b2-2365a3e93617", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]" + }, + { + "id": "069034ca-ed62-48e7-b6ae-d90d1d6d7aaf", + "version": "KqlParameterItem/1.0", + "name": "AggregatesLeft", + "type": 1, + "query": "print \"{Aggregates}\"", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "customWidth": "50", + "name": "parameters - 8" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "a1d2a8b9-9c5b-4d1f-b709-49dbd0fe94bd", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":true},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":true},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":false},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]" + }, + { + "id": "1f360103-df10-41c7-8f82-13edd11461aa", + "version": "KqlParameterItem/1.0", + "name": "AggregatesRight", + "type": 1, + "query": "print \"{Aggregates}\"", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "customWidth": "50", + "name": "parameters - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\n| where TimeGenerated {TimeRange}\n| where Namespace == 'Processor' and Name == 'UtilizationPercentage'\n| summarize {AggregatesLeft} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "name": "query - 10" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == 'Memory' and Name == 'AvailableMB'\r\n| summarize {AggregatesRight} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "linechart" + }, + "customWidth": "50", + "name": "query - 11" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk IOPS" + }, + "customWidth": "50", + "name": "text - 12" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk MB/s" + }, + "customWidth": "50", + "name": "text - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "547dae05-22bf-47a5-ad44-043a23995759", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]" + }, + { + "id": "1af979b2-3131-4771-bf02-30193138c565", + "version": "KqlParameterItem/1.0", + "name": "AggregatesLeft", + "type": 1, + "query": "print \"{Aggregates}\"", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "customWidth": "50", + "name": "parameters - 14" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "8aaa181d-7182-4d9d-b74e-22f37e3acbce", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]" + }, + { + "id": "c021b342-6bc8-4870-a88b-8ddf0b8b9cfa", + "version": "KqlParameterItem/1.0", + "name": "AggregatesRight", + "type": 1, + "query": "print \"{Aggregates}\"", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "customWidth": "50", + "name": "parameters - 15" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == 'LogicalDisk' and Name == 'TransfersPerSecond'\r\n| summarize {AggregatesLeft} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "name": "query - 16" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == 'LogicalDisk' and Name == 'BytesPerSecond'\r\n| summarize {AggregatesRight} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "linechart" + }, + "customWidth": "50", + "name": "query - 17" + }, + { + "type": 1, + "content": { + "json": "### Max Logical Disk Used %" + }, + "customWidth": "50", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "### Bytes Sent Rate B/s" + }, + "customWidth": "50", + "name": "text - 19" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "customWidth": "50", + "name": "parameters - 20" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "f963e52a-2099-4cd3-a3ad-0fdf78f38238", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":false},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]" + }, + { + "id": "6c5d9373-5403-44e5-b496-7155c338f958", + "version": "KqlParameterItem/1.0", + "name": "AggregatesRight", + "type": 1, + "query": "print \"{Aggregates}\"", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "customWidth": "50", + "name": "parameters - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n| summarize {AggregatesLeft} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 2, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "name": "query - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n| summarize {AggregatesRight} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "name": "query - 23" + }, + { + "type": 1, + "content": { + "json": "### Bytes Received Rate B/s" + }, + "customWidth": "50", + "name": "text - 24" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "50", + "name": "text - 25" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "c0592d9a-edd4-4a69-86c0-098ac0c72cf2", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":false},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]" + }, + { + "id": "d4795fc0-c995-4975-8bc6-e515dbad00be", + "version": "KqlParameterItem/1.0", + "name": "AggregatesLeft", + "type": 1, + "query": "print \"{Aggregates}\"", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.compute/virtualmachines" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "customWidth": "50", + "name": "parameters - 26" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "customWidth": "50", + "name": "parameters - 27" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n| summarize {AggregatesLeft} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "name": "query - 28" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM (Preview)/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM (Preview)/settings.json new file mode 100644 index 0000000..c3c1d54 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM (Preview)/settings.json @@ -0,0 +1,10 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance (Preview)", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "performance-vm", "resourceType": "microsoft.compute/virtualmachines", "order": 200 }, + { "type": "insights", "resourceType": "microsoft.compute/virtualmachines", "order": 200 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM/Performance Analysis for a Single VM.workbook b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM/Performance Analysis for a Single VM.workbook new file mode 100644 index 0000000..3d26338 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM/Performance Analysis for a Single VM.workbook @@ -0,0 +1,772 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Performance Analysis" + }, + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::selected" + ], + "parameters": [ + { + "id": "4f883c2c-8e3d-4d52-8f71-30fd86a0f827", + "version": "KqlParameterItem/1.0", + "name": "Computer", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true, + "microsoft.hybridcompute/machines": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "cb7fdad2-dd9c-4c53-b2cb-572351dbbb3d", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-01-15T00:55:43.346Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-01-15T00:55:43.347Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "363fc7ea-84b0-401c-b708-3a0c4dd98ccd", + "version": "KqlParameterItem/1.0", + "name": "ResourceType", + "type": 7, + "isRequired": true, + "query": "take 1\r\n| project \"{Computer:resourcetype}\"", + "crossComponentResources": [ + "value::selected" + ], + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "---\n## Trend\n💡 In the graph below a default counter (`Counter`) has been selected, select the dropdown to choose a different counter." + }, + "name": "text - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "d495f8c1-c6b2-490e-8eb6-43d151bc20c0", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "description": "Select a virtual machine performance counter to display in the chart below", + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Namespace, Name\r\n| order by Namespace asc, Name asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), Name, group = Namespace", + "crossComponentResources": [ + "{Computer}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "{ResourceType}" + }, + { + "id": "31b68fb4-3740-406d-b8eb-ac29cb461c3f", + "version": "KqlParameterItem/1.0", + "name": "CounterText", + "type": 1, + "query": "let metric = dynamic({Counter});\r\nrange Steps from 1 to 1 step 1\r\n| project strcat(metric.object, \" > \", metric.counter)", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + { + "id": "4bf4bd96-531d-4d30-b1ba-1aef067fbc6e", + "version": "KqlParameterItem/1.0", + "name": "grain", + "type": 1, + "isRequired": true, + "query": "print ({TimeRange:end} - {TimeRange:start})/100", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "{ResourceType}" + }, + { + "id": "dff91367-8a90-4d46-8a43-8595972eacc8", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "description": "Select one or more aggregates for the performance counter to display in the chart below", + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":false},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "{ResourceType}" + }, + "name": "parameters - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter});\r\nInsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == metric.object and Name == metric.counter\r\n| summarize {Aggregates} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceType}", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "name": "query - 4" + }, + { + "type": 1, + "content": { + "json": "---\n## Performance Charts\n💡 *Customize or add your own charts below in edit mode or by using the advanced editor*" + }, + "name": "text - 5" + }, + { + "type": 1, + "content": { + "json": "### CPU Utilization %" + }, + "customWidth": "50", + "name": "text - 6" + }, + { + "type": 1, + "content": { + "json": "### Available Memory MB" + }, + "customWidth": "50", + "name": "text - 7" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "f4ab7159-2f3a-4720-96b2-2365a3e93617", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "069034ca-ed62-48e7-b6ae-d90d1d6d7aaf", + "version": "KqlParameterItem/1.0", + "name": "AggregatesLeft", + "type": 1, + "query": "print \"{Aggregates}\"", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "{ResourceType}" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "{ResourceType}" + }, + "customWidth": "50", + "name": "parameters - 8" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "a1d2a8b9-9c5b-4d1f-b709-49dbd0fe94bd", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":true},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":true},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":false},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "1f360103-df10-41c7-8f82-13edd11461aa", + "version": "KqlParameterItem/1.0", + "name": "AggregatesRight", + "type": 1, + "query": "print \"{Aggregates}\"", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "{ResourceType}" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "{ResourceType}" + }, + "customWidth": "50", + "name": "parameters - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\n| where TimeGenerated {TimeRange}\n| where Namespace == 'Processor' and Name == 'UtilizationPercentage'\n| summarize {AggregatesLeft} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceType}", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "name": "query - 10" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == 'Memory' and Name == 'AvailableMB'\r\n| summarize {AggregatesRight} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceType}", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "linechart" + }, + "customWidth": "50", + "name": "query - 11" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk IOPS" + }, + "customWidth": "50", + "name": "text - 12" + }, + { + "type": 1, + "content": { + "json": "### Logical Disk MB/s" + }, + "customWidth": "50", + "name": "text - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "547dae05-22bf-47a5-ad44-043a23995759", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "1af979b2-3131-4771-bf02-30193138c565", + "version": "KqlParameterItem/1.0", + "name": "AggregatesLeft", + "type": 1, + "query": "print \"{Aggregates}\"", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "{ResourceType}" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "{ResourceType}" + }, + "customWidth": "50", + "name": "parameters - 14" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "8aaa181d-7182-4d9d-b74e-22f37e3acbce", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "c021b342-6bc8-4870-a88b-8ddf0b8b9cfa", + "version": "KqlParameterItem/1.0", + "name": "AggregatesRight", + "type": 1, + "query": "print \"{Aggregates}\"", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "{ResourceType}" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "{ResourceType}" + }, + "customWidth": "50", + "name": "parameters - 15" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == 'LogicalDisk' and Name == 'TransfersPerSecond'\r\n| summarize {AggregatesLeft} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceType}", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "name": "query - 16" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == 'LogicalDisk' and Name == 'BytesPerSecond'\r\n| summarize {AggregatesRight} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceType}", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "linechart" + }, + "customWidth": "50", + "name": "query - 17" + }, + { + "type": 1, + "content": { + "json": "### Max Logical Disk Used %" + }, + "customWidth": "50", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "### Bytes Sent Rate B/s" + }, + "customWidth": "50", + "name": "text - 19" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "customWidth": "50", + "name": "parameters - 20" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "f963e52a-2099-4cd3-a3ad-0fdf78f38238", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":false},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "6c5d9373-5403-44e5-b496-7155c338f958", + "version": "KqlParameterItem/1.0", + "name": "AggregatesRight", + "type": 1, + "query": "print \"{Aggregates}\"", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "{ResourceType}" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "{ResourceType}" + }, + "customWidth": "50", + "name": "parameters - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == 'LogicalDisk' and Name == 'FreeSpacePercentage'\r\n| summarize {AggregatesLeft} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 2, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceType}", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "name": "query - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == 'Network' and Name == 'WriteBytesPerSecond'\r\n| summarize {AggregatesRight} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceType}", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "name": "query - 23" + }, + { + "type": 1, + "content": { + "json": "### Bytes Received Rate B/s" + }, + "customWidth": "50", + "name": "text - 24" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "50", + "name": "text - 25" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [ + { + "id": "c0592d9a-edd4-4a69-86c0-098ac0c72cf2", + "version": "KqlParameterItem/1.0", + "name": "Aggregates", + "type": 2, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"P1st = round(percentile(Val, 1), 2)\", \"label\":\"P1st\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":false},\r\n { \"value\":\"P99th = round(percentile(Val, 99), 2)\", \"label\":\"P99th\", \"selected\":false},\r\n { \"value\":\"Min = round(min(Val), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(Val), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]", + "resourceType": "microsoft.insights/components" + }, + { + "id": "d4795fc0-c995-4975-8bc6-e515dbad00be", + "version": "KqlParameterItem/1.0", + "name": "AggregatesLeft", + "type": 1, + "query": "print \"{Aggregates}\"", + "crossComponentResources": [ + "{Computer}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "{ResourceType}" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "{ResourceType}" + }, + "customWidth": "50", + "name": "parameters - 26" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Computer}" + ], + "parameters": [], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines" + }, + "customWidth": "50", + "name": "parameters - 27" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| where Namespace == 'Network' and Name == 'ReadBytesPerSecond'\r\n| summarize {AggregatesLeft} by bin(TimeGenerated, totimespan('{grain}'))", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "Current machine is not emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceType}", + "crossComponentResources": [ + "{Computer}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "name": "query - 28" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM/settings.json new file mode 100644 index 0000000..5092c82 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Analysis for a Single VM/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance", + "author": "Microsoft", + "galleries": [ + { "type": "performance-vm", "resourceType": "microsoft.compute/virtualmachines", "categoryKey": "vmInsightsVirtualMachinesInsightsMetrics", "order": 200 }, + { "type": "insights", "resourceType": "microsoft.compute/virtualmachines", "categoryKey": "vmInsightsVirtualMachinesInsightsMetrics", "order": 200 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Azure Preview)/Performance Counters (Azure Preview).workbook b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Azure Preview)/Performance Counters (Azure Preview).workbook new file mode 100644 index 0000000..39ae7e1 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Azure Preview)/Performance Counters (Azure Preview).workbook @@ -0,0 +1,2090 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscriptions}" + ], + "parameters": [ + { + "id": "7d3239b1-19a0-44fd-a771-df82340e0d88", + "version": "KqlParameterItem/1.0", + "name": "DefaultResource", + "type": 5, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true, + "microsoft.resources/resourcegroups": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "0caf61ec-d776-4642-8553-5293060a62c7", + "version": "KqlParameterItem/1.0", + "name": "ContextFree", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{DefaultResource}\\\"\"}", + "isHiddenWhenLocked": true, + "queryType": 8, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6e82c4c1-769e-4549-bd80-b356ef999efa", + "version": "KqlParameterItem/1.0", + "name": "Selection", + "type": 1, + "query": "take 1\r\n| extend x = split ({DefaultResource:value}, '/')\r\n| project value = tostring(pack('sub', x[2], 'rg', case(x[4] != 'null', x[4], ''), 'vm', case(x[8] != 'null', x[8], '')))", + "crossComponentResources": [ + "value::selected" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "604f6d89-c6f9-4bdb-b4ca-483f56a8946c", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type in~('microsoft.compute/virtualmachines', 'microsoft.compute/virtualmachinescalesets')\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = iff(subscriptionId =~ todynamic('{Selection}').sub, true, false)", + "crossComponentResources": [ + "value::selected" + ], + "value": [ + "value::1" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "efc388e8-ac7b-4e72-8573-e97cfe370f16", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroup", + "label": "Resource groups", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type in~('microsoft.compute/virtualmachines', 'microsoft.compute/virtualmachinescalesets')\r\n| summarize Count = count() by resourceGroup\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = resourceGroup, label = resourceGroup, selected = iff(resourceGroup =~ todynamic('{Selection}').rg, true, false)\r\n| order by value asc", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "ff31cd1b-224e-42bd-8d65-f803ca13ce13", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "Virtual machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources \r\n| where resourceGroup in~({ResourceGroup}) and type in~('microsoft.compute/virtualmachines', 'microsoft.compute/virtualmachinescalesets')\r\n| project id, name, selected=false, group=iff(type =~ \"microsoft.compute/virtualmachines\", \"Virtual machines\", \"Virtual machine scale sets\")", + "crossComponentResources": [ + "{Subscriptions}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "feb5ccab-6fe6-4c5f-9161-ca0e412bd637", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "value": { + "durationMs": 86400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ], + "allowCustom": true + } + }, + { + "id": "d643672d-1bc2-497d-a5ce-20f631ee9399", + "version": "KqlParameterItem/1.0", + "name": "ResourceScope", + "type": 7, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| take 1\r\n| project x = dynamic([\"microsoft.compute/virtualmachines\", \"microsoft.compute/virtualmachinescalesets\", \"microsoft.resources/resourcegroups\", \"microsoft.resources/subscriptions\"])\r\n| mvexpand x to typeof(string)\r\n| extend jkey = 1\r\n| join kind = inner (Resources \r\n| where id in~ ({Resources})\r\n| summarize Subs = dcount(subscriptionId), resourceGroups = dcount(resourceGroup), resourceCount = count()\r\n| extend jkey = 1) on jkey\r\n| project x, label = 'x', selected = case(x in ('microsoft.compute/virtualmachinescalesets', 'microsoft.compute/virtualmachines') and resourceCount <= 5, true, x == 'microsoft.resources/resourcegroups' and resourceGroups <= 3 and resourceCount > 5, true, x == 'microsoft.resources/subscriptions' and resourceGroups > 3 and resourceCount > 5, true, false)\r\n", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "1a0a93cf-0406-40d1-80e1-572b1a8d640e", + "version": "KqlParameterItem/1.0", + "name": "TimeGrain", + "type": 2, + "isRequired": true, + "value": "15m", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"1 minute\",\r\n \"value\": \"1m\"\r\n },\r\n {\r\n \"label\": \"5 minutes\",\r\n \"value\": \"5m\"\r\n },\r\n {\r\n \"label\": \"15 minutes\",\r\n \"value\": \"15m\"\r\n },\r\n {\r\n \"label\": \"30 minutes\",\r\n \"value\": \"30m\"\r\n },\r\n {\r\n \"label\": \"1 hour\",\r\n \"value\": \"1h\"\r\n }\r\n]" + }, + { + "id": "112823d7-bf58-4604-a299-78ccc5899516", + "version": "KqlParameterItem/1.0", + "name": "LineChartQuerySnippet", + "type": 1, + "query": "print(\"bin(TimeGenerated, {TimeGrain}), ResourceName | render linechart\")", + "crossComponentResources": [ + "{Subscriptions}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "7055a395-0d53-4724-93ad-15e03d4e2ffa", + "version": "KqlParameterItem/1.0", + "name": "GridQuerySnippet", + "type": 1, + "value": "ResourceName", + "isHiddenWhenLocked": true + }, + { + "id": "9c56155c-9a7e-41db-ac56-40cabb7d7ddf", + "version": "KqlParameterItem/1.0", + "name": "TopN", + "type": 1, + "isRequired": true, + "query": "print 5", + "crossComponentResources": [ + "{Subscriptions}" + ], + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "4261aa48-5274-47a9-8642-1618c8aa7a95", + "version": "KqlParameterItem/1.0", + "name": "Mode", + "type": 2, + "isRequired": true, + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"Locked\",\r\n \"value\": \"1\"\r\n },\r\n {\r\n \"label\": \"Unlocked\",\r\n \"value\": \"0\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "
" + }, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter1", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator1", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder1", + "type": 1, + "query": "print(iff('{TrendAggregator1:label}' == 'P5th' or '{TrendAggregator1:label}' == 'P10th', 'asc', 'desc'))", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization", + "type": 2, + "isRequired": true, + "query": "datatable (value:long, Display:string, isSelected:boolean)\r\n [0, \"Line Chart\", true,\r\n 1, \"Grid\", false]", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet1", + "type": 1, + "isRequired": true, + "query": "print(iff({Visualization} == 0, \"{LineChartQuerySnippet}\", \"{GridQuerySnippet}\") )", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter2", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resources}" + ], + "value": "{\"counter\":\"AvailableMB\",\"object\":\"Memory\"}", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator2", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]", + "value": "P5th = round(percentile(Val, 5), 2)" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder2", + "type": 1, + "query": "print(iff('{TrendAggregator2:label}' == 'P5th' or '{TrendAggregator2:label}' == 'P10th', 'asc', 'desc'))", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "bf55b759-7b6a-4ea6-8040-e3e6cc2ffe25", + "version": "KqlParameterItem/1.0", + "name": "Visualization2", + "type": 2, + "isRequired": true, + "query": "datatable (value:long, Display:string, isSelected:boolean)\r\n [0, \"Line Chart\", true,\r\n 1, \"Grid\", false]", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "de7bf116-f413-457b-8c71-fb95cc6adc87", + "version": "KqlParameterItem/1.0", + "name": "Snippet2", + "type": 1, + "isRequired": true, + "query": "print(iff({Visualization2} == 0, \"{LineChartQuerySnippet}\", \"{GridQuerySnippet}\") )", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "2ce20c70-a462-4c7d-b5af-7f3b4cc27511", + "version": "KqlParameterItem/1.0", + "name": "Unit2", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter3", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resources}" + ], + "value": "{\"counter\":\"UtilizationPercentage\",\"object\":\"Processor\"}", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator3", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder3", + "type": 1, + "query": "print(iff('{TrendAggregator3:label}' == 'P5th' or '{TrendAggregator3:label}' == 'P10th', 'asc', 'desc'))", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "db1c9737-0d87-41ad-8f3c-f22c853be400", + "version": "KqlParameterItem/1.0", + "name": "Visualization3", + "type": 2, + "isRequired": true, + "query": "datatable (value:long, Display:string, isSelected:boolean)\r\n [0, \"Line Chart\", true,\r\n 1, \"Grid\", false]", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "82cef2b6-4ce0-4a64-bd64-017810211147", + "version": "KqlParameterItem/1.0", + "name": "Snippet3", + "type": 1, + "isRequired": true, + "query": "print(iff({Visualization3} == 0, \"{LineChartQuerySnippet}\", \"{GridQuerySnippet}\") )", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "def72a65-f496-4619-8fcb-85c338641907", + "version": "KqlParameterItem/1.0", + "name": "Unit3", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter4", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resources}" + ], + "value": "{\"counter\":\"BytesPerSecond\",\"object\":\"LogicalDisk\"}", + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator4", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder4", + "type": 1, + "query": "print(iff('{TrendAggregator4:label}' == 'P5th' or '{TrendAggregator4:label}' == 'P10th', 'asc', 'desc'))", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "16d42161-ad5d-4bd8-9b2a-8e834e3b8fed", + "version": "KqlParameterItem/1.0", + "name": "Visualization4", + "type": 2, + "isRequired": true, + "query": "datatable (value:long, Display:string, isSelected:boolean)\r\n [0, \"Line Chart\", true,\r\n 1, \"Grid\", false]", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "d768c009-20aa-4476-83cd-afacf4694818", + "version": "KqlParameterItem/1.0", + "name": "Snippet4", + "type": 1, + "isRequired": true, + "query": "print(iff({Visualization4} == 0, \"{LineChartQuerySnippet}\", \"{GridQuerySnippet}\") )", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "eb3e4d65-ee3c-481c-af2e-8b41e4049bf8", + "version": "KqlParameterItem/1.0", + "name": "Unit4", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 5" + }, + { + "type": 1, + "content": { + "json": "

{Counter1:label}

{TrendAggregator1:label} {TrendAggregatorOrder1} {Unit:label}

" + }, + "customWidth": "25", + "name": "text - 6" + }, + { + "type": 1, + "content": { + "json": "

{Counter2:label}

{TrendAggregator2:label} {TrendAggregatorOrder2} {Unit2:label}

" + }, + "customWidth": "25", + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "

{Counter3:label}

{TrendAggregator3:label} {TrendAggregatorOrder3} {Unit3:label}

" + }, + "customWidth": "25", + "name": "text - 8" + }, + { + "type": 1, + "content": { + "json": "

{Counter4:label}

{TrendAggregator4:label} {TrendAggregatorOrder4} {Unit4:label}

" + }, + "customWidth": "25", + "name": "text - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter1});\r\nlet cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where _ResourceId in~ ({Resources})\r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator1:value} by Computer, Name\r\n | top {TopN} by {TrendAggregator1:label} {TrendAggregatorOrder1});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator1:value}{Unit} by {Snippet1}\r\n\t\r\n", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Resources}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "25", + "name": "query - 10" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter2});\r\nlet cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where _ResourceId in~ ({Resources})\r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator2} by Computer, Name\r\n | top {TopN} by {TrendAggregator2:label} {TrendAggregatorOrder2});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator2}{Unit2} by {Snippet2}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Resources}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "25", + "name": "query - 11" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter3});\r\nlet cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where _ResourceId in~ ({Resources})\r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator3} by Computer, Name\r\n | top {TopN} by {TrendAggregator3:label} {TrendAggregatorOrder3});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator3}{Unit3} by {Snippet3}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Resources}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "25", + "name": "query - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter4});\r\nlet cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where _ResourceId in~ ({Resources})\r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator4} by Computer, Name\r\n | top {TopN} by {TrendAggregator4:label} {TrendAggregatorOrder4});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator4}{Unit4} by {Snippet4}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Resources}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "25", + "name": "query - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter5", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resources}" + ], + "value": "{\"counter\":\"FreeSpaceMB\",\"object\":\"LogicalDisk\"}", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator5", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder5", + "type": 1, + "query": "print(iff('{TrendAggregator5:label}' == 'P5th' or '{TrendAggregator5:label}' == 'P10th', 'asc', 'desc'))", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "b75e4ca5-7d71-4d29-b69e-9104934905ba", + "version": "KqlParameterItem/1.0", + "name": "Visualization5", + "type": 2, + "isRequired": true, + "query": "datatable (value:long, Display:string, isSelected:boolean)\r\n [0, \"Line Chart\", true,\r\n 1, \"Grid\", false]", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "7df7ee71-c054-4a88-b8b1-33ba6dd9d70d", + "version": "KqlParameterItem/1.0", + "name": "Snippet5", + "type": 1, + "isRequired": true, + "query": "print(iff({Visualization5} == 0, \"{LineChartQuerySnippet}\", \"{GridQuerySnippet}\") )", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "bb81032c-59e4-417f-a5e1-fc6552c3190f", + "version": "KqlParameterItem/1.0", + "name": "Unit5", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 14" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter6", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resources}" + ], + "value": "{\"counter\":\"FreeSpacePercentage\",\"object\":\"LogicalDisk\"}", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator6", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder6", + "type": 1, + "query": "print(iff('{TrendAggregator6:label}' == 'P5th' or '{TrendAggregator6:label}' == 'P10th', 'asc', 'desc'))", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "5b1ee58a-5d4d-4be8-b38c-3a8eb37a2f3e", + "version": "KqlParameterItem/1.0", + "name": "Visualization6", + "type": 2, + "isRequired": true, + "query": "datatable (value:long, Display:string, isSelected:boolean)\r\n [0, \"Line Chart\", true,\r\n 1, \"Grid\", false]", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "d931d741-2f83-4ca0-bc2b-5c0c13fe8058", + "version": "KqlParameterItem/1.0", + "name": "Snippet6", + "type": 1, + "isRequired": true, + "query": "print(iff({Visualization6} == 0, \"{LineChartQuerySnippet}\", \"{GridQuerySnippet}\") )", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "ab35d419-d8c1-45be-8885-e39a55c0648d", + "version": "KqlParameterItem/1.0", + "name": "Unit6", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 15" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter7", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resources}" + ], + "value": "{\"counter\":\"ReadBytesPerSecond\",\"object\":\"LogicalDisk\"}", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator7", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder7", + "type": 1, + "query": "print(iff('{TrendAggregator7:label}' == 'P5th' or '{TrendAggregator7:label}' == 'P10th', 'asc', 'desc'))", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "bc1291ba-dd26-4224-9b25-3a1e7b3eb024", + "version": "KqlParameterItem/1.0", + "name": "Visualization7", + "type": 2, + "isRequired": true, + "query": "datatable (value:long, Display:string, isSelected:boolean)\r\n [0, \"Line Chart\", true,\r\n 1, \"Grid\", false]", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6cc1a388-27c6-4cfe-a787-ff00cb8f4fae", + "version": "KqlParameterItem/1.0", + "name": "Snippet7", + "type": 1, + "isRequired": true, + "query": "print(iff({Visualization7} == 0, \"{LineChartQuerySnippet}\", \"{GridQuerySnippet}\") )", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "dce874fa-b71d-4a09-bcee-bd1b3f672f7f", + "version": "KqlParameterItem/1.0", + "name": "Unit7", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 16" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter8", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resources}" + ], + "value": "{\"counter\":\"ReadLatencyMs\",\"object\":\"LogicalDisk\"}", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator8", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder8", + "type": 1, + "query": "print(iff('{TrendAggregator8:label}' == 'P5th' or '{TrendAggregator8:label}' == 'P10th', 'asc', 'desc'))", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "68468652-570f-4d77-af12-a59d463d5f02", + "version": "KqlParameterItem/1.0", + "name": "Visualization8", + "type": 2, + "isRequired": true, + "query": "datatable (value:long, Display:string, isSelected:boolean)\r\n [0, \"Line Chart\", true,\r\n 1, \"Grid\", false]", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "15738505-f7e6-446e-995d-280cf70dde93", + "version": "KqlParameterItem/1.0", + "name": "Snippet8", + "type": 1, + "isRequired": true, + "query": "print(iff({Visualization8} == 0, \"{LineChartQuerySnippet}\", \"{GridQuerySnippet}\") )", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "c78d15dd-79cb-4cd2-8749-df9d97625b31", + "version": "KqlParameterItem/1.0", + "name": "Unit8", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 17" + }, + { + "type": 1, + "content": { + "json": "

{Counter5:label}

{TrendAggregator5:label} {TrendAggregatorOrder5} {Unit5:label}

" + }, + "customWidth": "25", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "

{Counter6:label}

{TrendAggregator6:label} {TrendAggregatorOrder6} {Unit6:label}

" + }, + "customWidth": "25", + "name": "text - 19" + }, + { + "type": 1, + "content": { + "json": "

{Counter7:label}

{TrendAggregator7:label} {TrendAggregatorOrder7} {Unit7:label}

" + }, + "customWidth": "25", + "name": "text - 20" + }, + { + "type": 1, + "content": { + "json": "

{Counter8:label}

{TrendAggregator8:label} {TrendAggregatorOrder8} {Unit8:label}

" + }, + "customWidth": "25", + "name": "text - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter5});\r\nlet cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where _ResourceId in~ ({Resources})\r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator5} by Computer, Name\r\n | top {TopN} by {TrendAggregator5:label} {TrendAggregatorOrder5});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator5}{Unit5} by {Snippet5}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Resources}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "25", + "name": "query - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter6});\r\nlet cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where _ResourceId in~ ({Resources})\r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator6} by Computer, Name\r\n | top {TopN} by {TrendAggregator6:label} {TrendAggregatorOrder6});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator6}{Unit6} by {Snippet6}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Resources}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "25", + "name": "query - 23" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter7});\r\nlet cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where _ResourceId in~ ({Resources})\r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator7} by Computer, Name\r\n | top {TopN} by {TrendAggregator7:label} {TrendAggregatorOrder7});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator7}{Unit7} by {Snippet7}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Resources}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "25", + "name": "query - 24" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter8});\r\nlet cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where _ResourceId in~ ({Resources})\r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator8} by Computer, Name\r\n | top {TopN} by {TrendAggregator8:label} {TrendAggregatorOrder8});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator8}{Unit8} by {Snippet8}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Resources}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "25", + "name": "query - 25" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "eba3fa3a-2f37-4dfb-80be-c19b680f31b0", + "version": "KqlParameterItem/1.0", + "name": "Counter9", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resources}" + ], + "value": "{\"counter\":\"ReadsPerSecond\",\"object\":\"LogicalDisk\"}", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "f3137f3e-9ff1-4a7f-b503-5b2b87431713", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator9", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "01a4cf96-e12f-4d2a-9cf3-25da44a6ebe4", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder9", + "type": 1, + "query": "print(iff('{TrendAggregator9:label}' == 'P5th' or '{TrendAggregator9:label}' == 'P10th', 'asc', 'desc'))", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "2ad65081-725a-4bc6-9198-9ab653dbb1aa", + "version": "KqlParameterItem/1.0", + "name": "Visualization9", + "type": 2, + "isRequired": true, + "query": "datatable (value:long, Display:string, isSelected:boolean)\r\n [0, \"Line Chart\", true,\r\n 1, \"Grid\", false]", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "d08e406f-4725-45f5-a5ec-1aa0b6ae4afd", + "version": "KqlParameterItem/1.0", + "name": "Snippet9", + "type": 1, + "isRequired": true, + "query": "print(iff({Visualization5} == 0, \"{LineChartQuerySnippet}\", \"{GridQuerySnippet}\") )", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "31e0e738-54eb-4fab-92b7-ae000819fc7d", + "version": "KqlParameterItem/1.0", + "name": "Unit9", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 26" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1ad", + "version": "KqlParameterItem/1.0", + "name": "Counter10", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resources}" + ], + "value": "{\"counter\":\"WritesPerSecond\",\"object\":\"LogicalDisk\"}", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9dd", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator10", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1dd", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder10", + "type": 1, + "query": "print(iff('{TrendAggregator10:label}' == 'P5th' or '{TrendAggregator10:label}' == 'P10th', 'asc', 'desc'))", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "5b1ee58a-5d4d-4be8-b38c-3a8eb37a2f3d", + "version": "KqlParameterItem/1.0", + "name": "Visualization10", + "type": 2, + "isRequired": true, + "query": "datatable (value:long, Display:string, isSelected:boolean)\r\n [0, \"Line Chart\", true,\r\n 1, \"Grid\", false]", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "d931d741-2f83-4ca0-bc2b-5c0c13fe805d", + "version": "KqlParameterItem/1.0", + "name": "Snippet10", + "type": 1, + "isRequired": true, + "query": "print(iff({Visualization6} == 0, \"{LineChartQuerySnippet}\", \"{GridQuerySnippet}\") )", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "089bb686-434d-43ea-a958-c344763cef7f", + "version": "KqlParameterItem/1.0", + "name": "Unit10", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 27" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1ad", + "version": "KqlParameterItem/1.0", + "name": "Counter11", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resources}" + ], + "value": "{\"counter\":\"ReadBytesPerSecond\",\"object\":\"Network\"}", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9dd", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator11", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1dd", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder11", + "type": 1, + "query": "print(iff('{TrendAggregator11:label}' == 'P5th' or '{TrendAggregator11:label}' == 'P10th', 'asc', 'desc'))", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "bc1291ba-dd26-4224-9b25-3a1e7b3eb02d", + "version": "KqlParameterItem/1.0", + "name": "Visualization11", + "type": 2, + "isRequired": true, + "query": "datatable (value:long, Display:string, isSelected:boolean)\r\n [0, \"Line Chart\", true,\r\n 1, \"Grid\", false]", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6cc1a388-27c6-4cfe-a787-ff00cb8f4fad", + "version": "KqlParameterItem/1.0", + "name": "Snippet11", + "type": 1, + "isRequired": true, + "query": "print(iff({Visualization7} == 0, \"{LineChartQuerySnippet}\", \"{GridQuerySnippet}\") )", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "77870d8a-bf65-4405-a722-fdf0826106ac", + "version": "KqlParameterItem/1.0", + "name": "Unit11", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 28" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Resources}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1ad", + "version": "KqlParameterItem/1.0", + "name": "Counter12", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Resources}" + ], + "value": "{\"counter\":\"WriteBytesPerSecond\",\"object\":\"Network\"}", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9dd", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator12", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1dd", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder12", + "type": 1, + "query": "print(iff('{TrendAggregator12:label}' == 'P5th' or '{TrendAggregator12:label}' == 'P10th', 'asc', 'desc'))", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "68468652-570f-4d77-af12-a59d463d5f0d", + "version": "KqlParameterItem/1.0", + "name": "Visualization12", + "type": 2, + "isRequired": true, + "query": "datatable (value:long, Display:string, isSelected:boolean)\r\n [0, \"Line Chart\", true,\r\n 1, \"Grid\", false]", + "crossComponentResources": [ + "{Resources}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "15738505-f7e6-446e-995d-280cf70dde9d", + "version": "KqlParameterItem/1.0", + "name": "Snippet12", + "type": 1, + "isRequired": true, + "query": "print(iff({Visualization8} == 0, \"{LineChartQuerySnippet}\", \"{GridQuerySnippet}\") )", + "crossComponentResources": [ + "{Resources}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + { + "id": "beb8493f-b5db-4bb5-865b-c8a4fed0ca0c", + "version": "KqlParameterItem/1.0", + "name": "Unit12", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/subscriptions" + }, + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 29" + }, + { + "type": 1, + "content": { + "json": "

{Counter9:label}

{TrendAggregator9:label} {TrendAggregatorOrder9} {Unit9:label}

" + }, + "customWidth": "25", + "name": "text - 30" + }, + { + "type": 1, + "content": { + "json": "

{Counter10:label}

{TrendAggregator10:label} {TrendAggregatorOrder10} {Unit10:label}

" + }, + "customWidth": "25", + "name": "text - 31" + }, + { + "type": 1, + "content": { + "json": "

{Counter11:label}

{TrendAggregator11:label} {TrendAggregatorOrder11} {Unit11:label}

" + }, + "customWidth": "25", + "name": "text - 32" + }, + { + "type": 1, + "content": { + "json": "

{Counter12:label}

{TrendAggregator12:label} {TrendAggregatorOrder12} {Unit12:label}

" + }, + "customWidth": "25", + "name": "text - 33" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter9});\r\nlet cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where _ResourceId in~ ({Resources})\r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator9} by Computer, Name\r\n | top {TopN} by {TrendAggregator9:label} {TrendAggregatorOrder9});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator9}{Unit9} by {Snippet9}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Resources}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "25", + "name": "query - 34" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter10});\r\nlet cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where _ResourceId in~ ({Resources})\r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator10} by Computer, Name\r\n | top {TopN} by {TrendAggregator10:label} {TrendAggregatorOrder10});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator10}{Unit10} by {Snippet10}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Resources}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "25", + "name": "query - 35" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter11});\r\nlet cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where _ResourceId in~ ({Resources})\r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator11} by Computer, Name\r\n | top {TopN} by {TrendAggregator11:label} {TrendAggregatorOrder11});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator11}{Unit11} by {Snippet11}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Resources}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "25", + "name": "query - 36" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter12});\r\nlet cpuSummary=totable(InsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where _ResourceId in~ ({Resources})\r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator12} by Computer, Name\r\n | top {TopN} by {TrendAggregator12:label} {TrendAggregatorOrder12});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator12}{Unit12} by {Snippet12}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "{ResourceScope}", + "crossComponentResources": [ + "{Resources}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "25", + "name": "query - 37" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Azure Preview)/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Azure Preview)/settings.json new file mode 100644 index 0000000..95e22eb --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Azure Preview)/settings.json @@ -0,0 +1,10 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance Counters (Azure Preview)", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 200 }, + { "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorVirtualMachines", "order": 100 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Perf)/Performance Counters (Perf).workbook b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Perf)/Performance Counters (Perf).workbook new file mode 100644 index 0000000..d184800 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Perf)/Performance Counters (Perf).workbook @@ -0,0 +1,2347 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "80a15801-7442-49f3-a82f-6e55849ec7fb", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "90119d28-e9c1-4c0d-8715-1f601d337f5c", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "7da21a07-10f4-4455-9105-c37132dcee0d", + "version": "KqlParameterItem/1.0", + "name": "ContextSelection", + "type": 1, + "query": "where strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7324c544-2fd2-4d61-b529-481a0f5fd286", + "version": "KqlParameterItem/1.0", + "name": "HybridMode", + "type": 1, + "value": "true", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ContextSelection is empty ), result = 'false'", + "criteriaContext": { + "leftOperand": "ContextSelection", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ] + }, + { + "id": "2942e38e-232e-4d89-9ada-12f9863b3c5b", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "summarize by subscriptionId\r\n| project strcat('/subscriptions/', subscriptionId), selected = iff({HybridMode} == true, iff(subscriptionId == todynamic('{ContextSelection}').sub, true, false), iff(strcat('/subscriptions/', subscriptionId) == '{DefaultSubscription}', true, false))", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2bc1e5fc-cc2d-4eb5-bead-5f7d96664dec", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| order by tolower(name) asc\r\n| extend Row = row_number()\r\n| project id, selected = iff({HybridMode} == 'true', iff(id == todynamic('{ContextSelection}').ws, true, false), Row == 1)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d0f502a4-2f0f-4d3d-af70-5198d41f3e0c", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "1a0a93cf-0406-40d1-80e1-572b1a8d640e", + "version": "KqlParameterItem/1.0", + "name": "TimeGrain", + "type": 2, + "isRequired": true, + "value": "15m", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"1 minute\",\r\n \"value\": \"1m\"\r\n },\r\n {\r\n \"label\": \"5 minutes\",\r\n \"value\": \"5m\"\r\n },\r\n {\r\n \"label\": \"15 minutes\",\r\n \"value\": \"15m\"\r\n },\r\n {\r\n \"label\": \"30 minutes\",\r\n \"value\": \"30m\"\r\n },\r\n {\r\n \"label\": \"1 hour\",\r\n \"value\": \"1h\"\r\n }\r\n]" + }, + { + "id": "112823d7-bf58-4604-a299-78ccc5899516", + "version": "KqlParameterItem/1.0", + "name": "LineChartQuerySnippet", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"bin(TimeGenerated, {TimeGrain}), ResourceName | render linechart\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "7055a395-0d53-4724-93ad-15e03d4e2ffa", + "version": "KqlParameterItem/1.0", + "name": "GridQuerySnippet", + "type": 1, + "value": "ResourceName", + "isHiddenWhenLocked": true + }, + { + "id": "0b83d1f7-f49b-4dea-8727-ac6d03f51b2a", + "version": "KqlParameterItem/1.0", + "name": "ComputerNameContains", + "type": 1, + "value": "" + }, + { + "id": "8e436ee8-ba56-4fe5-8a2b-46f77ad405ee", + "version": "KqlParameterItem/1.0", + "name": "CustomComputerQuery", + "type": 1, + "query": "let computerFilter = iff('{ComputerNameContains}' != '', \"| where Computer contains '{ComputerNameContains}'\", \"\");\r\nprint(computerFilter)", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "3cd4c13e-bb7a-4b71-952e-ebf5779fba6a", + "version": "KqlParameterItem/1.0", + "name": "Computers", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n{CustomComputerQuery}\r\n| summarize by Computer\r\n| project Value = Computer, Display = Computer, isSelected = false\r\n| order by Display asc\r\n| union (datatable(Value:string, Display:string, isSelected:boolean)['*', 'All',true])", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "28d4b81f-7dab-4e3b-abe4-a1f82e9d5561", + "version": "KqlParameterItem/1.0", + "name": "ComputerFilter", + "type": 1, + "value": null, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Computers contains '*'), result = CustomComputerQuery", + "criteriaContext": { + "leftOperand": "Computers", + "operator": "contains", + "rightValType": "static", + "rightVal": "*", + "resultValType": "param", + "resultVal": "CustomComputerQuery" + } + }, + { + "condition": "else result = '| where Computer in ({Computers})'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where Computer in ({Computers})" + } + } + ] + }, + { + "id": "9c56155c-9a7e-41db-ac56-40cabb7d7ddf", + "version": "KqlParameterItem/1.0", + "name": "TopN", + "type": 1, + "isRequired": true, + "value": "5" + }, + { + "id": "4261aa48-5274-47a9-8642-1618c8aa7a95", + "version": "KqlParameterItem/1.0", + "name": "Mode", + "type": 2, + "isRequired": true, + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"Locked\",\r\n \"value\": \"1\"\r\n },\r\n {\r\n \"label\": \"Unlocked\",\r\n \"value\": \"0\"\r\n }\r\n]" + }, + { + "id": "48e2b8b9-e618-480c-80e6-5cf1cee85ee9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "label": "Not Onboarded", + "type": 1, + "query": "Perf\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "
" + }, + "name": "text - 1" + }, + { + "type": 1, + "content": { + "json": "⚠ No performance counters were detected in the selected workspace for the specified time period (`{TimeRange:label}`). Either try a broader time range, select a different workspace, or onboard virtual machines to the selected workspace `{Workspaces:label}`.\r\n\r\nIf you choose to onboard virtual machines to workspace `{Workspaces:label}`, follow the instruction in the following link: [Azure Monitor for VMs (preview)](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview)." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": "1" + }, + "name": "text - 38" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "isRequired": true, + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| summarize by CounterName, ObjectName, CounterText = CounterName\r\n| order by ObjectName asc, CounterText asc\r\n| project Counter = pack('counter', CounterName, 'object', ObjectName), CounterText, group = ObjectName", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": "{\"counter\":\"% Processor Time\",\"object\":\"Process\"}" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder1", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet1", + "type": 1, + "isRequired": true, + "value": "bin(TimeGenerated, 15m), ResourceName | render linechart", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "2c9b88ba-fba2-41cf-b10d-8369f2b00377", + "version": "KqlParameterItem/1.0", + "name": "Counter1", + "type": 1, + "value": "{\"counter\":\"% Processor Time\",\"object\":\"Process\"}", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "else result = Counter", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Counter" + } + } + ] + }, + { + "id": "028cfd79-33d7-4d82-be4d-348d17488ca1", + "version": "KqlParameterItem/1.0", + "name": "CounterLabel1", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Counter:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "41eb7c98-b679-42b9-8454-432a4b8fff48", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorValue1", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "5c8cbc8c-1776-42fd-9291-2fc4f0e0558b", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorLabel1", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter2", + "type": 2, + "isRequired": true, + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| summarize by CounterName, ObjectName, CounterText = CounterName\r\n| order by ObjectName asc, CounterText asc\r\n| project Counter = pack('counter', CounterName, 'object', ObjectName), CounterText, group = ObjectName", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": "{\"counter\":\"% Available Memory\",\"object\":\"Memory\"}" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator2", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder2", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator2 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator2", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator2 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator2", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization2", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet2", + "type": 1, + "isRequired": true, + "value": "bin(TimeGenerated, 15m), ResourceName | render linechart", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization2 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization2", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "028cfd79-33d7-4d82-be4d-348d17488ca1", + "version": "KqlParameterItem/1.0", + "name": "CounterLabel2", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Counter2:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "41eb7c98-b679-42b9-8454-432a4b8fff48", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorValue2", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator2}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "5c8cbc8c-1776-42fd-9291-2fc4f0e0558b", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorLabel2", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator2:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit2", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter3", + "type": 2, + "isRequired": true, + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| summarize by CounterName, ObjectName, CounterText = CounterName\r\n| order by ObjectName asc, CounterText asc\r\n| project Counter = pack('counter', CounterName, 'object', ObjectName), CounterText, group = ObjectName", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": "{\"counter\":\"Bytes Sent/sec\",\"object\":\"Network Adapter\"}" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator3", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder3", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator3 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator3", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator3 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator3", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization3", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet3", + "type": 1, + "isRequired": true, + "value": "bin(TimeGenerated, 15m), ResourceName | render linechart", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization3 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization3", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "028cfd79-33d7-4d82-be4d-348d17488ca1", + "version": "KqlParameterItem/1.0", + "name": "CounterLabel3", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Counter3:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "41eb7c98-b679-42b9-8454-432a4b8fff48", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorValue3", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator3}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "5c8cbc8c-1776-42fd-9291-2fc4f0e0558b", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorLabel3", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator3:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit3", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter4", + "type": 2, + "isRequired": true, + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| summarize by CounterName, ObjectName, CounterText = CounterName\r\n| order by ObjectName asc, CounterText asc\r\n| project Counter = pack('counter', CounterName, 'object', ObjectName), CounterText, group = ObjectName", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": "{\"counter\":\"Bytes Received/sec\",\"object\":\"Network Adapter\"}" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator4", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder4", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator4 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator4", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator4 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator4", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization4", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet4", + "type": 1, + "isRequired": true, + "value": "bin(TimeGenerated, 15m), ResourceName | render linechart", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization4 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization4", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "028cfd79-33d7-4d82-be4d-348d17488ca1", + "version": "KqlParameterItem/1.0", + "name": "CounterLabel4", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Counter4:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "41eb7c98-b679-42b9-8454-432a4b8fff48", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorValue4", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator4}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "5c8cbc8c-1776-42fd-9291-2fc4f0e0558b", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorLabel4", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator4:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit4", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 5" + }, + { + "type": 1, + "content": { + "json": "

{CounterLabel1}

{TrendAggregatorLabel1} {TrendAggregatorOrder1} {Unit:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 6" + }, + { + "type": 1, + "content": { + "json": "

{Counter2:label}

{TrendAggregator2:label} {TrendAggregatorOrder2} {Unit2:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "

{Counter3:label}

{TrendAggregator3:label} {TrendAggregatorOrder3} {Unit3:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 8" + }, + { + "type": 1, + "content": { + "json": "

{Counter4:label}

{TrendAggregator4:label} {TrendAggregatorOrder4} {Unit4:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter1});\r\nlet cpuSummary=totable(Perf\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregatorValue1} by Computer, CounterName\r\n | top {TopN} by {TrendAggregatorLabel1} {TrendAggregatorOrder1});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregatorValue1}{Unit} by {Snippet1}\r\n\t\r\n", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 10" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter2});\r\nlet cpuSummary=totable(Perf\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator2} by Computer, CounterName\r\n | top {TopN} by {TrendAggregator2:label} {TrendAggregatorOrder2});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator2}{Unit2} by {Snippet2}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 11" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter3});\r\nlet cpuSummary=totable(Perf\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator3} by Computer, CounterName\r\n | top {TopN} by {TrendAggregator3:label} {TrendAggregatorOrder3});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator3}{Unit3} by {Snippet3}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter4});\r\nlet cpuSummary=totable(Perf\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator4} by Computer, CounterName\r\n | top {TopN} by {TrendAggregator4:label} {TrendAggregatorOrder4});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator4}{Unit4} by {Snippet4}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter5", + "type": 2, + "isRequired": true, + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| summarize by CounterName, ObjectName, CounterText = CounterName\r\n| order by ObjectName asc, CounterText asc\r\n| project Counter = pack('counter', CounterName, 'object', ObjectName), CounterText, group = ObjectName", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": "{\"counter\":\"% Used Space\",\"object\":\"Logical Disk\"}" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator5", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder5", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator5 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator5", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator5 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator5", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization5", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet5", + "type": 1, + "isRequired": true, + "value": "bin(TimeGenerated, 15m), ResourceName | render linechart", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization5 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization5", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "028cfd79-33d7-4d82-be4d-348d17488ca1", + "version": "KqlParameterItem/1.0", + "name": "CounterLabel5", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Counter5:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "41eb7c98-b679-42b9-8454-432a4b8fff48", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorValue5", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator5}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "5c8cbc8c-1776-42fd-9291-2fc4f0e0558b", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorLabel5", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator5:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit5", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 14" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter6", + "type": 2, + "isRequired": true, + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| summarize by CounterName, ObjectName, CounterText = CounterName\r\n| order by ObjectName asc, CounterText asc\r\n| project Counter = pack('counter', CounterName, 'object', ObjectName), CounterText, group = ObjectName", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": "{\"counter\":\"% Free Space\",\"object\":\"LogicalDisk\"}" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator6", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder6", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator6 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator6", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator6 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator6", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization6", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet6", + "type": 1, + "isRequired": true, + "value": "bin(TimeGenerated, 15m), ResourceName | render linechart", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization6 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization6", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "028cfd79-33d7-4d82-be4d-348d17488ca1", + "version": "KqlParameterItem/1.0", + "name": "CounterLabel6", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Counter6:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "41eb7c98-b679-42b9-8454-432a4b8fff48", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorValue6", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator6}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "5c8cbc8c-1776-42fd-9291-2fc4f0e0558b", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorLabel6", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator6:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit6", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 15" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter7", + "type": 2, + "isRequired": true, + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| summarize by CounterName, ObjectName, CounterText = CounterName\r\n| order by ObjectName asc, CounterText asc\r\n| project Counter = pack('counter', CounterName, 'object', ObjectName), CounterText, group = ObjectName", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": "{\"counter\":\"Disk Write Bytes/sec\",\"object\":\"Logical Disk\"}" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator7", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder7", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator7 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator7", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator7 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator7", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization7", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet7", + "type": 1, + "isRequired": true, + "value": "bin(TimeGenerated, 15m), ResourceName | render linechart", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization7 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization7", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "028cfd79-33d7-4d82-be4d-348d17488ca1", + "version": "KqlParameterItem/1.0", + "name": "CounterLabel7", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Counter7:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "41eb7c98-b679-42b9-8454-432a4b8fff48", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorValue7", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator7}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "5c8cbc8c-1776-42fd-9291-2fc4f0e0558b", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorLabel7", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator7:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit7", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 16" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter8", + "type": 2, + "isRequired": true, + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| summarize by CounterName, ObjectName, CounterText = CounterName\r\n| order by ObjectName asc, CounterText asc\r\n| project Counter = pack('counter', CounterName, 'object', ObjectName), CounterText, group = ObjectName", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": "{\"counter\":\"Disk Read Bytes/sec\",\"object\":\"Logical Disk\"}" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator8", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(CounterValue, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(CounterValue, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(CounterValue, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(CounterValue, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(CounterValue, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(CounterValue, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder8", + "type": 1, + "value": "desc", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator8 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator8", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator8 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator8", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization8", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet8", + "type": 1, + "isRequired": true, + "value": "bin(TimeGenerated, 15m), ResourceName | render linechart", + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization8 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization8", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "028cfd79-33d7-4d82-be4d-348d17488ca1", + "version": "KqlParameterItem/1.0", + "name": "CounterLabel8", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{Counter8:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "41eb7c98-b679-42b9-8454-432a4b8fff48", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorValue8", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator8}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "5c8cbc8c-1776-42fd-9291-2fc4f0e0558b", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorLabel8", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"{TrendAggregator8:label}\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit8", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 17" + }, + { + "type": 1, + "content": { + "json": "

{Counter5:label}

{TrendAggregator5:label} {TrendAggregatorOrder5} {Unit5:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "

{Counter6:label}

{TrendAggregator6:label} {TrendAggregatorOrder6} {Unit6:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 19" + }, + { + "type": 1, + "content": { + "json": "

{Counter7:label}

{TrendAggregator7:label} {TrendAggregatorOrder7} {Unit7:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 20" + }, + { + "type": 1, + "content": { + "json": "

{Counter8:label}

{TrendAggregator8:label} {TrendAggregatorOrder8} {Unit8:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter5});\r\nlet cpuSummary=totable(Perf\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator5} by Computer, CounterName\r\n | top {TopN} by {TrendAggregator5:label} {TrendAggregatorOrder5});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator5}{Unit5} by {Snippet5}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter6});\r\nlet cpuSummary=totable(Perf\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator6} by Computer, CounterName\r\n | top {TopN} by {TrendAggregator6:label} {TrendAggregatorOrder6});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator6}{Unit6} by {Snippet6}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 23" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter7});\r\nlet cpuSummary=totable(Perf\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator7} by Computer, CounterName\r\n | top {TopN} by {TrendAggregator7:label} {TrendAggregatorOrder7});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator7}{Unit7} by {Snippet7}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 24" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter8});\r\nlet cpuSummary=totable(Perf\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator8} by Computer, CounterName\r\n | top {TopN} by {TrendAggregator8:label} {TrendAggregatorOrder8});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nPerf\r\n | where TimeGenerated {TimeRange}\r\n | where ObjectName == metric.object and CounterName == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator8}{Unit8} by {Snippet8}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 25" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Perf)/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Perf)/settings.json new file mode 100644 index 0000000..0a7a2ba --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Perf)/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance Counters", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "categoryKey": "vmInsightsVirtualMachinesPerf", "order": 200 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Preview)/Performance Counters (Preview).workbook b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Preview)/Performance Counters (Preview).workbook new file mode 100644 index 0000000..cb12c2c --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Preview)/Performance Counters (Preview).workbook @@ -0,0 +1,2138 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "2c4ef86b-c7cb-434e-9051-291940cb51bf", + "version": "KqlParameterItem/1.0", + "name": "Blank", + "type": 1, + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "80a15801-7442-49f3-a82f-6e55849ec7fb", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "90119d28-e9c1-4c0d-8715-1f601d337f5c", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "7da21a07-10f4-4455-9105-c37132dcee0d", + "version": "KqlParameterItem/1.0", + "name": "ContextSelection", + "type": 1, + "query": "where strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7324c544-2fd2-4d61-b529-481a0f5fd286", + "version": "KqlParameterItem/1.0", + "name": "HybridMode", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ContextSelection is empty ), result = 'false'", + "criteriaContext": { + "leftOperand": "ContextSelection", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ] + }, + { + "id": "2942e38e-232e-4d89-9ada-12f9863b3c5b", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "summarize by subscriptionId\r\n| project strcat('/subscriptions/', subscriptionId), selected = iff({HybridMode} == true, iff(subscriptionId == todynamic('{ContextSelection}').sub, true, false), iff(strcat('/subscriptions/', subscriptionId) == '{DefaultSubscription}', true, false))", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2bc1e5fc-cc2d-4eb5-bead-5f7d96664dec", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| order by tolower(name) asc\r\n| extend Row = row_number()\r\n| project id, selected = iff({HybridMode} == 'true', iff(id == todynamic('{ContextSelection}').ws, true, false), Row == 1)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d0f502a4-2f0f-4d3d-af70-5198d41f3e0c", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "1a0a93cf-0406-40d1-80e1-572b1a8d640e", + "version": "KqlParameterItem/1.0", + "name": "TimeGrain", + "type": 2, + "isRequired": true, + "value": "15m", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"1 minute\",\r\n \"value\": \"1m\"\r\n },\r\n {\r\n \"label\": \"5 minutes\",\r\n \"value\": \"5m\"\r\n },\r\n {\r\n \"label\": \"15 minutes\",\r\n \"value\": \"15m\"\r\n },\r\n {\r\n \"label\": \"30 minutes\",\r\n \"value\": \"30m\"\r\n },\r\n {\r\n \"label\": \"1 hour\",\r\n \"value\": \"1h\"\r\n }\r\n]", + "label": "Time Grain" + }, + { + "id": "112823d7-bf58-4604-a299-78ccc5899516", + "version": "KqlParameterItem/1.0", + "name": "LineChartQuerySnippet", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"bin(TimeGenerated, {TimeGrain}), ResourceName | render linechart\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "7055a395-0d53-4724-93ad-15e03d4e2ffa", + "version": "KqlParameterItem/1.0", + "name": "GridQuerySnippet", + "type": 1, + "value": "ResourceName", + "isHiddenWhenLocked": true + }, + { + "id": "0b83d1f7-f49b-4dea-8727-ac6d03f51b2a", + "version": "KqlParameterItem/1.0", + "name": "ComputerNameContains", + "type": 1, + "value": "", + "label": "Computer Name Contains" + }, + { + "id": "8e436ee8-ba56-4fe5-8a2b-46f77ad405ee", + "version": "KqlParameterItem/1.0", + "name": "CustomComputerQuery", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ComputerNameContains is not empty ), result = '| where Computer contains '{ComputerNameContains}''", + "criteriaContext": { + "leftOperand": "ComputerNameContains", + "operator": "isNotNull", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where Computer contains '{ComputerNameContains}'" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ] + }, + { + "id": "3cd4c13e-bb7a-4b71-952e-ebf5779fba6a", + "version": "KqlParameterItem/1.0", + "name": "Computers", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n{CustomComputerQuery}\r\n| summarize by Computer\r\n| project Value = Computer, Display = Computer, isSelected = false\r\n| order by Display asc\r\n| union (datatable(Value:string, Display:string, isSelected:boolean)['*', 'All',true])", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "28d4b81f-7dab-4e3b-abe4-a1f82e9d5561", + "version": "KqlParameterItem/1.0", + "name": "ComputerFilter", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Computers contains '*'), result = CustomComputerQuery", + "criteriaContext": { + "leftOperand": "Computers", + "operator": "contains", + "rightValType": "static", + "rightVal": "*", + "resultValType": "param", + "resultVal": "CustomComputerQuery" + } + }, + { + "condition": "else result = '| where Computer in ({Computers})'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where Computer in ({Computers})" + } + } + ] + }, + { + "id": "9c56155c-9a7e-41db-ac56-40cabb7d7ddf", + "version": "KqlParameterItem/1.0", + "name": "TopN", + "label": "Top N", + "type": 1, + "isRequired": true, + "value": "5" + }, + { + "id": "4261aa48-5274-47a9-8642-1618c8aa7a95", + "version": "KqlParameterItem/1.0", + "name": "Mode", + "type": 2, + "isRequired": true, + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"Locked\",\r\n \"value\": \"1\"\r\n },\r\n {\r\n \"label\": \"Unlocked\",\r\n \"value\": \"0\"\r\n }\r\n]" + }, + { + "id": "48e2b8b9-e618-480c-80e6-5cf1cee85ee9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "label": "Not Onboarded", + "type": 1, + "query": "InsightsMetrics\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "
" + }, + "name": "text - 1" + }, + { + "type": 1, + "content": { + "json": "⚠ No performance counters were detected in the selected workspace for the specified time period (`{TimeRange:label}`). Either try a broader time range, select a different workspace, or onboard virtual machines to the selected workspace `{Workspaces:label}`.\r\n\r\nIf you choose to onboard virtual machines to workspace `{Workspaces:label}`, follow the instruction in the following link: [Azure Monitor for VMs (preview)](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview)." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": "1" + }, + "name": "text - 38" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter1", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator1", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder1", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator1 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator1", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator1 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator1", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet1", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter2", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator2", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder2", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator2 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator2", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator2 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator2", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization2", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet2", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization2 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization2", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit2", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter3", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator3", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder3", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator3 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator3", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator3 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator3", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization3", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet3", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization3 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization3", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit3", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter4", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator4", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder4", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator4 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator4", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator4 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator4", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization4", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet4", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization4 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization4", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit4", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 5" + }, + { + "type": 1, + "content": { + "json": "

{Counter1:label}

{TrendAggregator1:label} {TrendAggregatorOrder1} {Unit:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 6" + }, + { + "type": 1, + "content": { + "json": "

{Counter2:label}

{TrendAggregator2:label} {TrendAggregatorOrder2} {Unit2:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "

{Counter3:label}

{TrendAggregator3:label} {TrendAggregatorOrder3} {Unit3:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 8" + }, + { + "type": 1, + "content": { + "json": "

{Counter4:label}

{TrendAggregator4:label} {TrendAggregatorOrder4} {Unit4:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter1});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator1:value} by Computer, Name\r\n | top {TopN} by {TrendAggregator1:label} {TrendAggregatorOrder1});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator1:value}{Unit} by {Snippet1}\r\n\t\r\n", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 10" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter2});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator2} by Computer, Name\r\n | top {TopN} by {TrendAggregator2:label} {TrendAggregatorOrder2});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator2}{Unit2} by {Snippet2}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 11" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter3});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator3} by Computer, Name\r\n | top {TopN} by {TrendAggregator3:label} {TrendAggregatorOrder3});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator3}{Unit3} by {Snippet3}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter4});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator4} by Computer, Name\r\n | top {TopN} by {TrendAggregator4:label} {TrendAggregatorOrder4});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator4}{Unit4} by {Snippet4}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter5", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator5", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder5", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator5 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator5", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator5 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator5", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization5", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet5", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization5 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization5", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit5", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 14" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter6", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator6", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder6", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator6 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator6", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator6 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator6", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization6", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet6", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization6 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization6", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit6", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 15" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter7", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator7", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder7", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator7 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator7", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator7 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator7", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization7", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet7", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization7 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization7", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit7", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 16" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter8", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator8", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder8", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator8 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator8", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator8 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator8", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization8", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet8", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization8 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization8", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit8", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 17" + }, + { + "type": 1, + "content": { + "json": "

{Counter5:label}

{TrendAggregator5:label} {TrendAggregatorOrder5} {Unit5:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "

{Counter6:label}

{TrendAggregator6:label} {TrendAggregatorOrder6} {Unit6:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 19" + }, + { + "type": 1, + "content": { + "json": "

{Counter7:label}

{TrendAggregator7:label} {TrendAggregatorOrder7} {Unit7:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 20" + }, + { + "type": 1, + "content": { + "json": "

{Counter8:label}

{TrendAggregator8:label} {TrendAggregatorOrder8} {Unit8:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter5});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator5} by Computer, Name\r\n | top {TopN} by {TrendAggregator5:label} {TrendAggregatorOrder5});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator5}{Unit5} by {Snippet5}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter6});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator6} by Computer, Name\r\n | top {TopN} by {TrendAggregator6:label} {TrendAggregatorOrder6});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator6}{Unit6} by {Snippet6}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 23" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter7});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator7} by Computer, Name\r\n | top {TopN} by {TrendAggregator7:label} {TrendAggregatorOrder7});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator7}{Unit7} by {Snippet7}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 24" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter8});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator8} by Computer, Name\r\n | top {TopN} by {TrendAggregator8:label} {TrendAggregatorOrder8});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator8}{Unit8} by {Snippet8}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 25" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Preview)/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Preview)/settings.json new file mode 100644 index 0000000..f3a72e4 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters (Preview)/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance Counters (Preview)", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 200 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Counters/Performance Counters.workbook b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters/Performance Counters.workbook new file mode 100644 index 0000000..cb12c2c --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters/Performance Counters.workbook @@ -0,0 +1,2138 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "2c4ef86b-c7cb-434e-9051-291940cb51bf", + "version": "KqlParameterItem/1.0", + "name": "Blank", + "type": 1, + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange" + }, + { + "id": "80a15801-7442-49f3-a82f-6e55849ec7fb", + "version": "KqlParameterItem/1.0", + "name": "DefaultWorkspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "90119d28-e9c1-4c0d-8715-1f601d337f5c", + "version": "KqlParameterItem/1.0", + "name": "DefaultSubscription", + "type": 5, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/subscriptions": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "7da21a07-10f4-4455-9105-c37132dcee0d", + "version": "KqlParameterItem/1.0", + "name": "ContextSelection", + "type": 1, + "query": "where strcat(\"'\", id, \"'\") =~ \"{DefaultWorkspace:value}\"\r\n| project value = tostring(pack('sub', subscriptionId, 'rg', resourceGroup, 'ws', id))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7324c544-2fd2-4d61-b529-481a0f5fd286", + "version": "KqlParameterItem/1.0", + "name": "HybridMode", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ContextSelection is empty ), result = 'false'", + "criteriaContext": { + "leftOperand": "ContextSelection", + "operator": "is Empty", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + }, + { + "condition": "else result = 'true'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "true" + } + } + ] + }, + { + "id": "2942e38e-232e-4d89-9ada-12f9863b3c5b", + "version": "KqlParameterItem/1.0", + "name": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "summarize by subscriptionId\r\n| project strcat('/subscriptions/', subscriptionId), selected = iff({HybridMode} == true, iff(subscriptionId == todynamic('{ContextSelection}').sub, true, false), iff(strcat('/subscriptions/', subscriptionId) == '{DefaultSubscription}', true, false))", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2bc1e5fc-cc2d-4eb5-bead-5f7d96664dec", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| summarize by id, name\r\n| order by tolower(name) asc\r\n| extend Row = row_number()\r\n| project id, selected = iff({HybridMode} == 'true', iff(id == todynamic('{ContextSelection}').ws, true, false), Row == 1)", + "crossComponentResources": [ + "{Subscriptions}" + ], + "typeSettings": { + "limitSelectTo": 5, + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d0f502a4-2f0f-4d3d-af70-5198d41f3e0c", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-02-20T19:49:16.686Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-02-20T19:49:16.687Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-02-20T19:49:16.688Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "1a0a93cf-0406-40d1-80e1-572b1a8d640e", + "version": "KqlParameterItem/1.0", + "name": "TimeGrain", + "type": 2, + "isRequired": true, + "value": "15m", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"1 minute\",\r\n \"value\": \"1m\"\r\n },\r\n {\r\n \"label\": \"5 minutes\",\r\n \"value\": \"5m\"\r\n },\r\n {\r\n \"label\": \"15 minutes\",\r\n \"value\": \"15m\"\r\n },\r\n {\r\n \"label\": \"30 minutes\",\r\n \"value\": \"30m\"\r\n },\r\n {\r\n \"label\": \"1 hour\",\r\n \"value\": \"1h\"\r\n }\r\n]", + "label": "Time Grain" + }, + { + "id": "112823d7-bf58-4604-a299-78ccc5899516", + "version": "KqlParameterItem/1.0", + "name": "LineChartQuerySnippet", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"\\\"bin(TimeGenerated, {TimeGrain}), ResourceName | render linechart\\\"\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "queryType": 8 + }, + { + "id": "7055a395-0d53-4724-93ad-15e03d4e2ffa", + "version": "KqlParameterItem/1.0", + "name": "GridQuerySnippet", + "type": 1, + "value": "ResourceName", + "isHiddenWhenLocked": true + }, + { + "id": "0b83d1f7-f49b-4dea-8727-ac6d03f51b2a", + "version": "KqlParameterItem/1.0", + "name": "ComputerNameContains", + "type": 1, + "value": "", + "label": "Computer Name Contains" + }, + { + "id": "8e436ee8-ba56-4fe5-8a2b-46f77ad405ee", + "version": "KqlParameterItem/1.0", + "name": "CustomComputerQuery", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (ComputerNameContains is not empty ), result = '| where Computer contains '{ComputerNameContains}''", + "criteriaContext": { + "leftOperand": "ComputerNameContains", + "operator": "isNotNull", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where Computer contains '{ComputerNameContains}'" + } + }, + { + "condition": "else result = Blank", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "Blank" + } + } + ] + }, + { + "id": "3cd4c13e-bb7a-4b71-952e-ebf5779fba6a", + "version": "KqlParameterItem/1.0", + "name": "Computers", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where TimeGenerated {TimeRange}\r\n{CustomComputerQuery}\r\n| summarize by Computer\r\n| project Value = Computer, Display = Computer, isSelected = false\r\n| order by Display asc\r\n| union (datatable(Value:string, Display:string, isSelected:boolean)['*', 'All',true])", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "28d4b81f-7dab-4e3b-abe4-a1f82e9d5561", + "version": "KqlParameterItem/1.0", + "name": "ComputerFilter", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Computers contains '*'), result = CustomComputerQuery", + "criteriaContext": { + "leftOperand": "Computers", + "operator": "contains", + "rightValType": "static", + "rightVal": "*", + "resultValType": "param", + "resultVal": "CustomComputerQuery" + } + }, + { + "condition": "else result = '| where Computer in ({Computers})'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "| where Computer in ({Computers})" + } + } + ] + }, + { + "id": "9c56155c-9a7e-41db-ac56-40cabb7d7ddf", + "version": "KqlParameterItem/1.0", + "name": "TopN", + "label": "Top N", + "type": 1, + "isRequired": true, + "value": "5" + }, + { + "id": "4261aa48-5274-47a9-8642-1618c8aa7a95", + "version": "KqlParameterItem/1.0", + "name": "Mode", + "type": 2, + "isRequired": true, + "value": "1", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"Locked\",\r\n \"value\": \"1\"\r\n },\r\n {\r\n \"label\": \"Unlocked\",\r\n \"value\": \"0\"\r\n }\r\n]" + }, + { + "id": "48e2b8b9-e618-480c-80e6-5cf1cee85ee9", + "version": "KqlParameterItem/1.0", + "name": "Test", + "label": "Not Onboarded", + "type": 1, + "query": "InsightsMetrics\r\n| take 1\r\n| summarize count()", + "crossComponentResources": [ + "{Workspaces}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "
" + }, + "name": "text - 1" + }, + { + "type": 1, + "content": { + "json": "⚠ No performance counters were detected in the selected workspace for the specified time period (`{TimeRange:label}`). Either try a broader time range, select a different workspace, or onboard virtual machines to the selected workspace `{Workspaces:label}`.\r\n\r\nIf you choose to onboard virtual machines to workspace `{Workspaces:label}`, follow the instruction in the following link: [Azure Monitor for VMs (preview)](https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview)." + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isNotEqualTo", + "value": "1" + }, + "name": "text - 38" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter1", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator1", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder1", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator1 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator1", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator1 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator1", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet1", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter2", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator2", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder2", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator2 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator2", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator2 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator2", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization2", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet2", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization2 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization2", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit2", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter3", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator3", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder3", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator3 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator3", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator3 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator3", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization3", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet3", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization3 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization3", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit3", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter4", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator4", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder4", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator4 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator4", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator4 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator4", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization4", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet4", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization4 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization4", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit4", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 5" + }, + { + "type": 1, + "content": { + "json": "

{Counter1:label}

{TrendAggregator1:label} {TrendAggregatorOrder1} {Unit:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 6" + }, + { + "type": 1, + "content": { + "json": "

{Counter2:label}

{TrendAggregator2:label} {TrendAggregatorOrder2} {Unit2:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "

{Counter3:label}

{TrendAggregator3:label} {TrendAggregatorOrder3} {Unit3:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 8" + }, + { + "type": 1, + "content": { + "json": "

{Counter4:label}

{TrendAggregator4:label} {TrendAggregatorOrder4} {Unit4:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter1});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator1:value} by Computer, Name\r\n | top {TopN} by {TrendAggregator1:label} {TrendAggregatorOrder1});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator1:value}{Unit} by {Snippet1}\r\n\t\r\n", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 10" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter2});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator2} by Computer, Name\r\n | top {TopN} by {TrendAggregator2:label} {TrendAggregatorOrder2});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator2}{Unit2} by {Snippet2}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 11" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter3});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator3} by Computer, Name\r\n | top {TopN} by {TrendAggregator3:label} {TrendAggregatorOrder3});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator3}{Unit3} by {Snippet3}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter4});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator4} by Computer, Name\r\n | top {TopN} by {TrendAggregator4:label} {TrendAggregatorOrder4});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator4}{Unit4} by {Snippet4}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 13" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter5", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator5", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder5", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator5 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator5", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator5 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator5", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization5", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet5", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization5 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization5", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit5", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 14" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter6", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator6", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder6", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator6 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator6", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator6 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator6", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization6", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet6", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization6 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization6", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit6", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 15" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter7", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator7", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder7", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator7 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator7", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator7 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator7", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization7", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet7", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization7 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization7", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit7", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 16" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "aa2368fc-ad30-4608-b96a-72abf7b1e1af", + "version": "KqlParameterItem/1.0", + "name": "Counter8", + "label": "Counter", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\r\n| summarize by Name, Namespace, CounterText = Name\r\n| order by Namespace asc, CounterText asc\r\n| project Counter = pack('counter', Name, 'object', Namespace), CounterText, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "6a7306ea-247f-46ca-abca-501911f9e9d3", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregator8", + "label": "Trend Aggregator", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(Val), 2)\", \"label\":\"Average\", \"selected\":false},\r\n { \"value\":\"P5th = round(percentile(Val, 5), 2)\", \"label\":\"P5th\", \"selected\":false},\r\n { \"value\":\"P10th = round(percentile(Val, 10), 2)\", \"label\":\"P10th\", \"selected\":false},\r\n { \"value\":\"P50th = round(percentile(Val, 50), 2)\", \"label\":\"P50th\", \"selected\":false},\r\n { \"value\":\"P80th = round(percentile(Val, 80), 2)\", \"label\":\"P80th\", \"selected\":false},\r\n { \"value\":\"P90th = round(percentile(Val, 90), 2)\", \"label\":\"P90th\", \"selected\":false},\r\n { \"value\":\"P95th = round(percentile(Val, 95), 2)\", \"label\":\"P95th\", \"selected\":true} \r\n]" + }, + { + "id": "0327f26e-cdde-4b48-b512-6c35f06ad1d0", + "version": "KqlParameterItem/1.0", + "name": "TrendAggregatorOrder8", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (TrendAggregator8 contains 'P5th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator8", + "operator": "contains", + "rightValType": "static", + "rightVal": "P5th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "if (TrendAggregator8 contains 'P10th'), result = 'asc'", + "criteriaContext": { + "leftOperand": "TrendAggregator8", + "operator": "contains", + "rightValType": "static", + "rightVal": "P10th", + "resultValType": "static", + "resultVal": "asc" + } + }, + { + "condition": "else result = 'desc'", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "desc" + } + } + ] + }, + { + "id": "d026cf36-d22e-4f92-a577-94220726ba3f", + "version": "KqlParameterItem/1.0", + "name": "Visualization8", + "label": "Visualization", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"value\": \"0\",\r\n \"label\": \"Line Chart\",\r\n \"selected\": true\r\n },\r\n {\r\n \"value\": \"1\",\r\n \"label\": \"Grid\",\r\n \"selected\": false\r\n }\r\n]" + }, + { + "id": "a9ac011f-176f-4c31-b82e-139aba93a426", + "version": "KqlParameterItem/1.0", + "name": "Snippet8", + "type": 1, + "isRequired": true, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "condition": "if (Visualization8 == '0'), result = LineChartQuerySnippet", + "criteriaContext": { + "leftOperand": "Visualization8", + "operator": "==", + "rightValType": "static", + "rightVal": "0", + "resultValType": "param", + "resultVal": "LineChartQuerySnippet" + } + }, + { + "condition": "else result = GridQuerySnippet", + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "param", + "resultVal": "GridQuerySnippet" + } + } + ] + }, + { + "id": "26106dfe-4e33-4c7c-b4b6-2eff5cc76476", + "version": "KqlParameterItem/1.0", + "name": "Unit8", + "type": 2, + "value": null, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n {\r\n \"label\": \"B -> MB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"B -> GB\",\r\n \"value\": \"/1024/1024/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> GB\",\r\n \"value\": \"/1024\"\r\n },\r\n {\r\n \"label\": \"MB -> TB\",\r\n \"value\": \"/1024/1024\"\r\n },\r\n {\r\n \"label\": \"b -> Mb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"b -> Gb\",\r\n \"value\": \"/1000/1000/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Gb\",\r\n \"value\": \"/1000\"\r\n },\r\n {\r\n \"label\": \"Mb -> Tb\",\r\n \"value\": \"/1000/1000\"\r\n },\r\n {\r\n \"label\": \"s -> ms\",\r\n \"value\": \"*1000\"\r\n },\r\n {\r\n \"label\": \"ms -> s\",\r\n \"value\": \"/1000\"\r\n }\r\n]" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibilities": [ + { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + } + ], + "conditionalVisibility": { + "parameterName": "Mode", + "comparison": "isEqualTo", + "value": "0" + }, + "customWidth": "25", + "name": "parameters - 17" + }, + { + "type": 1, + "content": { + "json": "

{Counter5:label}

{TrendAggregator5:label} {TrendAggregatorOrder5} {Unit5:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 18" + }, + { + "type": 1, + "content": { + "json": "

{Counter6:label}

{TrendAggregator6:label} {TrendAggregatorOrder6} {Unit6:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 19" + }, + { + "type": 1, + "content": { + "json": "

{Counter7:label}

{TrendAggregator7:label} {TrendAggregatorOrder7} {Unit7:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 20" + }, + { + "type": 1, + "content": { + "json": "

{Counter8:label}

{TrendAggregator8:label} {TrendAggregatorOrder8} {Unit8:label}

" + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "text - 21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter5});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator5} by Computer, Name\r\n | top {TopN} by {TrendAggregator5:label} {TrendAggregatorOrder5});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator5}{Unit5} by {Snippet5}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter6});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator6} by Computer, Name\r\n | top {TopN} by {TrendAggregator6:label} {TrendAggregatorOrder6});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator6}{Unit6} by {Snippet6}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 23" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter7});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator7} by Computer, Name\r\n | top {TopN} by {TrendAggregator7:label} {TrendAggregatorOrder7});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator7}{Unit7} by {Snippet7}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 24" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter8});\r\nlet cpuSummary=totable(InsightsMetrics\r\n {ComputerFilter}\r\n | where TimeGenerated {TimeRange} \r\n | where Namespace == metric.object and Name == metric.counter\r\n | summarize hint.shufflekey=Computer {TrendAggregator8} by Computer, Name\r\n | top {TopN} by {TrendAggregator8:label} {TrendAggregatorOrder8});\r\nlet computerList=(cpuSummary \r\n | project Computer);\r\nlet EmptyNodeIdentityAndProps = datatable(Computer:string, NodeId:string, NodeProps:dynamic, Priority: long) [];\r\nlet OmsNodeIdentityAndProps = computerList\r\n | extend NodeId = Computer\r\n | extend Priority = 1\r\n | extend NodeProps = pack('type', 'StandAloneNode', 'name', Computer);\r\nlet ServiceMapNodeIdentityAndProps = ServiceMapComputer_CL\r\n | where TimeGenerated {TimeRange}\r\n | where Computer in (computerList)\r\n | summarize arg_max(TimeGenerated, *) by Computer\r\n | extend Computer = ComputerName_s, AzureCloudServiceNodeIdentity = iif(isnotempty(columnifexists('AzureCloudServiceName_s', '')), strcat(columnifexists('AzureCloudServiceInstanceId_s', ''), '|', columnifexists('AzureCloudServiceDeployment_g', '')), ''), AzureScaleSetNodeIdentity = iif(isnotempty(columnifexists('AzureVmScaleSetName_s', '')), strcat(columnifexists('AzureVmScaleSetInstanceId_s', ''), '|', columnifexists('AzureVmScaleSetDeployment_g', '')), ''), ComputerProps = pack('type', 'StandAloneNode', 'name', ComputerName_s, 'mappingResourceId', ResourceId, 'subscriptionId', AzureSubscriptionId_g, 'resourceGroup', AzureResourceGroup_s, 'azureResourceId', columnifexists('AzureResourceId_s', '')), AzureCloudServiceNodeProps = pack('type', 'AzureCloudServiceNode', 'cloudServiceInstanceId', columnifexists('AzureCloudServiceInstanceId_s', ''), 'cloudServiceRoleName', columnifexists('AzureCloudServiceRoleName_s', ''), 'cloudServiceDeploymentId', columnifexists('AzureCloudServiceDeployment_g', ''), 'cloudServiceName', columnifexists('AzureCloudServiceName_s', ''), 'mappingResourceId', ResourceId), AzureScaleSetNodeProps = pack('type', 'AzureScaleSetNode', 'scaleSetInstanceId', columnifexists('AzureName_s', ''), 'vmScaleSetDeploymentId', columnifexists('AzureVmScaleSetDeployment_g', ''), 'vmScaleSetName', columnifexists('AzureVmScaleSetName_s', ''), 'serviceFabricClusterName', columnifexists('AzureServiceFabricClusterName_s', ''), 'vmScaleSetResourceId', columnifexists('AzureVmScaleSetResourceId_s', ''), 'resourceGroupName', columnifexists('AzureResourceGroup_s', ''), 'subscriptionId', columnifexists('AzureSubscriptionId_g', ''), 'mappingResourceId', ResourceId)| project Computer, NodeId = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeIdentity, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeIdentity, Computer), NodeProps = case(isnotempty(AzureCloudServiceNodeIdentity), AzureCloudServiceNodeProps, isnotempty(AzureScaleSetNodeIdentity), AzureScaleSetNodeProps, ComputerProps), Priority = 2;\r\nlet NodeIdentityAndProps = union kind=inner isfuzzy = true EmptyNodeIdentityAndProps, OmsNodeIdentityAndProps, ServiceMapNodeIdentityAndProps \r\n | summarize arg_max(Priority, *) by Computer; \r\nlet NodeIdentityAndPropsMin = NodeIdentityAndProps\r\n | extend Kind = iff(NodeProps.type == \"StandAloneNode\", iff(NodeProps.azureResourceId == \"\", \"Non-Azure Virtual Machine\", \"Azure Virtual Machine\"), NodeProps.type), \r\n ResourceId = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.vmScaleSetResourceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceDeploymentId, Computer)),\r\n ResourceName = iff(NodeProps.type == \"AzureScaleSetNode\", NodeProps.scaleSetInstanceId, \r\n iff(NodeProps.type == \"AzureCloudServiceNode\", NodeProps.cloudServiceInstanceId, Computer))\r\n | project Computer, Kind, ResourceId, ResourceName;\r\nInsightsMetrics\r\n | where TimeGenerated {TimeRange}\r\n | where Namespace == metric.object and Name == metric.counter\r\n | where Computer in (computerList)\r\n | join kind=leftouter (NodeIdentityAndPropsMin) on Computer\r\n | summarize {TrendAggregator8}{Unit8} by {Snippet8}", + "size": 0, + "aggregation": 3, + "showAnnotations": true, + "noDataMessage": "No computers are emitting data for this performance counter.", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Computer", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "value", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "conditionalVisibility": { + "parameterName": "Test", + "comparison": "isEqualTo", + "value": "1" + }, + "customWidth": "25", + "name": "query - 25" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Performance Counters/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters/settings.json new file mode 100644 index 0000000..0cf857d --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Performance Counters/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Performance Counters", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "categoryKey": "vmInsightsVirtualMachinesInsightsMetrics", "order": 200 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Resource Monitor/Resource Monitor.workbook b/Virtual Machines - Performance Analysis/Workbooks/Resource Monitor/Resource Monitor.workbook new file mode 100644 index 0000000..46c16f6 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Resource Monitor/Resource Monitor.workbook @@ -0,0 +1,881 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "💠 Only the first query is turned on, turn on `RunQuery` on the other metrics to run the respective query." + }, + "conditionalVisibility": null, + "name": "text - 17" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "2781694c-ace8-4cc0-b861-26f56a957d0d", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "timeContextFromParameter": null + }, + { + "id": "150bdd2a-8e6e-44ac-b5d0-f3fcf96dc3b9", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000 + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2019-02-21T21:55:19.829Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2019-02-21T21:55:19.829Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2019-02-21T21:55:19.829Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2019-02-21T21:55:19.829Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2019-02-21T21:55:19.829Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2019-02-21T21:55:19.829Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2019-02-21T21:55:19.829Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2019-02-21T21:55:19.829Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2019-02-21T21:55:19.830Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2019-02-21T21:55:19.830Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2019-02-21T21:55:19.830Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2019-02-21T21:55:19.830Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2019-02-21T21:55:19.830Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2019-02-21T21:55:19.830Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "timeContextFromParameter": null + }, + { + "id": "93e85e8c-6c21-4c4d-a0d9-5ee94465b5cc", + "version": "KqlParameterItem/1.0", + "name": "ComputerNameContains", + "type": 1, + "isRequired": false, + "isHiddenWhenLocked": false, + "timeContextFromParameter": null, + "value": "" + }, + { + "id": "4eb8116a-ccd0-4973-a555-8ac5780fa652", + "version": "KqlParameterItem/1.0", + "name": "Computers", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| where Computer contains '{ComputerNameContains}'\r\n| distinct Computer", + "crossComponentResources": [ + "{Workspace}" + ], + "value": [ + "value::all" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "timeContextFromParameter": null, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "86d652c1-935f-43cd-aa81-dcd59b4c03de", + "version": "KqlParameterItem/1.0", + "name": "ComputerFilter", + "type": 1, + "isRequired": true, + "query": "let computerFilter = iff('*' in ({Computers}), \"| where Computer contains '{ComputerNameContains}'\", \"| where Computer in ({Computers})\");\r\nprint(computerFilter)", + "crossComponentResources": [ + "{Workspace}" + ], + "isHiddenWhenLocked": true, + "timeContextFromParameter": null, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": null, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "## CPU" + }, + "conditionalVisibility": null, + "name": "text - 1" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "6d65fdf3-1e3f-4924-8511-465bcb003d7d", + "version": "KqlParameterItem/1.0", + "name": "ShowHelp", + "type": 2, + "isRequired": true, + "value": "0", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": \"1\", \"label\": \"Yes\" },\r\n { \"value\": \"0\", \"label\": \"No\"}\r\n]", + "timeContextFromParameter": null + }, + { + "id": "40039c8a-2b3d-4f6b-9443-81ce51372220", + "version": "KqlParameterItem/1.0", + "name": "RunQuery", + "type": 2, + "isRequired": true, + "value": "1", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": \"1\", \"label\": \"Yes\" },\r\n { \"value\": \"0\", \"label\": \"No\"}\r\n]", + "timeContextFromParameter": null + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": null, + "name": "parameters - 12" + }, + { + "type": 1, + "content": { + "json": "⚠ *Only processes from Windows VMs are shown*\r\n\r\n**Counters**\r\n- PerfMon Windows (Process/% Processor Time, Process/% User Time, Processor/% Processor Time, Processor/% User Time)\r\n- PerfMon Linux (Process/Pct Privileged Time, Process/Pct User Time, Processor/% Processor Time, Processor/% User Time, Processor/% Privileged Time)\r\n- ServiceMap (ServiceMapComputer_CL)" + }, + "conditionalVisibility": { + "parameterName": "ShowHelp", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "text - 13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let filters = Perf {ComputerFilter} | where \"{RunQuery:value}\" == \"1\" | where TimeGenerated {TimeRange};\r\nlet ptime = filters | where ObjectName == 'Process' and CounterName == '% Processor Time' | where InstanceName != '_Total' and InstanceName != 'Idle';\r\nlet utime = filters | where ObjectName == 'Process' and CounterName == '% User Time' | where InstanceName != '_Total' and InstanceName != 'Idle';\r\nlet ctime = filters | where ObjectName == 'Processor' and CounterName == '% Processor Time' | where InstanceName == '_Total';\r\nlet cutime = filters | where ObjectName == 'Processor' and CounterName == '% User Time' | where InstanceName == '_Total';\r\nlet cores = ServiceMapComputer_CL | distinct Computer, Cpus_d;\r\nlet ccomps = ctime | summarize CPU=avg(CounterValue) by Computer | project CPU, Name=strcat('💻 ', Computer), Key=Computer, ParentKey='', Computer;\r\nlet ucomps = cutime | summarize UserTime=avg(CounterValue) by Computer | project UserTime, Key=Computer;\r\nlet comps = ccomps | join hint.shufflekey=Key kind=leftouter ucomps on Key | project CPU, Name, Key, ParentKey, Computer, UserTime;\r\nlet pprocs = ptime | summarize CPU=avg(CounterValue) by Computer, InstanceName | project CPU, Name=strcat('🎫 ', InstanceName), ParentKey=Computer, Key=strcat(Computer, '-', InstanceName), Computer, Process=InstanceName;\r\nlet uprocs = utime | summarize UserTime=avg(CounterValue) by Computer, InstanceName | project UserTime, Key=strcat(Computer, '-', InstanceName), Process=InstanceName;\r\nlet procs = pprocs | join hint.shufflekey=Key kind=leftouter uprocs on Key | project CPU, Name, ParentKey, Key, Computer, UserTime, Process;\r\nlet table = comps | union procs;\r\ntable\r\n| join hint.strategy=shuffle kind=leftouter cores on Computer\r\n| project Name, Key, ParentKey, CPU, CPU_cores = CPU / Cpus_d, CPU_user = (UserTime / 100) * CPU, CPU_user_cores = (UserTime / 100) * (CPU / Cpus_d), UserTime, Cores = Cpus_d, Process\r\n| order by CPU desc", + "size": 0, + "exportDefaultValue": "{\"ParentKey\":\"\", \"Process\":\"\"}", + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Key", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ParentKey", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "CPU", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "CPU_cores", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "turquoise", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "CPU_user", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "lightBlue", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "CPU_user_cores", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "purple", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "UserTime", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Cores", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalUserTime", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "percent" + } + } + }, + { + "columnMatch": "Process", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "hierarchySettings": { + "idColumn": "Key", + "parentColumn": "ParentKey", + "treeType": 0, + "expanderColumn": "Name" + } + } + }, + "conditionalVisibility": null, + "showPin": true, + "name": "query - 2" + }, + { + "type": 1, + "content": { + "json": "## Disk" + }, + "conditionalVisibility": null, + "name": "text - 4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "80fbb524-2de3-4eec-8667-35d6d673a33b", + "version": "KqlParameterItem/1.0", + "name": "ShowHelp", + "type": 2, + "isRequired": true, + "value": "0", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": \"1\", \"label\": \"Yes\" },\r\n { \"value\": \"0\", \"label\": \"No\"}\r\n]", + "timeContextFromParameter": null + }, + { + "id": "b3c5bdd5-503c-4e67-b1a6-4ecfbac8cebf", + "version": "KqlParameterItem/1.0", + "name": "RunQuery", + "type": 2, + "isRequired": true, + "value": "0", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": \"1\", \"label\": \"Yes\" },\r\n { \"value\": \"0\", \"label\": \"No\"}\r\n]", + "timeContextFromParameter": null + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": null, + "name": "parameters - 13" + }, + { + "type": 1, + "content": { + "json": "⚠ *Only Windows VMs are shown*\r\n⚠ *Computer stats aggregated over processes, not per computer*\r\n\r\n**Counters**\r\n- PerfMon Windows (Process/IO Read Bytes/sec, Process/IO Write Bytes/sec, Process/IO Read Operations/sec, Process/IO Write Operations/sec)" + }, + "conditionalVisibility": { + "parameterName": "ShowHelp", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "text - 14" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let disk = Perf | where \"{RunQuery:value}\" == \"1\" | where ObjectName == 'Process' {ComputerFilter} and InstanceName != '_Total' and InstanceName != 'Idle' | where TimeGenerated {TimeRange};\r\nlet readc = disk | where CounterName == 'IO Read Bytes/sec' | summarize ReadBytes=sum(CounterValue) by Computer;\r\nlet readp = disk | where CounterName == 'IO Read Bytes/sec' | summarize ReadBytes=avg(CounterValue) by Computer, InstanceName;\r\nlet writec = disk | where CounterName == 'IO Write Bytes/sec' | summarize WriteBytes=sum(CounterValue) by Computer;\r\nlet writep = disk | where CounterName == 'IO Write Bytes/sec' | summarize WriteBytes=avg(CounterValue) by Computer, InstanceName;\r\nlet ropsc = disk | where CounterName == 'IO Read Operations/sec' | summarize ReadOps=sum(CounterValue) by Computer;\r\nlet ropsp = disk | where CounterName == 'IO Read Operations/sec' | summarize ReadOps=avg(CounterValue) by Computer, InstanceName;\r\nlet wopsc = disk | where CounterName == 'IO Write Operations/sec' | summarize WriteOps=sum(CounterValue) by Computer;\r\nlet wopsp = disk | where CounterName == 'IO Write Operations/sec' | summarize WriteOps=avg(CounterValue) by Computer, InstanceName;\r\nlet comp = readc | join kind=leftouter writec on Computer | join kind=leftouter ropsc on Computer | join kind=leftouter wopsc on Computer | project Name=strcat('💻 ', Computer), Key=Computer, ReadBytes, WriteBytes, TotalBytes = ReadBytes + WriteBytes, ReadOps, WriteOps, TotalOps = ReadOps + WriteOps, ParentKey='';\r\nlet proc = readp | join kind=leftouter writep on Computer, InstanceName | join kind=leftouter ropsp on Computer, InstanceName | join kind=leftouter wopsp on Computer, InstanceName | project Name=strcat('🎫 ', InstanceName), ParentKey=Computer, ReadBytes, WriteBytes, TotalBytes = ReadBytes + WriteBytes, ReadOps, WriteOps, TotalOps = ReadOps + WriteOps, Key=strcat(Computer, '-', InstanceName);\r\ncomp\r\n| union proc\r\n| order by TotalBytes desc, TotalOps desc", + "size": 0, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Key", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ReadBytes", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "WriteBytes", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalBytes", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "grayBlue", + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "ReadOps", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "turquoise", + "showIcon": true + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "WriteOps", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TotalOps", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "gray", + "showIcon": true + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "ParentKey", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "hierarchySettings": { + "idColumn": "Key", + "parentColumn": "ParentKey", + "treeType": 0, + "expanderColumn": "Name", + "expandTopLevel": false + } + } + }, + "conditionalVisibility": null, + "showPin": true, + "name": "query - 5" + }, + { + "type": 1, + "content": { + "json": "## Network" + }, + "conditionalVisibility": null, + "name": "text - 7" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "1ae04b51-fa65-4cb0-9298-43f3341abf82", + "version": "KqlParameterItem/1.0", + "name": "ShowHelp", + "type": 2, + "isRequired": true, + "value": "0", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": \"1\", \"label\": \"Yes\" },\r\n { \"value\": \"0\", \"label\": \"No\"}\r\n]", + "timeContextFromParameter": null + }, + { + "id": "d42ba498-6c6a-4f4d-8752-930c460dc682", + "version": "KqlParameterItem/1.0", + "name": "RunQuery", + "type": 2, + "isRequired": true, + "value": "0", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": \"1\", \"label\": \"Yes\" },\r\n { \"value\": \"0\", \"label\": \"No\"}\r\n]", + "timeContextFromParameter": null + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": null, + "name": "parameters - 15" + }, + { + "type": 1, + "content": { + "json": "⚠ *Computer stats aggregated over processes, not per computer*\r\n\r\n**Counters**\r\n- ServiceMap (VMConnection)" + }, + "conditionalVisibility": { + "parameterName": "ShowHelp", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "text - 16" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let network = VMConnection {ComputerFilter} | where \"{RunQuery:value}\" == \"1\" | where TimeGenerated {TimeRange};\r\nlet rxc = network | summarize RX=avg(BytesReceived) by Computer;\r\nlet rxp = network | summarize RX=avg(BytesReceived) by Computer, ProcessName;\r\nlet txc = network | summarize TX=avg(BytesSent) by Computer;\r\nlet txp = network | summarize TX=avg(BytesSent) by Computer, ProcessName;\r\nlet tlc = network | summarize Total=avg(BytesReceived) + avg(BytesSent) by Computer;\r\nlet tlp = network | summarize Total=avg(BytesReceived) + avg(BytesSent) by Computer, ProcessName;\r\nlet comp = rxc | join hint.shufflekey=Computer txc on Computer | join tlc on Computer | project Name=strcat('💻 ', Computer), RX, TX, Total, Key=Computer, ParentKey='';\r\nlet proc = rxp | join hint.shufflekey=Computer txp on Computer, ProcessName | join tlp on Computer, ProcessName | project Name=strcat('🎫 ', ProcessName), RX, TX, Total, Key=strcat(Computer, '-', ProcessName), ParentKey=Computer;\r\ncomp\r\n| union proc\r\n| order by Total desc", + "size": 0, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "RX", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "TX", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Total", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Key", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ParentKey", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "hierarchySettings": { + "idColumn": "Key", + "parentColumn": "ParentKey", + "treeType": 0, + "expanderColumn": "Name" + } + } + }, + "conditionalVisibility": null, + "showPin": true, + "name": "query - 8" + }, + { + "type": 1, + "content": { + "json": "## Memory" + }, + "conditionalVisibility": null, + "name": "text - 10" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "471e58b7-da7a-4004-a038-4202025a9c87", + "version": "KqlParameterItem/1.0", + "name": "ShowHelp", + "type": 2, + "isRequired": true, + "value": "0", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": \"1\", \"label\": \"Yes\" },\r\n { \"value\": \"0\", \"label\": \"No\"}\r\n]", + "timeContextFromParameter": null + }, + { + "id": "121af5d2-4d7a-45d3-a75f-de677366240e", + "version": "KqlParameterItem/1.0", + "name": "RunQuery", + "type": 2, + "isRequired": true, + "value": "0", + "isHiddenWhenLocked": false, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": \"1\", \"label\": \"Yes\" },\r\n { \"value\": \"0\", \"label\": \"No\"}\r\n]", + "timeContextFromParameter": null + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": null, + "name": "parameters - 15" + }, + { + "type": 1, + "content": { + "json": "⚠ *Computer stats aggregated over processes, not per computer*\r\n\r\n**Counters**\r\n- PerfMon Windows (Process/Private Bytes)\r\n- PerfMon Linux (Process/Used Mmeory)" + }, + "conditionalVisibility": { + "parameterName": "ShowHelp", + "comparison": "isEqualTo", + "value": "1" + }, + "name": "text - 16" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let mem = Perf {ComputerFilter} | where \"{RunQuery:value}\" == \"1\" | where TimeGenerated {TimeRange} | where ObjectName == 'Process' and CounterName == 'Private Bytes' or CounterName == 'Used Memory' and InstanceName != '_Total' and InstanceName != 'Idle';\r\nlet memc = mem | summarize Memory=sum(CounterValue) by Computer;\r\nlet memp = mem | summarize Memory=avg(CounterValue) by Computer, InstanceName;\r\nlet comp = memc | project Name=strcat('💻 ', Computer), Key=Computer, Memory;\r\nlet proc = memp | project Name=strcat('🎫 ', InstanceName), Key=strcat(Computer, '-', InstanceName), ParentKey=Computer, Memory;\r\ncomp\r\n| union proc\r\n| order by Memory desc", + "size": 0, + "showAnalytics": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Key", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Memory", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "ParentKey", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "hierarchySettings": { + "idColumn": "Key", + "parentColumn": "ParentKey", + "treeType": 0, + "expanderColumn": "Name" + } + } + }, + "conditionalVisibility": null, + "showPin": true, + "name": "query - 11" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/Resource Monitor/settings.json b/Virtual Machines - Performance Analysis/Workbooks/Resource Monitor/settings.json new file mode 100644 index 0000000..28bbe26 --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/Resource Monitor/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name": "Resource Monitor (preview)", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "vm-insights", "resourceType": "Azure Monitor", "order": 200 } + ] +} diff --git a/Virtual Machines - Performance Analysis/Workbooks/categoryResources.json b/Virtual Machines - Performance Analysis/Workbooks/categoryResources.json new file mode 100644 index 0000000..fc5658d --- /dev/null +++ b/Virtual Machines - Performance Analysis/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Performance Analysis", "description": "Look for common issues with your VM via metrics", "order": 200} +} diff --git a/Virtual Machines/Alerts/README b/Virtual Machines/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Virtual Machines/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Virtual Machines/Queries/README b/Virtual Machines/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Virtual Machines/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Virtual Machines/Workbooks/At-scale Metrics/Key Metrics.workbook b/Virtual Machines/Workbooks/At-scale Metrics/Key Metrics.workbook new file mode 100644 index 0000000..fb85fb5 --- /dev/null +++ b/Virtual Machines/Workbooks/At-scale Metrics/Key Metrics.workbook @@ -0,0 +1,1023 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "1ca69445-60fc-4806-b43d-ac7e6aad630a", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.compute/virtualmachines'\r\n\t| summarize Count = count() by subscriptionId\r\n\t| order by Count desc\r\n\t| extend Rank = row_number()\r\n\t| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachines", + "label": "Virtual Machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.compute/virtualmachines'\n\t| order by name asc\n\t| extend Rank = row_number()\n\t| project value = id, label = id, selected = Rank <= 25", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 3600000 + }, + "label": "Time Range" + }, + { + "id": "83eda9a9-8850-4fce-ad6b-aeb230f6471c", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "where type == 'microsoft.compute/virtualmachines' \r\n| summarize Selected = countif(id in ({VirtualMachines:value})), Total = count()\r\n| extend Selected = iff(Selected > 200, 200, Selected)\r\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "Parameter block" + }, + { + "type": 1, + "content": { + "json": "{Message}\r\n_Virtual machines_" + }, + "name": "Resource count", + "styleSettings": { + "margin": "20px 0 20px 0" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link", + "workbookContext": {}, + "templateRunContext": {}, + "alertRuleContext": {} + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Key metrics", + "subTarget": "Details", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Regions", + "subTarget": "Regions", + "style": "link", + "workbookContext": {}, + "templateRunContext": {}, + "alertRuleContext": {} + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Resource health", + "subTarget": "Health", + "style": "link" + } + ] + }, + "name": "Tabs" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": -3, + "resourceIds": [ + "{VirtualMachines}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Percentage CPU", + "aggregation": 4 + } + ], + "title": "CPU utilization of virtual machines", + "mapSettings": { + "locInfo": "AzureResource", + "locInfoColumn": "Name", + "sizeSettings": "Name", + "sizeAggregation": "Count", + "legendMetric": "microsoft.compute/virtualmachines--Percentage CPU", + "legendAggregation": "Max", + "itemColorSettings": { + "nodeColorField": "microsoft.compute/virtualmachines--Percentage CPU", + "colorAggregation": "Max", + "type": "heatmap", + "heatmapPalette": "greenRed", + "heatmapMin": 30, + "heatmapMax": 80 + }, + "numberFormatSettings": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "graphSettings": { + "type": 2, + "topContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": false + } + }, + "centerContent": { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU", + "formatter": 12, + "formatOptions": { + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Virtual Machines/Virtual machine details", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.compute/virtualmachines", + "locationSource": "default" + } + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + "hivesContent": { + "columnMatch": "Subscription", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + "nodeIdField": "Name", + "nodeSize": null, + "staticNodeSize": 100, + "colorSettings": { + "nodeColorField": "microsoft.compute/virtualmachines--Percentage CPU", + "type": 4, + "heatmapPalette": "greenRed", + "heatmapMin": 30, + "heatmapMax": 80, + "emptyValueColor": "gray" + }, + "groupByField": "Subscription", + "hivesMargin": 5 + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Percentage CPU (Average)", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Percentage CPU Timeline", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU", + "formatter": 1, + "numberFormat": { + "unit": 1, + "options": null + } + } + ], + "rowLimit": 10000, + "filter": true, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Percentage CPU", + "label": "Percentage CPU (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Percentage CPU Timeline", + "label": "Percentage CPU Timeline" + } + ] + }, + "sortBy": [], + "showExportToExcel": true + }, + "showPin": true, + "name": "CPU data" + }, + { + "type": 1, + "content": { + "json": "💡 _Click on the CPU usage metric in a cell to see more details about the virtual machine_\r\n
" + }, + "name": "Overview tip" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "Highest CPU utilization by region", + "items": [ + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": -2, + "metricScope": 0, + "resourceIds": [ + "{VirtualMachines}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Percentage CPU", + "aggregation": 4 + } + ], + "mapSettings": { + "locInfo": "AzureResource", + "locInfoColumn": "Name", + "sizeSettings": "Name", + "sizeAggregation": "Count", + "legendMetric": "microsoft.compute/virtualmachines--Percentage CPU", + "legendAggregation": "Max", + "itemColorSettings": { + "nodeColorField": "microsoft.compute/virtualmachines--Percentage CPU", + "colorAggregation": "Max", + "type": "heatmap", + "heatmapPalette": "greenRed", + "heatmapMin": 30, + "heatmapMax": 80 + }, + "numberFormatSettings": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Percentage CPU (Average)", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Percentage CPU Timeline", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU", + "formatter": 1, + "numberFormat": { + "unit": 1, + "options": null + } + } + ], + "rowLimit": 10000, + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Percentage CPU", + "label": "Percentage CPU (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Percentage CPU Timeline", + "label": "Percentage CPU Timeline" + } + ] + }, + "sortBy": [], + "exportMultipleValues": true, + "exportAggregateParts": true, + "exportedParameters": [ + { + "fieldName": "Name", + "parameterName": "ResourcesInSelectedRegion", + "parameterType": 1 + } + ] + }, + "showPin": true, + "name": "CPU data" + }, + { + "type": 1, + "content": { + "json": "💡 _Select a region to see details of the virtual machines in it_\r\n
" + }, + "conditionalVisibility": { + "parameterName": "ResourcesInSelectedRegion", + "comparison": "isEqualTo" + }, + "name": "Region tip" + }, + { + "type": 10, + "content": { + "chartId": "workbook0b213afb-2aee-4fe6-9df0-96d2b608cd42", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{ResourcesInSelectedRegion}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "ResourcesInSelectedRegion", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Percentage CPU", + "aggregation": 4 + } + ], + "title": "Virtual machines in selected region", + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU", + "formatter": 8, + "formatOptions": { + "min": 30, + "max": 80, + "palette": "greenRed", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU Timeline", + "formatter": 9, + "formatOptions": { + "min": 30, + "max": 80, + "palette": "greenRed", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.compute/virtualmachines--Percentage CPU_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Percentage CPU", + "label": "Percentage CPU (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Percentage CPU Timeline", + "label": "Percentage CPU Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.compute/virtualmachines--Percentage CPU_3", + "sortOrder": 2 + } + ] + }, + "conditionalVisibility": { + "parameterName": "ResourcesInSelectedRegion", + "comparison": "isNotEqualTo" + }, + "name": "Region VM details" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Regions" + }, + "name": "Regions" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 2, + "chartType": 0, + "resourceIds": [ + "{VirtualMachines}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Percentage CPU", + "aggregation": 4, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Disk Read Bytes", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Disk Write Bytes", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network In Total", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network Out Total", + "aggregation": 1, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Virtual Machines/Virtual machine details", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.compute/virtualmachines" + } + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Disk Read Bytes|microsoft.compute/virtualmachines--Disk Write Bytes", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Disk Read Bytes Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Disk Write Bytes Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total|microsoft.compute/virtualmachines--Network Out Total", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network In Total Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + } + ], + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Subscription" + ], + "expandTopLevel": true, + "finalBy": "Name" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.compute/virtualmachines--Percentage CPU_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "microsoft.compute/virtualmachines--Percentage CPU", + "label": "Percentage CPU (Average)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Percentage CPU Timeline", + "label": "Percentage CPU Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Disk Read Bytes", + "label": "Disk Read Bytes (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Disk Read Bytes Timeline", + "label": "Disk Read Bytes Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Disk Write Bytes", + "label": "Disk Write Bytes (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Disk Write Bytes Timeline", + "label": "Disk Write Bytes Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total", + "label": "Network In Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network In Total Timeline", + "label": "Network In Total Timeline" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total", + "label": "Network Out Total (Sum)" + }, + { + "columnId": "microsoft.compute/virtualmachines--Network Out Total Timeline", + "label": "Network Out Total Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.compute/virtualmachines--Percentage CPU_3", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "showPin": true, + "name": "Azure Monitor VM Key Metrics" + }, + { + "type": 1, + "content": { + "json": "💡 _Click on the CPU utilization cells to zoom into the metrics of the virtual machine_\r\n
" + }, + "name": "Details table tip" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Details" + }, + "name": "Details" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"AzureHealthQuery/1.0\",\"queryType\":\"Detailed\"}", + "size": 2, + "showExportToExcel": true, + "queryType": 4, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{VirtualMachines}" + ], + "visualization": "graph", + "graphSettings": { + "type": 2, + "topContent": { + "columnMatch": "Availability state", + "formatter": 1, + "formatOptions": { + "showIcon": false + } + }, + "centerContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "resourcehealth", + "showIcon": false + } + }, + "bottomContent": { + "columnMatch": "Reason type", + "formatter": 1, + "formatOptions": { + "showIcon": true + }, + "tooltipFormat": {} + }, + "nodeIdField": "Name", + "nodeSize": null, + "staticNodeSize": 100, + "colorSettings": { + "nodeColorField": "Availability state", + "type": 3, + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Available", + "representation": "green" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "orange" + } + ] + }, + "hivesMargin": 5 + } + }, + "showPin": true, + "name": "Resource health" + }, + { + "type": 1, + "content": { + "json": "💡 _Click on the virtual machine name to see more details about the resource health_\r\n
\r\n
\r\nLearn about [Azure resource health](https://docs.microsoft.com/en-us/azure/service-health/resource-health-overview)" + }, + "name": "Resource health tip" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Health" + }, + "name": "Resource health group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Virtual Machines/Workbooks/At-scale Metrics/settings.json b/Virtual Machines/Workbooks/At-scale Metrics/settings.json new file mode 100644 index 0000000..61bffd7 --- /dev/null +++ b/Virtual Machines/Workbooks/At-scale Metrics/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Key Metrics", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorVirtualMachines", "order": 50 } + ] +} \ No newline at end of file diff --git a/Virtual Machines/Workbooks/Availability/Server Availability.workbook b/Virtual Machines/Workbooks/Availability/Server Availability.workbook new file mode 100644 index 0000000..1f6bb44 --- /dev/null +++ b/Virtual Machines/Workbooks/Availability/Server Availability.workbook @@ -0,0 +1,278 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "ff24505c-2099-43a4-a8a3-3456bed78eb5", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 259200000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "bfe50469-7469-4c4d-a33e-0edbb43546c4", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.compute/virtualmachines'\r\n| summarize Count = count() by subscriptionId\r\n\t| order by Count desc\r\n\t| extend Rank = row_number()\r\n\t| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "limitSelectTo": 100, + "additionalResourceOptions": [ + "value::10" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "value": [ + "value::10" + ] + }, + { + "id": "fb861784-4609-49f2-9f58-427fcc547677", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::3" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "limitSelectTo": 100, + "additionalResourceOptions": [ + "value::1", + "value::3", + "value::all" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "b2627475-cef7-4e91-97b9-b70bf00164e6", + "version": "KqlParameterItem/1.0", + "name": "Servers", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Heartbeat\r\n| distinct Computer\r\n| order by Computer", + "crossComponentResources": [ + "{Workspace}" + ], + "value": [ + "value::10" + ], + "typeSettings": { + "limitSelectTo": 100, + "additionalResourceOptions": [ + "value::10", + "value::all" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let timeRangeStart = {TimeRange:start};\r\nlet timeRangeEnd = {TimeRange:end};\r\nHeartbeat\r\n| where ResourceType == \"virtualMachines\"\r\n| extend ResourceGroup = case(ResourceGroup <> \"\", ResourceGroup, \"On-Prem\")\r\n| where TimeGenerated > timeRangeStart and TimeGenerated < timeRangeEnd and Computer in ({Servers})\r\n| summarize heartbeat_per_hour=count() by bin_at(TimeGenerated, 1h, timeRangeStart), Resource,ResourceGroup\r\n| extend available_per_hour=iff(heartbeat_per_hour>0, true, false)\r\n| summarize total_available_hours=countif(available_per_hour==true) by Resource,ResourceGroup\r\n| extend total_number_of_buckets=round((timeRangeEnd-timeRangeStart)/1h)\r\n| extend round(availability_rate=total_available_hours*100/total_number_of_buckets,2)\r\n| order by availability_rate asc", + "size": 2, + "title": "VM Availability", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "table", + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Resource Group" + } + }, + { + "columnMatch": "Resource", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "ResourceGroup", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "total_available_hours", + "formatter": 0, + "formatOptions": { + "aggregation": "Average" + } + }, + { + "columnMatch": "total_number_of_buckets", + "formatter": 0, + "formatOptions": { + "aggregation": "Average" + } + }, + { + "columnMatch": "availability_rate", + "formatter": 3, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "redGreen", + "aggregation": "Average" + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "_ResourceId", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Computer", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "RG", + "formatter": 5, + "formatOptions": {} + } + ], + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "ResourceGroup" + ], + "expandTopLevel": true, + "finalBy": "Resource" + }, + "labelSettings": [ + { + "columnId": "total_available_hours", + "label": "Available Hours" + }, + { + "columnId": "total_number_of_buckets", + "label": "Total Hours" + }, + { + "columnId": "availability_rate", + "label": "Availability" + } + ] + }, + "sortBy": [] + }, + "name": "query - 0" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Virtual Machines/Workbooks/Availability/settings.json b/Virtual Machines/Workbooks/Availability/settings.json new file mode 100644 index 0000000..50aa4f5 --- /dev/null +++ b/Virtual Machines/Workbooks/Availability/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Availability", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "categoryKey": "azureMonitorVirtualMachines", "order": 400 } + ] +} \ No newline at end of file diff --git a/Virtual Machines/Workbooks/CPU heatmap/CPU heatmap.workbook b/Virtual Machines/Workbooks/CPU heatmap/CPU heatmap.workbook new file mode 100644 index 0000000..09f964b --- /dev/null +++ b/Virtual Machines/Workbooks/CPU heatmap/CPU heatmap.workbook @@ -0,0 +1,341 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "1ca69445-60fc-4806-b43d-ac7e6aad630a", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.compute/virtualmachines'\r\n\t| summarize Count = count() by subscriptionId\r\n\t| order by Count desc\r\n\t| extend Rank = row_number()\r\n\t| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachines", + "label": "Virtual Machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'microsoft.compute/virtualmachines'\n\t| order by name asc\n\t| extend Rank = row_number()\n\t| project value = id, label = id, selected = Rank <= 25", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 3600000 + }, + "label": "Time Range" + }, + { + "id": "83eda9a9-8850-4fce-ad6b-aeb230f6471c", + "version": "KqlParameterItem/1.0", + "name": "Message", + "type": 1, + "query": "where type == 'microsoft.compute/virtualmachines' \r\n| summarize Selected = countif(id in ({VirtualMachines:value})), Total = count()\r\n| extend Selected = iff(Selected > 200, 200, Selected)\r\n| project Message = strcat('# ', Selected, ' / ', Total)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "{Message}\r\n_Virtual machines_" + }, + "name": "text - 5", + "styleSettings": { + "margin": "20px 0 20px 0" + } + }, + { + "type": 10, + "content": { + "chartId": "workbookdb19a8d8-91af-44ea-951d-5ffa133b2ebe", + "version": "MetricsItem/2.0", + "size": 4, + "chartType": 0, + "resourceIds": [ + "{VirtualMachines}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Percentage CPU", + "aggregation": 4, + "splitBy": null + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Percentage CPU (Average)", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Percentage CPU Timeline", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "microsoft.compute/virtualmachines--Percentage CPU", + "formatter": 1, + "numberFormat": { + "unit": 1, + "options": null + } + } + ], + "labelSettings": [] + }, + "sortBy": [], + "filters": [] + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "CPU data" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"4e6b78ae-e9b4-4fd7-8162-3665f7d44b76\",\"mergeType\":\"table\",\"leftTable\":\"CPU data\"}],\"projectRename\":[{\"originalName\":\"[CPU data].Subscription\",\"mergedName\":\"Subscription\"},{\"originalName\":\"[CPU data].Name\",\"mergedName\":\"Name\"},{\"originalName\":\"[CPU data].microsoft.compute/virtualmachines--Percentage CPU\",\"mergedName\":\"Percentage CPU (Average)\",\"fromId\":\"unknown\"},{\"originalName\":\"[CPU data].microsoft.compute/virtualmachines--Percentage CPU Timeline\",\"mergedName\":\"Percentage CPU Timeline\",\"fromId\":\"unknown\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Text\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"condition\":\"Percentage CPU (Average) is empty Result is -\",\"newColumnContext\":{\"leftColumn\":\"Percentage CPU (Average)\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"-\"}},{\"condition\":\"Default\",\"newColumnContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\",\"resultVal\":\"Percentage CPU (Average)\"}}]},{\"originalName\":\"[Added column]\",\"mergedName\":\"Value\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"condition\":\"Percentage CPU (Average) is empty Result is 0\",\"newColumnContext\":{\"leftColumn\":\"Percentage CPU (Average)\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"0\"}},{\"condition\":\"Default\",\"newColumnContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\",\"resultVal\":\"Percentage CPU (Average)\"}}]},{\"originalName\":\"[CPU data].microsoft.compute/virtualmachines--Percentage CPU\"},{\"originalName\":\"[CPU data].microsoft.compute/virtualmachines--Percentage CPU Timeline\"},{\"originalName\":\"[CPU data].Percentage CPU (Average)\"},{\"originalName\":\"[CPU data].Percentage CPU Timeline\"}]}", + "size": 2, + "title": "CPU usage", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 7, + "visualization": "graph", + "graphSettings": { + "type": 2, + "topContent": { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": false + } + }, + "centerContent": { + "columnMatch": "Text", + "formatter": 12, + "formatOptions": { + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "showIcon": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Name", + "resourceIdsSource": "column", + "resourceIds": "Name", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Virtual Machines/Virtual machine details", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.compute/virtualmachines" + } + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "hivesContent": { + "columnMatch": "Subscription", + "formatter": 15, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + "nodeIdField": "Name", + "nodeSize": null, + "staticNodeSize": 100, + "colorSettings": { + "nodeColorField": "Value", + "type": 4, + "heatmapPalette": "greenRed", + "heatmapMin": 0, + "heatmapMax": 100 + }, + "groupByField": "Subscription", + "hivesMargin": 5 + } + }, + "name": "CPU heatmap merge control" + }, + { + "type": 1, + "content": { + "json": "💡 _Click on the CPU usage metric in a cell to see more details about the virtual machine_\r\n
" + }, + "name": "text - 4" + }, + { + "type": 1, + "content": { + "json": "
" + }, + "name": "text - 14" + } + ], + "styleSettings": {}, + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Virtual Machines/Workbooks/CPU heatmap/settings.json b/Virtual Machines/Workbooks/CPU heatmap/settings.json new file mode 100644 index 0000000..f710e62 --- /dev/null +++ b/Virtual Machines/Workbooks/CPU heatmap/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"CPU Usage Heatmap", + "author": "Microsoft", + "description": "not shown in any gallery, CPU Heatmaps is now inside Workbooks/Virtual Machines/At-scale Metrics/Key Metrics.workbook", + "galleries": [] +} diff --git a/Virtual Machines/Workbooks/Key Metrics/Key Metrics.workbook b/Virtual Machines/Workbooks/Key Metrics/Key Metrics.workbook new file mode 100644 index 0000000..8d33d6a --- /dev/null +++ b/Virtual Machines/Workbooks/Key Metrics/Key Metrics.workbook @@ -0,0 +1,394 @@ +{ + "version": "Notebook/1.0", + "isLocked": false, + "items": [ + { + "type": 1, + "content": { + "json": "# Virtual Machines Metrics" + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "85bc1eb3-c168-4054-a925-2bcc86074223", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::all", + "value::3" + ] + } + }, + { + "id": "0d13757a-59d3-4fdc-ae21-1de067448751", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-21T23:40:02.726Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-21T23:40:02.726Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-21T23:40:02.726Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-21T23:40:02.726Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + }, + "value": { + "durationMs": 14400000, + "createdTime": "2018-08-21T23:40:02.727Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + } + ], + "resourceType": "microsoft.resources/resourcegroups" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Percentage CPU" + }, + "conditionalVisibility": null + }, + { + "type": 10, + "content": { + "chartId": "workbook3fdb1843-c2e1-4420-8e67-e3367994134f", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-10-29T17:31:35.478Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Percentage CPU", + "aggregation": 4, + "chartType": 3, + "color": "blue" + } + ] + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "*Percentage CPU* is the percentage of allocated compute units that are currently in use by the Virtual Machine(s)." + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Disk Reads" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Disk Writes" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook3fdb1843-c2e1-4420-8e67-e3367994134f", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-10-29T17:31:35.524Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Disk Read Bytes", + "aggregation": 4, + "chartType": 3, + "color": "orange" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook3fdb1843-c2e1-4420-8e67-e3367994134f", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-10-29T17:31:35.549Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Disk Write Bytes", + "aggregation": 4, + "chartType": 3, + "color": "orange" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Disk reads* is the average bytes read from disk during monitoring period." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Disk writes* is the average bytes written to disk during monitoring period." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "### Network In" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "### Network Out" + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook3fdb1843-c2e1-4420-8e67-e3367994134f", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-10-29T17:31:35.642Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network In", + "aggregation": 4, + "chartType": 3, + "color": "green" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 10, + "content": { + "chartId": "workbook3fdb1843-c2e1-4420-8e67-e3367994134f", + "version": "MetricsItem/1.0", + "size": 0, + "timeContext": { + "durationMs": 0, + "endTime": null, + "createdTime": "2018-10-29T17:31:35.677Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "VirtualMachines", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network Out", + "aggregation": 4, + "chartType": 3, + "color": "green" + } + ] + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Network In* is the number of bytes received on all network interfaces by the Virtual Machine(s) (Incoming Traffic)." + }, + "conditionalVisibility": null, + "customWidth": "50" + }, + { + "type": 1, + "content": { + "json": "*Network out* is the number of bytes out on all network interfaces by the Virtual Machine(s) (Outgoing Traffic)." + }, + "conditionalVisibility": null, + "customWidth": "50" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Virtual Machines/Workbooks/Key Metrics/settings.json b/Virtual Machines/Workbooks/Key Metrics/settings.json new file mode 100644 index 0000000..18504ed --- /dev/null +++ b/Virtual Machines/Workbooks/Key Metrics/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Key Metrics", + "author": "Microsoft", + "galleries": [ + { "type": "performance-vm", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 }, + { "type": "failure-vm", "resourceType": "microsoft.resources/subscriptions/resourcegroups", "order": 200 } + ] +} \ No newline at end of file diff --git a/Virtual Machines/Workbooks/Virtual Machine Performance/Virtual Machine Performance.workbook b/Virtual Machines/Workbooks/Virtual Machine Performance/Virtual Machine Performance.workbook new file mode 100644 index 0000000..9e18afa --- /dev/null +++ b/Virtual Machines/Workbooks/Virtual Machine Performance/Virtual Machine Performance.workbook @@ -0,0 +1,308 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", + "version": "Notebook/1.0", + "isLocked": true, + "items": [ + { + "type": 1, + "content": { + "json": "# Virtual Machine Performance\nAnalyze the performance counters (processor, memory, disk, etc.) of your VMs using this workbook. You can also choose to customize the analysis by using the `Edit` button in the toolbar." + }, + "conditionalVisibility": null + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "764356de-cf43-4be7-a9f2-f582e5f2ffc2", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 86400000, + "createdTime": "2018-10-25T18:51:46.918Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-10-25T18:51:46.917Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-10-25T18:51:46.917Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-10-25T18:51:46.917Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-10-25T18:51:46.917Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-10-25T18:51:46.918Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-10-25T18:51:46.918Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-10-25T18:51:46.918Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-10-25T18:51:46.918Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-10-25T18:51:46.918Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-10-25T18:51:46.918Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1209600000, + "createdTime": "2018-10-25T18:51:46.918Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 2592000000, + "createdTime": "2018-10-25T18:51:46.919Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 5184000000, + "createdTime": "2018-10-25T18:51:46.919Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 7776000000, + "createdTime": "2018-10-25T18:51:46.919Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": true + } + }, + { + "id": "8f72709f-725a-41e6-82a2-8d067e38a261", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "value": [ + "value::1" + ], + "type": 5, + "isRequired": true, + "isHiddenWhenLocked": false, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + }, + { + "id": "24eb29a6-309b-4b55-aebd-87d3a2057b3f", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachines", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Perf\r\n| summarize by Computer\r\n| order by Computer asc\r\n| serialize rank = row_number()\r\n| project Computer, Label = Computer, Selected = iff(rank == 1, true, false)\r\n| union (datatable(Computer:string, Label:string, Selected:boolean)['*', 'All Machines', false])", + "crossComponentResources": [ + "{Workspace}" + ], + "isHiddenWhenLocked": false, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "d495f8c1-c6b2-490e-8eb6-43d151bc20c0", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "isRequired": true, + "query": "Perf\r\n| where TimeGenerated {TimeRange}\r\n| where Computer in ({VirtualMachines}) or '*' in ({VirtualMachines})\r\n| summarize by CounterName, ObjectName, CounterText = strcat(ObjectName, ' > ', CounterName)\r\n| order by ObjectName asc, CounterText asc\r\n| project Counter = pack('counter', CounterName, 'object', ObjectName), CounterText", + "value": "{\"counter\":\"% Processor Time\",\"object\":\"Processor\"}", + "isHiddenWhenLocked": false, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "28991f51-2685-417c-8737-afb1d6e8d166", + "version": "KqlParameterItem/1.0", + "name": "Metrics", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "", + "delimiter": ",", + "value": [ + "Average = round(avg(CounterValue), 2)" + ], + "isHiddenWhenLocked": false, + "jsonData": "[\r\n { \"value\":\"Average = round(avg(CounterValue), 2)\", \"label\":\"Average\", \"selected\":true },\r\n { \"value\":\"p1 = round(percentile(CounterValue, 1), 2)\", \"label\":\"p1\", \"selected\":false},\r\n { \"value\":\"p5 = round(percentile(CounterValue, 5), 2)\", \"label\":\"p5\", \"selected\":false},\r\n { \"value\":\"p10 = round(percentile(CounterValue, 10), 2)\", \"label\":\"p10\", \"selected\":false},\r\n { \"value\":\"p50 = round(percentile(CounterValue, 50), 2)\", \"label\":\"p50\", \"selected\":false},\r\n { \"value\":\"p90 = round(percentile(CounterValue, 90), 2)\", \"label\":\"p90\", \"selected\":false},\r\n { \"value\":\"p95 = round(percentile(CounterValue, 95), 2)\", \"label\":\"p95\", \"selected\":true},\r\n { \"value\":\"p99 = round(percentile(CounterValue, 99), 2)\", \"label\":\"p99\", \"selected\":false},\r\n { \"value\":\"Min = round(min(CounterValue), 2)\", \"label\":\"Min\", \"selected\":false},\r\n { \"value\":\"Max = round(max(CounterValue), 2)\", \"label\":\"Max\", \"selected\":false} \r\n]" + }, + { + "id": "989f7b0f-dafb-461a-a8bc-8a044cd47d10", + "version": "KqlParameterItem/1.0", + "name": "computer", + "type": 1, + "isRequired": false, + "value": "All", + "isHiddenWhenLocked": true + } + ], + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "Use the `Counter` parameter to switch to a different VM counter. You can include more VMs in your analysis using the `VirtualMachines` parameter. " + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Computers" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter});\nlet data = Perf\n| where TimeGenerated {TimeRange}\n| where Computer in ({VirtualMachines}) or '*' in ({VirtualMachines})\n| where ObjectName == metric.object and CounterName == metric.counter\n| summarize {Metrics} by Computer;\nPerf\n| where TimeGenerated {TimeRange}\n| where Computer in ({VirtualMachines}) or '*' in ({VirtualMachines})\n| where ObjectName == metric.object and CounterName == metric.counter\n| make-series Trend = round(avg(CounterValue), 2) default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Computer\n| project Computer, ['Trend (avg)'] = Trend\n| join kind=inner (data) on Computer\n| project-away Computer1\n| order by tolower(Computer) asc", + "showQuery": false, + "size": 3, + "aggregation": 0, + "showAnnotations": false, + "exportFieldName": "Computer", + "exportParameterName": "computer", + "showAnalytics": false, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Computer", + "formatter": 1, + "formatOptions": {} + }, + { + "columnMatch": "Trend (avg)", + "formatter": 10, + "formatOptions": { + "min": null, + "max": null, + "palette": "green" + } + }, + { + "columnMatch": ".*", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": null, + "palette": "red" + } + } + ] + } + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "*Click on a row to see trends for just that computer*" + }, + "conditionalVisibility": null + }, + { + "type": 1, + "content": { + "json": "## Trend: {computer}" + }, + "conditionalVisibility": null + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let metric = dynamic({Counter});\nPerf\n| where TimeGenerated {TimeRange}\n| where Computer in ({VirtualMachines}) or '*' in ({VirtualMachines})\n| where Computer == '{computer}' or 'All' == '{computer}'\n| where ObjectName == metric.object and CounterName == metric.counter\n| summarize {Metrics} by bin(TimeGenerated, {TimeRange:grain})", + "showQuery": false, + "size": 0, + "aggregation": 3, + "showAnnotations": false, + "showAnalytics": false, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "timechart" + }, + "conditionalVisibility": null + } + ], + "defaultResourceIds": [] + } diff --git a/Virtual Machines/Workbooks/Virtual Machine Performance/settings.json b/Virtual Machines/Workbooks/Virtual Machine Performance/settings.json new file mode 100644 index 0000000..c69e64a --- /dev/null +++ b/Virtual Machines/Workbooks/Virtual Machine Performance/settings.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Virtual Machine Performance", + "author": "Microsoft", + "galleries": [ + ] +} \ No newline at end of file diff --git a/Virtual Machines/Workbooks/Virtual machine details/Virtual machine details.workbook b/Virtual Machines/Workbooks/Virtual machine details/Virtual machine details.workbook new file mode 100644 index 0000000..7d3f9c8 --- /dev/null +++ b/Virtual Machines/Workbooks/Virtual machine details/Virtual machine details.workbook @@ -0,0 +1,194 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "2241c21b-5a59-4a42-b3a9-b503de023938", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 3600000 + }, + "isHiddenWhenLocked": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ] + } + }, + { + "id": "41637606-f74f-4e7b-8380-8ff980f79138", + "version": "KqlParameterItem/1.0", + "name": "SelectedVM", + "type": 5, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::1" + ] + } + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.resources/resourcegroups" + }, + "name": "parameters - 1" + }, + { + "type": 10, + "content": { + "chartId": "workbook71fad38a-5496-49e9-8853-7881ce43cb82", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "color": "blue", + "resourceIds": [ + "{SelectedVM}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "SelectedVM", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Percentage CPU", + "aggregation": 4, + "splitBy": null + } + ], + "title": "CPU percentage", + "filters": [] + }, + "conditionalVisibility": { + "parameterName": "SelectedVM", + "comparison": "isNotEqualTo", + "value": null + }, + "showPin": true, + "name": "CPU percentage" + }, + { + "type": 10, + "content": { + "chartId": "workbook71fad38a-5496-49e9-8853-7881ce43cb82", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "resourceIds": [ + "{SelectedVM}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "SelectedVM", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Disk Read Bytes", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Disk Write Bytes", + "aggregation": 1 + } + ], + "title": "Disk reads and writes", + "filters": [] + }, + "showPin": true, + "name": "Disk reads and writes" + }, + { + "type": 10, + "content": { + "chartId": "workbook71fad38a-5496-49e9-8853-7881ce43cb82", + "version": "MetricsItem/2.0", + "size": 1, + "chartType": 2, + "resourceIds": [ + "{SelectedVM}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.compute/virtualmachines", + "resourceParameter": "SelectedVM", + "metrics": [ + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network In Total", + "aggregation": 1, + "splitBy": null + }, + { + "namespace": "microsoft.compute/virtualmachines", + "metric": "microsoft.compute/virtualmachines--Network Out Total", + "aggregation": 1 + } + ], + "title": "Network in and out", + "filters": [] + }, + "showPin": true, + "name": "Network in and out" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Virtual Machines/Workbooks/Virtual machine details/settings.json b/Virtual Machines/Workbooks/Virtual machine details/settings.json new file mode 100644 index 0000000..d9a182d --- /dev/null +++ b/Virtual Machines/Workbooks/Virtual machine details/settings.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Virtual machine details", + "author": "Microsoft", + "galleries": [] +} \ No newline at end of file diff --git a/Virtual Machines/Workbooks/categoryResources.json b/Virtual Machines/Workbooks/categoryResources.json new file mode 100644 index 0000000..396d068 --- /dev/null +++ b/Virtual Machines/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Virtual Machine Metrics", "description": "Look for common issues with your VM via metrics", "order": 200} +} \ No newline at end of file diff --git a/Workloads/Alerts/README b/Workloads/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Workloads/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Workloads/Queries/README b/Workloads/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Workloads/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Workloads/Workbooks/Alerts group/Alerts group.workbook b/Workloads/Workbooks/Alerts group/Alerts group.workbook new file mode 100644 index 0000000..efd7003 --- /dev/null +++ b/Workloads/Workbooks/Alerts group/Alerts group.workbook @@ -0,0 +1,328 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5749861f-a2b4-467c-bbe8-c07f16a20ebe", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + "value::all" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "f8f45fd1-3b0b-4da0-ba5b-aede9dc26b9b", + "version": "KqlParameterItem/1.0", + "name": "SuggestedAlerts", + "type": 1, + "value": "[]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "9d700f0f-fa4b-48bf-9183-2cfae0f88787", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ] + }, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "Parameter block" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Resources\n| where id in ({Workspaces})\n| project WorkspaceId = tolower(id), WorkspaceFriendly = id\n| join kind = leftouter (Resources\n | where type =~ 'Microsoft.Insights/scheduledQueryRules'\n | project AlertRuleId = tolower(id), dataSourceId = tolower(properties.source.dataSourceId), AlertEnabled = tostring(properties.enabled), AlertName = name, AlertRuleFriendly = id, AlertDescription = tostring(properties.description)\n | where dataSourceId contains 'Microsoft.OperationalInsights/workspaces'\n) on $left.WorkspaceId == $right.dataSourceId\n| extend AlertRuleKey = tolower(strcat(WorkspaceId, '/', AlertName))\n| project-away dataSourceId\n| where AlertRuleId != ''\n", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "value::all" + ] + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "customWidth": "33", + "name": "Workspace alert rules" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Resources\n| where id in ({Workspaces})\n| project WorkspaceId = tolower(id), SuggestedAlertWorkspaceFriendly = id\n| extend SuggestedAlert = dynamic({SuggestedAlerts})\n| mvexpand SuggestedAlert limit 400 \n| project WorkspaceId, SuggestedAlertName = tostring(SuggestedAlert.AlertName), WorkspaceAndThreshold = strcat(WorkspaceId, '/alertname/', SuggestedAlert.AlertName,'/threshold/', SuggestedAlert.AlertThreshold, '/template/', SuggestedAlert.AlertTemplate), SuggestedAlertWorkspaceFriendly, SuggestedAlertDescription = tostring(SuggestedAlert.AlertDescription)\n| extend AlertRuleKey = tolower(strcat(WorkspaceId, '/', SuggestedAlertName)), Kind = 'Recommended alert'\n", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "value::all" + ] + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "customWidth": "33", + "name": "Suggested alerts" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "alertsmanagementresources\n| where properties.essentials.startDateTime > {TimeRange:start} and properties.essentials.startDateTime < {TimeRange:end}\n| where properties.essentials.alertState != \"Closed\"\n| where properties.essentials.targetResourceType == \"microsoft.operationalinsights/workspaces\"\n| extend workspaceResourceId = extract(\"(/subscriptions/.+/workspaces/.+)/providers\", 1, id)\n| where workspaceResourceId in~ ({Workspaces})\n| project AlertRuleId = properties.essentials.alertRule, ['Alert Instance'] = id", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "value::all" + ] + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "customWidth": "33", + "name": "Active alerts" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"7b912967-a5a6-4a92-952c-bde3f11350a6\",\"mergeType\":\"leftouter\",\"leftTable\":\"Workspace alert rules\",\"rightTable\":\"Active alerts\",\"leftColumn\":\"AlertRuleId\",\"rightColumn\":\"AlertRuleId\"},{\"id\":\"7b912967-a5a6-4a92-952c-bde3f11350c5\",\"mergeType\":\"outer\",\"leftTable\":\"Workspace alert rules\",\"rightTable\":\"Suggested alerts\",\"leftColumn\":\"AlertRuleKey\",\"rightColumn\":\"AlertRuleKey\"}],\"projectRename\":[{\"originalName\":\"[Added column]\",\"mergedName\":\"Workspaces\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"condition\":\"if (WorkspaceId is empty ), result = SuggestedAlertWorkspaceFriendly\",\"criteriaContext\":{\"leftOperand\":\"WorkspaceId\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"column\",\"resultVal\":\"SuggestedAlertWorkspaceFriendly\"}},{\"condition\":\"else result = WorkspaceFriendly\",\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\",\"resultVal\":\"WorkspaceFriendly\"}}]},{\"originalName\":\"[Added column]\",\"mergedName\":\"Alert rule\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"condition\":\"if (AlertRuleId is empty ), result = SuggestedAlertName\",\"criteriaContext\":{\"leftOperand\":\"AlertRuleId\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"column\",\"resultVal\":\"SuggestedAlertName\"}},{\"condition\":\"else result = AlertName\",\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\",\"resultVal\":\"AlertName\"}}]},{\"originalName\":\"[Workspace alert rules].AlertEnabled\",\"mergedName\":\"AlertEnabled\",\"fromId\":\"7b912967-a5a6-4a92-952c-bde3f11350a6\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Alert status\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"condition\":\"if (AlertRuleId1 is not empty ), result = 'Active alert'\",\"criteriaContext\":{\"leftOperand\":\"AlertRuleId1\",\"operator\":\"isNotNull\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"Active alert\"}},{\"condition\":\"if (AlertEnabled == 'false'), result = 'Disabled alert rule'\",\"criteriaContext\":{\"leftOperand\":\"AlertEnabled\",\"operator\":\"==\",\"rightValType\":\"static\",\"rightVal\":\"false\",\"resultValType\":\"static\",\"resultVal\":\"Disabled alert rule\"}},{\"condition\":\"if (AlertRuleId is empty ), result = 'Not created'\",\"criteriaContext\":{\"leftOperand\":\"AlertRuleId\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"Not created\"}},{\"condition\":\"else result = 'No alert'\",\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"No alert\"}}]},{\"originalName\":\"[Workspace alert rules].AlertDescription\",\"mergedName\":\"AlertDescription\",\"fromId\":\"unknown\"},{\"originalName\":\"[Active alerts].Alert Instance\",\"mergedName\":\"Alert Instance\",\"fromId\":\"unknown\"},{\"originalName\":\"[Workspace alert rules].AlertName\",\"mergedName\":\"AlertName\",\"fromId\":\"unknown\"},{\"originalName\":\"[Workspace alert rules].WorkspaceId\",\"mergedName\":\"WorkspaceId\",\"fromId\":\"7b912967-a5a6-4a92-952c-bde3f11350a6\"},{\"originalName\":\"[Workspace alert rules].AlertRuleId\",\"mergedName\":\"AlertRuleId\",\"fromId\":\"7b912967-a5a6-4a92-952c-bde3f11350a6\"},{\"originalName\":\"[Workspace alert rules].AlertRuleKey\",\"mergedName\":\"AlertRuleKey\",\"fromId\":\"7b912967-a5a6-4a92-952c-bde3f11350a6\"},{\"originalName\":\"[Active alerts].AlertRuleId\",\"mergedName\":\"AlertRuleId1\",\"fromId\":\"7b912967-a5a6-4a92-952c-bde3f11350a6\"},{\"originalName\":\"[Suggested alerts].WorkspaceId\",\"mergedName\":\"WorkspaceId1\",\"fromId\":\"7b912967-a5a6-4a92-952c-bde3f11350c5\"},{\"originalName\":\"[Suggested alerts].SuggestedAlertName\",\"mergedName\":\"SuggestedAlertName\",\"fromId\":\"7b912967-a5a6-4a92-952c-bde3f11350c5\"},{\"originalName\":\"[Suggested alerts].AlertRuleKey\",\"mergedName\":\"AlertRuleKey1\",\"fromId\":\"7b912967-a5a6-4a92-952c-bde3f11350c5\"},{\"originalName\":\"[Suggested alerts].Kind\",\"mergedName\":\"Kind\",\"fromId\":\"unknown\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Alert description\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"condition\":\"if (AlertDescription is empty ), result = SuggestedAlertDescription\",\"criteriaContext\":{\"leftOperand\":\"AlertDescription\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"column\",\"resultVal\":\"SuggestedAlertDescription\"}},{\"condition\":\"else result = AlertDescription\",\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\",\"resultVal\":\"AlertDescription\"}}]},{\"originalName\":\"[Added column]\",\"mergedName\":\"Action\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"condition\":\"if (WorkspaceId is empty ), result = 'Create alert'\",\"criteriaContext\":{\"leftOperand\":\"WorkspaceId\",\"operator\":\"is Empty\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"Create alert\"}},{\"condition\":\"Click edit to specify a result for the default condition.\",\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"column\"}}]},{\"originalName\":\"[Workspace alert rules].WorkspaceFriendly\",\"mergedName\":\"WorkspaceFriendly\",\"fromId\":\"unknown\"},{\"originalName\":\"[Workspace alert rules].AlertRuleFriendly\",\"mergedName\":\"AlertRuleFriendly\",\"fromId\":\"unknown\"},{\"originalName\":\"[Suggested alerts].WorkspaceFriendly\",\"mergedName\":\"WorkspaceFriendly\",\"fromId\":\"unknown\"},{\"originalName\":\"[Suggested alerts].SuggestedAlertWorkspaceFriendly\",\"mergedName\":\"SuggestedAlertWorkspaceFriendly\",\"fromId\":\"unknown\"},{\"originalName\":\"[Suggested alerts].AlertThreshold\",\"mergedName\":\"AlertThreshold\",\"fromId\":\"unknown\"},{\"originalName\":\"[Suggested alerts].WorkspaceAndThreshold\",\"mergedName\":\"WorkspaceAndThreshold\",\"fromId\":\"unknown\"},{\"originalName\":\"[Workspace alert rules].properties\",\"mergedName\":\"properties\",\"fromId\":\"unknown\"},{\"originalName\":\"[Suggested alerts].SuggestedAlertDescription\",\"mergedName\":\"SuggestedAlertDescription\",\"fromId\":\"unknown\"},{\"originalName\":\"[Active alerts].Alert Instance\",\"mergedName\":\"Alert Instance\",\"fromId\":\"unknown\"}]}", + "size": 2, + "queryType": 7, + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "subTarget": "alerts", + "showIcon": true + } + }, + { + "columnMatch": "Workspaces", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Alert rule", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "AlertEnabled", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Alert status", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Active alert", + "representation": "4", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Disabled alert rule", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Not created", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "AlertDescription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "AlertName", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "WorkspaceId", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "AlertRuleId", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "AlertRuleKey", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "AlertRuleId1", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "WorkspaceId1", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "SuggestedAlertName", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "AlertRuleKey1", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Friendly", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Action", + "formatter": 7, + "formatOptions": { + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Workspaces", + "resourceIdsSource": "column", + "resourceIds": "WorkspaceAndThreshold", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Workloads/Create log alert", + "typeSource": "static", + "type": "workload-insights", + "gallerySource": "static", + "gallery": "Azure Monitor", + "locationSource": "default" + } + } + }, + { + "columnMatch": "WorkspaceAndThreshold", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Alert Instance", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Alert Instance", + "formatter": 5, + "formatOptions": {} + } + ], + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Workspaces" + ], + "expandTopLevel": true, + "finalBy": "Alert rule" + } + } + }, + "name": "Alert view" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/Alerts group/settings.json b/Workloads/Workbooks/Alerts group/settings.json new file mode 100644 index 0000000..5721e7d --- /dev/null +++ b/Workloads/Workbooks/Alerts group/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Alerts group", + "author": "Microsoft", + "galleries": [ + { "type": "workloads-shared", "resourceType": "Azure Monitor", "order": 500 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/Collection logs/Collection logs.workbook b/Workloads/Workbooks/Collection logs/Collection logs.workbook new file mode 100644 index 0000000..b37ced8 --- /dev/null +++ b/Workloads/Workbooks/Collection logs/Collection logs.workbook @@ -0,0 +1,143 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "f1e2d7f8-f4ff-4bf0-a178-93887b200447", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachine", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "6ed69a2c-3ea5-4ec1-a31b-67a8cfe569b7", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "value": { + "durationMs": 14400000 + }, + "isHiddenWhenLocked": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "### Collection logs from {VirtualMachine:name}" + }, + "name": "text - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union telegraflogs_CL, waagentlogs_CL\n| order by TimeGenerated desc\n| extend Message = iff(Type == 'telegraflogs_CL', extract(@'.+Z D! \\[outputs.socket_writer\\] (.+)', 1, RawData), \n extract(@'.+Z (.+)', 1, RawData) )\n| project Time = TimeGenerated, Message = iff(Message == '', RawData, Message), ['Log type'] = iff(Type == 'telegraflogs_CL', 'Telegraf', 'WA Agent')\n| take 200", + "size": 3, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 0, + "resourceType": "microsoft.compute/virtualmachines", + "crossComponentResources": [ + "{VirtualMachine}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Time", + "formatter": 6, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + }, + "dateFormat": { + "showUtcTime": null, + "formatName": "shortDateTimePattern" + } + } + ], + "filter": true + } + }, + "name": "Log query" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/Collection logs/settings.json b/Workloads/Workbooks/Collection logs/settings.json new file mode 100644 index 0000000..ff6a719 --- /dev/null +++ b/Workloads/Workbooks/Collection logs/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Collection logs", + "author": "Microsoft", + "galleries": [ + { "type": "workloads-shared", "resourceType": "Azure Monitor", "order": 500 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/Create log alert/Create log alert.workbook b/Workloads/Workbooks/Create log alert/Create log alert.workbook new file mode 100644 index 0000000..e4d4981 --- /dev/null +++ b/Workloads/Workbooks/Create log alert/Create log alert.workbook @@ -0,0 +1,279 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "6b8f6e27-ae41-41ab-aab6-9c7e619a9015", + "version": "KqlParameterItem/1.0", + "name": "WorkspaceAndThrehsold", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "b0ad9246-1885-4f0e-84d2-4e12e70a7ba3", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "query": "Resources\r\n| take 1\r\n| project id = extract(@'(/subscriptions/.+/resourcegroups/.+/providers/microsoft.operationalinsights/workspaces/.+)/alertname/.+/threshold/.+/template/.+', 1, tolower('{WorkspaceAndThrehsold}'))\r\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2109914d-a3d1-4af7-99ab-fe0b64cda115", + "version": "KqlParameterItem/1.0", + "name": "Location", + "type": 1, + "isRequired": true, + "query": "Resources\n| where id =~ '{Workspace}'\n| project location", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e80c35ad-f5fe-490f-b320-c3940e7115b7", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroup", + "label": "Resource group", + "type": 1, + "isRequired": true, + "query": "Resources\n| where id =~ '{Workspace}'\n| project rg = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)\n", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "25a5d5a3-18fb-4c1a-bc59-2a9fa0f596c5", + "version": "KqlParameterItem/1.0", + "name": "AlertName", + "label": "Alert name", + "type": 1, + "isRequired": true, + "query": "Resources\r\n| take 1\r\n| project id = extract(@'/subscriptions/.+/resourcegroups/.+/providers/microsoft.operationalinsights/workspaces/.+/alertname/(.+)/threshold/.+/template/.+', 1, tolower('{WorkspaceAndThrehsold}'))\r\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "a30a7601-bb8f-4d81-b04d-01b304ae2434", + "version": "KqlParameterItem/1.0", + "name": "AlertTemplate", + "label": "Alert template", + "type": 1, + "query": "Resources\r\n| take 1\r\n| project id = extract(@'.+/alertname/.+/threshold/.+/template/(.+)', 1, '{WorkspaceAndThrehsold}')\r\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "## Create alert: {AlertName}\n" + }, + "name": "text - 2" + }, + { + "type": 1, + "content": { + "json": "### Choose a threshold to use for the alert" + }, + "name": "text - 6", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "7d7dd46b-4be1-4f3f-a4d9-8a1a3535bd47", + "version": "KqlParameterItem/1.0", + "name": "AlertThreshold", + "label": "Alert threshold", + "type": 1, + "query": "Resources\r\n| take 1\r\n| project id = extract(@'/subscriptions/.+/resourcegroups/.+/providers/microsoft.operationalinsights/workspaces/.+/alertname/.+/threshold/(.*)/template/.+', 1, tolower('{WorkspaceAndThrehsold}'))\r\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "Parameter block" + }, + { + "type": 1, + "content": { + "json": "### Choose an alert group for notifcations" + }, + "name": "text - 2 - Copy", + "styleSettings": { + "margin": "15px 0 0 0 " + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "1d6df05e-eb03-486b-94bd-c6cbc4d5b9c9", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "query": "Resources\n| where type =~ 'microsoft.insights/actiongroups'\n| summarize Count = count() by subscriptionId\n| order by Count desc\n| extend Rank = row_number()\n| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d8cb1021-2a3e-4156-8627-216c71ba9046", + "version": "KqlParameterItem/1.0", + "name": "ActionGroup", + "label": "Action group", + "type": 5, + "isRequired": true, + "query": "Resources\n| where type =~ 'microsoft.insights/actiongroups'\n| project value = id, label = id, selected = false, group = resourceGroup", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "value": null + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 0 - Copy" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "nav", + "links": [ + { + "linkTarget": "ArmTemplate", + "linkLabel": "Enable alert rule", + "style": "primary", + "linkIsContextBlade": true, + "templateRunContext": { + "componentIdSource": "parameter", + "componentId": "ResourceGroup", + "templateUriSource": "parameter", + "templateUri": "AlertTemplate", + "templateParameters": [ + { + "name": "alertName", + "source": "parameter", + "value": "AlertName", + "kind": "value" + }, + { + "name": "alertLocation", + "source": "parameter", + "value": "Location", + "kind": "value" + }, + { + "name": "dataSourceId", + "source": "parameter", + "value": "Workspace", + "kind": "value" + }, + { + "name": "actionGroupId", + "source": "parameter", + "value": "ActionGroup", + "kind": "value" + }, + { + "name": "alertThreshold", + "source": "parameter", + "value": "AlertThreshold", + "kind": "value" + } + ], + "titleSource": "static", + "title": "Create log alert", + "descriptionSource": "static", + "description": "Ready to deploy your log alert.", + "runLabelSource": "static", + "runLabel": "Deploy log alert" + } + } + ] + }, + "name": "links - 1", + "styleSettings": { + "margin": "25px 0.0 0 " + } + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/Create log alert/settings.json b/Workloads/Workbooks/Create log alert/settings.json new file mode 100644 index 0000000..73a303d --- /dev/null +++ b/Workloads/Workbooks/Create log alert/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Create log alert", + "author": "Microsoft", + "galleries": [ + { "type": "workloads-shared", "resourceType": "Azure Monitor", "order": 500 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/Enable monitoring group/Enable monitoring group.workbook b/Workloads/Workbooks/Enable monitoring group/Enable monitoring group.workbook new file mode 100644 index 0000000..adf05db --- /dev/null +++ b/Workloads/Workbooks/Enable monitoring group/Enable monitoring group.workbook @@ -0,0 +1,355 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "d1c4f8e4-96b6-48e1-9baa-da83b7c811c4", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + ], + "typeSettings": { + "additionalResourceOptions": [], + "includeAll": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "ef077188-ac30-4b38-84cc-2d2758baa550", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where type =~ 'microsoft.compute/virtualmachines'\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "48430e34-20cc-4d65-8cd4-f7cfd9e7e31d", + "version": "KqlParameterItem/1.0", + "name": "WorkloadTag", + "type": 1, + "isRequired": true, + "value": "mssql", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components" + }, + { + "id": "c4abc1cf-1ebf-4289-999c-76e64884fc0f", + "version": "KqlParameterItem/1.0", + "name": "OnboardingTemplate", + "type": 1, + "isRequired": true, + "value": "Community-Workbooks/Workloads/Onboard MSSQL Insights", + "resourceType": "microsoft.insights/components" + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "parameters - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "83902f33-0ca2-4de1-a90e-7f07953f86a1", + "version": "KqlParameterItem/1.0", + "name": "Tags", + "type": 2, + "isRequired": true, + "query": "Resources\n| where id in~ ({Resources})\n| project id, tags\n| mvexpand tags limit 400\n| extend tn = extract(@'{\"(.+)\"\\:\\\".+\"}', 1, tostring (tags)), tv = extract(@'{\".+\"\\:\\\"(.+)\"}', 1, tostring (tags))\n| where tv != '' and tv != ''\n| summarize by tn, tv\n| order by tn asc, tv asc\n| project value = tostring(pack('tn', tn, 'tv', tv)), label = tv, selected = false, group = tn\n| union (datatable(value:string, label:string, selected:boolean, group:string)[\n\"{\\\"tn\\\":\\\"*\\\"}\", \"Include all\", true, \"\"\n])", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "8c04ac65-462b-4080-807e-0f0182114275", + "version": "KqlParameterItem/1.0", + "name": "VmsWithTag", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({Resources})\n| project id, tags\n| mvexpand tags limit 400\n| extend tn = extract(@'{\"(.+)\"\\:\\\".+\"}', 1, tostring (tags)), tv = extract(@'{\".+\"\\:\\\"(.+)\"}', 1, tostring (tags))\n| extend selectedTag = dynamic({Tags})\n| where selectedTag.tn == '*' or (selectedTag.tn == tn and selectedTag.tv == tv)\n| project value = id, label = id, selected = true\n", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Resources\r\n| where id in~ ({VmsWithTag})\r\n| project ['Virtual machine'] = tolower(id), Name = name, ['Resource group'] = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), Subscription = subscriptionId, Location = location, OsType = iff(properties.osProfile.windowsConfiguration == '', 'Linux', 'Windows'), Offer = tostring(properties.storageProfile.imageReference.offer)\r\n//| where Offer == 'UbuntuServer' //and Location == 'centralus'\r\n| join kind = leftouter (Resources\r\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring'\r\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), WorkspaceId = tostring(properties.settings.workspaceId)\r\n | where Vm != ''\r\n ) on $left.['Virtual machine'] == $right.Vm\r\n| join kind = leftouter (Resources\r\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\r\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\r\n | where Vm != ''\r\n ) on $left.['Virtual machine'] == $right.Vm\r\n| project-away Vm, Vm1\r\n| join kind = leftouter (Resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project Workspace = id, location, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\r\n| project ['Virtual machine'], Name, ['Resource group'], Subscription, Workspace, Location, State = case(Workspace == '' or Location !in ('eastus', 'centralus', 'westus', 'eastus2', 'westus2', 'eastasia', 'southeastasia', 'northeurope', 'westeurope', 'francecentral', 'uksouth', 'ukwest', 'centralindia', 'japanwest') or Offer != 'UbuntuServer', 'Not supported', Insight == '{WorkloadTag}', 'Monitored', 'Not Monitored'), Action = case(Workspace == '' or Location !in ('eastus', 'centralus', 'westus', 'eastus2', 'westus2', 'eastasia', 'southeastasia', 'northeurope', 'westeurope', 'francecentral', 'uksouth', 'ukwest', 'centralindia', 'japanwest') or Offer != 'UbuntuServer', 'Not supported', Insight == '{WorkloadTag}', 'Update settings', Insight != '{WorkloadTag}', 'Enable monitoring', ''), ['Enabled insights'] = Insight, Template = case(Workspace == '' or Location !in ('eastus', 'centralus', 'westus', 'eastus2', 'westus2', 'eastasia', 'southeastasia', 'northeurope', 'westeurope', 'francecentral', 'uksouth', 'ukwest', 'centralindia', 'japanwest') or Offer != 'UbuntuServer', 'Community-Workbooks/Workloads/Monitoring checklist', '{OnboardingTemplate}')\r\n| extend Rank = case(Action == 'Update settings', 0, Action == 'Enable monitoring', 1, 2) \r\n| order by Rank asc, Name asc\r\n| project-away Rank\r\n| extend Troubleshooting = iff([\"Enabled insights\"] == \"{WorkloadTag}\", \"Collection logs\", \"\")", + "size": 2, + "title": "Enable monitoring", + "exportedParameters": [ + { + "fieldName": "Virtual machine", + "parameterName": "Resource", + "parameterType": 5 + }, + { + "fieldName": "Workspace", + "parameterName": "Workspace", + "parameterType": 5 + } + ], + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "value::all" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Virtual machine", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Name", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Resource group", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": { + "linkTarget": "Resource" + } + }, + { + "columnMatch": "Workspace", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Location", + "formatter": 17, + "formatOptions": {} + }, + { + "columnMatch": "State", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Monitored", + "representation": "success", + "text": "Enabled" + }, + { + "operator": "==", + "thresholdValue": "Not supported", + "representation": "Blank", + "text": "--" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "failed", + "text": "Disabled" + } + ] + } + }, + { + "columnMatch": "Action", + "formatter": 1, + "formatOptions": { + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Virtual machine", + "resourceIdsSource": "column", + "resourceIds": "Virtual machine", + "templateIdSource": "column", + "templateId": "Template", + "typeSource": "static", + "type": "workbook", + "gallerySource": "static", + "gallery": "microsoft.operationalinsights/workspaces", + "locationSource": "workbook" + }, + "templateRunContext": { + "componentIdSource": "column", + "componentId": "Resource group", + "templateUriSource": "static", + "templateUri": "https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/DeployVme/azuredeploy.json", + "templateParameters": [ + { + "name": "vmName", + "source": "column", + "value": "Name" + } + ], + "titleSource": "static", + "title": "Enable Azure Monitor for Microsoft SQL", + "descriptionSource": "static", + "description": "![SQL logo](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/DeployVme/sql-logo.jpg)\n\nSQL Server environments are becoming more complex while remaining a critical component of your application architecture. It’s a struggle to keep up with this continual growth without the right SQL monitoring tools. What if you could proactively manage your SQL Server environment and diagnose database performance issues by viewing the health of all your SQL Server instances on a single screen, anytime, anywhere on any device? You can with the right SQL Server monitoring tool.\n\nWith Azure Monitor for SQL Server, you can manage your SQL Server environment while also gaining visibility into your operating system – Windows or Linux – and also monitor your virtualization infrastructure. Make configuration a breeze with templates, automated alerts and customizable actions. Spend less time fighting fires by accurately diagnosing real-time and historical database performance issues, and focus on more proactive measures like query tuning.\n\n", + "runLabelSource": "static", + "runLabel": "Enable monitoring" + } + } + }, + { + "columnMatch": "Enabled insights", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Template", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Troubleshooting", + "formatter": 7, + "formatOptions": { + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Virtual machine", + "resourceIdsSource": "column", + "resourceIds": "Virtual machine", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Workloads/Collection logs", + "typeSource": "static", + "type": "Azure Monitor", + "gallerySource": "static", + "gallery": "workbook", + "locationSource": "default" + } + } + }, + { + "columnMatch": "WorkspaceLocation", + "formatter": 5, + "formatOptions": {} + } + ], + "rowLimit": 1000, + "filter": true, + "labelSettings": [ + { + "columnId": "Virtual machine" + }, + { + "columnId": "Name" + }, + { + "columnId": "Resource group" + }, + { + "columnId": "Subscription" + }, + { + "columnId": "Workspace" + }, + { + "columnId": "Location" + }, + { + "columnId": "State", + "label": "Monitoring" + }, + { + "columnId": "Action" + } + ] + }, + "sortBy": [] + }, + "name": "Enable monitoring", + "styleSettings": { + "margin": "10px 0 0 0" + } + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/Enable monitoring group/settings.json b/Workloads/Workbooks/Enable monitoring group/settings.json new file mode 100644 index 0000000..80ab4ed --- /dev/null +++ b/Workloads/Workbooks/Enable monitoring group/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Enable monitoring group", + "author": "Microsoft", + "galleries": [ + { "type": "workloads-shared", "resourceType": "Azure Monitor", "order": 400 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/Explore metrics group/Explore metrics group.workbook b/Workloads/Workbooks/Explore metrics group/Explore metrics group.workbook new file mode 100644 index 0000000..76bd3d5 --- /dev/null +++ b/Workloads/Workbooks/Explore metrics group/Explore metrics group.workbook @@ -0,0 +1,201 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "4c005545-b047-44a5-815b-40fa6c21069c", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "value": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.operationalinsights/workspaces": true + }, + "additionalResourceOptions": [ + "value::all" + ] + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "1de9a3bf-5455-4532-9a8b-daf2cfe62459", + "version": "KqlParameterItem/1.0", + "name": "OnboardedComputers", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\n {\"value\":\"c1\", \"label\":\"c1\", \"selected\":true }\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "58d462ec-1c70-4f66-91df-45d6d024a297", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 14400000 + }, + "isHiddenWhenLocked": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + }, + { + "id": "d96a773c-653b-468b-bba0-33925dabe752", + "version": "KqlParameterItem/1.0", + "name": "Metric", + "type": 2, + "isRequired": true, + "query": "InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \n| summarize by Namespace, Name\n| order by Namespace asc, Name asc\n| extend Row = row_number()\n| project value = strcat(Namespace, \"/\", Name), label = Name, selected = Row == 1, group = Namespace", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": null, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "1e8a0803-aff5-45d4-990a-29923479851b", + "version": "KqlParameterItem/1.0", + "name": "Aggregation", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\n { \"value\":\"avg(Val)\", \"label\":\"Average\", \"selected\":\"true\" },\n { \"value\":\"sum(Val)\", \"label\":\"Sum\", \"selected\":\"false\" },\n { \"value\":\"min(Val)\", \"label\":\"Minimum\", \"selected\":\"false\" },\n { \"value\":\"max(Val)\", \"label\":\"Maximum\", \"selected\":\"false\" },\n { \"value\":\"count()\", \"label\":\"Count\", \"selected\":\"false\" }\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 1", + "styleSettings": { + "margin": "15px 0 10px 0" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and strcat(Namespace, '/', Name) == '{Metric}'\n| make-series Trend = {Aggregation} default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer\n", + "size": 0, + "aggregation": 3, + "showAnalytics": true, + "title": "{Metric:label} trend", + "timeContext": { + "durationMs": 86400000 + }, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "chartSettings": { + "xSettings": {}, + "ySettings": { + "min": 0 + } + } + }, + "showPin": true, + "name": "Metric trend" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/Explore metrics group/settings.json b/Workloads/Workbooks/Explore metrics group/settings.json new file mode 100644 index 0000000..53cbee8 --- /dev/null +++ b/Workloads/Workbooks/Explore metrics group/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Explore metrics group", + "author": "Microsoft", + "galleries": [ + { "type": "workloads-shared", "resourceType": "Azure Monitor", "order": 400 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/Monitoring checklist/Monitoring checklist.workbook b/Workloads/Workbooks/Monitoring checklist/Monitoring checklist.workbook new file mode 100644 index 0000000..b3a2d17 --- /dev/null +++ b/Workloads/Workbooks/Monitoring checklist/Monitoring checklist.workbook @@ -0,0 +1,123 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "### Can I monitor using this virtual machine?\n\n" + }, + "name": "text - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "c6973909-3b98-425e-9a6d-74b5ed161702", + "version": "KqlParameterItem/1.0", + "name": "DefaultVirtualMachine", + "label": "Default virtual machine", + "type": 5, + "isRequired": true, + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "85015818-38b5-44f1-ac2c-a29c14420459", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| summarize Count = countif(id =~ '{DefaultVirtualMachine}') by subscriptionId\n| project value = subscriptionId, label = subscriptionId, selected = Count > 0", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d5f0fc61-75c4-4fad-9035-daa1bc652be2", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachine", + "label": "Virtual machine", + "type": 5, + "query": "Resources\n| where type =~ 'microsoft.compute/virtualmachines'\n| project value = id, label = id, selected = id =~ '{DefaultVirtualMachine}', group = resourceGroup", + "crossComponentResources": [ + "{Subscription}" + ], + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "fbc8b0f8-bcb2-4ca7-938d-5578e966a7c2", + "version": "KqlParameterItem/1.0", + "name": "OnboardingStatus", + "label": "Onboarding status", + "type": 1, + "isRequired": true, + "query": "Resources\n| where id == '{VirtualMachine}'\n| project ['Virtual machine'] = tolower(id), Name = name, ['Resource group'] = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), Subscription = subscriptionId, Location = location, OsType = iff(properties.osProfile.windowsConfiguration == '', 'Linux', 'Windows'), Offer = tostring(properties.storageProfile.imageReference.offer)\n//| where Offer == 'UbuntuServer' //and Location == 'centralus'\n| join kind = leftouter (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), WorkspaceId = tostring(properties.settings.workspaceId)\n | where Vm != ''\n ) on $left.['Virtual machine'] == $right.Vm\n| join kind = leftouter (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != ''\n ) on $left.['Virtual machine'] == $right.Vm\n| project-away Vm, Vm1\n| join kind = leftouter (Resources\n| where type =~ 'microsoft.operationalinsights/workspaces'\n| project Workspace = id, location, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\n| project-away ['Virtual machine'], ['Resource group'], Subscription, Insight, WorkspaceId1, location\n| project tostring(pack_all())\n", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "77d59cac-0e77-4a4f-9857-8586aa7ca26e", + "version": "KqlParameterItem/1.0", + "name": "Text", + "type": 1, + "query": "Resources\n| take 1\n| project x = dynamic({OnboardingStatus})\n| project label = strcat('**Virtual machine: ', x.Name, '**',\n '

',\n strcat(iff(x.Location in~ ('eastus', 'centralus', 'westus', 'eastus2', 'westus2', 'eastasia', 'southeastasia', 'northeurope', 'westeurope', 'francecentral', 'uksouth', 'ukwest', 'centralindia', 'japanwest'), '✅', '❌'), ' Located in ', x.Location),\n '

',\n strcat(iff(x.OsType =~ 'linux', '✅', '❌'), ' OS is ', x.OsType),\n '

',\n strcat(iff(x.Offer =~ 'ubuntuserver', '✅', '❌'), ' OS offer is ', x.Offer),\n '

',\n strcat(iff(x.WorkspaceId != '', '✅', '❌'), ' Configured with the Log Analytics agent'),\n '

',\n strcat(iff(x.Workspace != '', '✅', '❌'), ' Sufficient access to the Log Analytics workspace')\n )", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 0", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "{Text}" + }, + "name": "text - 2", + "styleSettings": { + "margin": "20px 0 0 0 " + } + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/Monitoring checklist/settings.json b/Workloads/Workbooks/Monitoring checklist/settings.json new file mode 100644 index 0000000..bffdd7d --- /dev/null +++ b/Workloads/Workbooks/Monitoring checklist/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Monitoring checklist", + "author": "Microsoft", + "galleries": [ + { "type": "workloads-shared", "resourceType": "Azure Monitor", "order": 500 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/MySQL Insights/MySQL Insights.workbook b/Workloads/Workbooks/MySQL Insights/MySQL Insights.workbook new file mode 100644 index 0000000..c3f8231 --- /dev/null +++ b/Workloads/Workbooks/MySQL Insights/MySQL Insights.workbook @@ -0,0 +1,855 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "a9f2f311-a9a7-45ae-93d7-f1fe6e07fa02", + "version": "KqlParameterItem/1.0", + "name": "WorkloadTag", + "type": 1, + "isRequired": true, + "value": "mysql", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components" + }, + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All subscriptions with virtual machines", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines'\r\n| project id = tolower(id), subscriptionId\r\n| join kind = leftouter (Resources\r\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\r\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\r\n | where Vm != '' and Insight == '{WorkloadTag}'\r\n ) on $left.id == $right.Vm\r\n| summarize Onboarded = countif(Vm != ''), All = count() by subscriptionId\r\n| order by Onboarded desc, All desc\r\n| extend Row = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Row == 1\r\n", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "f60ea0a0-3703-44ca-a59b-df0246423f41", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "All virtual machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines'\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = name, selected = false, group = resourceGroup", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "5e510131-51a9-40c0-b1a8-328932b5f46e", + "version": "KqlParameterItem/1.0", + "name": "OnboardedComputers", + "label": "Monitored VMs", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": " Resources\n| where id in~ ({Resources})\n| project ['Virtual machine'] = tolower(id), Name = name\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == '{WorkloadTag}'\n ) on $left.['Virtual machine'] == $right.Vm\n| project Name\n", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "", + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "4908b8cf-7658-4356-9aa5-5dc5aca7a1aa", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "619bf90b-5093-47cc-83a3-bf009257bc7d", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({Resources})\n| project ['Virtual machine'] = tolower(id), Name = name, ['Resource group'] = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), Subscription = subscriptionId, Location = location, OsType = iff(properties.osProfile.windowsConfiguration == '', 'Linux', 'Windows'), Offer = tostring(properties.storageProfile.imageReference.offer)\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == '{WorkloadTag}'\n ) on $left.['Virtual machine'] == $right.Vm\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), WorkspaceId = tostring(properties.settings.workspaceId)\n | where Vm != ''\n ) on $left.['Virtual machine'] == $right.Vm\n| project-away Vm, Vm1\n| join kind = leftouter (Resources\n| where type =~ 'microsoft.operationalinsights/workspaces'\n| project Workspace = id, location, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\n| summarize by Workspace\n| project value = Workspace, label = Workspace, selected = true\n", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e6598941-f9f5-4deb-bd0d-48658ade8297", + "version": "KqlParameterItem/1.0", + "name": "OnboardedComputerCount", + "type": 1, + "isRequired": true, + "query": " Resources\n| where id in~ ({Resources})\n| project ['Virtual machine'] = tolower(id), Name = name\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == '{WorkloadTag}'\n ) on $left.['Virtual machine'] == $right.Vm\n| count\n| project Count = tostring(Count)\n", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "label": "Onboarded computer count" + }, + { + "id": "bb7b9387-0445-4ee2-9fc7-f52cb9f59e8c", + "version": "KqlParameterItem/1.0", + "name": "TotalComputers", + "type": 1, + "query": "Resources\n| where type =~ 'microsoft.compute/virtualmachines'\n| count\n| project Count = tostring(Count)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "label": "Total computer count" + }, + { + "id": "e3f68984-22e6-4b7d-a6fd-114447050b03", + "version": "KqlParameterItem/1.0", + "name": "OnboardingTemplate", + "label": "Onboarding template", + "type": 1, + "isRequired": true, + "value": "Community-Workbooks/Workloads/Onboard MySQL Insights", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "*Virtual machines*\n# {OnboardedComputerCount} / {TotalComputers}\n*with MySQL monitoring*" + }, + "name": "text - 8", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Performance", + "subTarget": "Performance", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Networking", + "subTarget": "Networking", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "InnoDB", + "subTarget": "InnoDB", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Alerts", + "subTarget": "Alerts", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Explore metrics", + "subTarget": "Explore metrics", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Enable monitoring", + "subTarget": "Enable monitoring", + "style": "link" + } + ] + }, + "name": "links - 3", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == 'mysql' and Name in~ ('queries')\n| order by Computer asc, Name asc, TimeGenerated asc\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null))\n| where isnull(Value) == false;\ndata\n| summarize \n QueryCount = sumif(Value, Name == 'queries'),\n QueryRate = sumif(Value, Name == 'queries') / (({TimeRange:end} - {TimeRange:start}) / 1s)\n by Computer\n| join kind = inner (data\n| where Name == 'queries'\n| make-series QueryTrend = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer) on Computer\n| project Computer, QueryCount, QueryTrend, QueryRate\n", + "size": 0, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "QueryCount", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "QueryTrend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue" + } + }, + { + "columnMatch": "QueryRate", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "minimumFractionDigits": 1, + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 1000 + }, + "sortBy": [] + }, + "conditionalVisibility": { + "parameterName": "OnboardedComputerCount", + "comparison": "isNotEqualTo", + "value": "0" + }, + "showPin": true, + "name": "Overview" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "167a4f9a-2280-451e-8fb8-4bf3dacdc4ec", + "version": "KqlParameterItem/1.0", + "name": "SuggestedAlerts", + "type": 1, + "isRequired": true, + "value": "[ { \"AlertName\": \"host-high-cpu\", \"AlertDescription\": \"Fires when high CPU usage is detected on the host\", \"AlertThreshold\": 70, \"AlertTemplate\": \"https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Alerts/Host/Cpu/azuredeploy.json\" }, { \"AlertName\": \"host-used-memory-percentage\", \"AlertDescription\": \"Fires when Used Memory percentage on the host exceeds a threshold\", \"AlertThreshold\": 85, \"AlertTemplate\": \"https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Alerts/Host/Memory/azuredeploy.json\" } ]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 0" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Alerts group", + "items": [] + }, + "name": "Alert" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Alerts" + }, + "name": "Alert group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Explore metrics group", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Explore metrics" + }, + "name": "Explore metrics group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name in (\"com_insert\",\"com_select\",\"com_delete\",\"com_update\")\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null)), Series = strcat(Computer, \"/\", substring(Name,4))\r\n| make-series Connections = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series", + "size": 0, + "showAnalytics": true, + "title": "Queries", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name in (\"opened_files\",\"opened_tables\")\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null)), Series = strcat(Computer, \"/\", Name)\r\n| make-series Connections = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series", + "size": 0, + "showAnalytics": true, + "title": "Opened Files/Opened Tables", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name contains \"sort_\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null)), Series = strcat(Computer, \"/\", substring(Name,5))\r\n| make-series Connections = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series", + "size": 0, + "showAnalytics": true, + "title": "Sorts", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name == \"slow_queries\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null))\r\n| where isnull(Value) == false\r\n| make-series Connections = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer\r\n", + "size": 0, + "showAnalytics": true, + "title": "Slow queries", + "noDataMessage": "No slow queries detected", + "noDataMessageStyle": 3, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name in (\"qcache_inserts\",\"qcache_hits\")\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null)), Series = strcat(Computer, \"/\", substring(Name,7))\r\n| make-series Cache = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series", + "size": 0, + "showAnalytics": true, + "title": "Cache", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 7" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Performance" + }, + "name": "Performance" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name == \"connections\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null))\r\n| where isnull(Value) == false\r\n| make-series Connections = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "aggregation": 3, + "showAnalytics": true, + "title": "Active Connections", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name contains \"aborted\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null)), Series = strcat(Computer, \"/\", substring(Name,8))\r\n| make-series Connections = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series", + "size": 0, + "showAnalytics": true, + "title": "Aborted Connections", + "noDataMessage": "No aborted connections", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name contains \"connections_errors\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null)), Series = strcat(Computer, \"/\", substring(Name,12))\r\n| make-series Connections = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series", + "size": 0, + "showAnalytics": true, + "title": "Connection Errors", + "noDataMessage": "No connection errors detected", + "noDataMessageStyle": 3, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "gridSettings": { + "sortBy": [ + { + "itemKey": "Name", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "Name", + "sortOrder": 1 + } + ] + }, + "customWidth": "33", + "showPin": true, + "name": "query - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name == \"com_show_slave_status\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null))\r\n| where isnull(Value) == false\r\n| make-series Connections = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer\r\n", + "size": 0, + "showAnalytics": true, + "title": "Slave status", + "noDataMessage": "No slave data available", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name contains \"threads_\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null)), Series = strcat(Computer, \"/\", substring(Name,8))\r\n| make-series Connections = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series\r\n", + "size": 0, + "showAnalytics": true, + "title": "Thread Status", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name in (\"bytes_sent\",\"bytes_received\")\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null)), Series = strcat(Computer, \"/\", substring(Name,6))\r\n| make-series Connections = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series", + "size": 0, + "showAnalytics": true, + "title": "Bytes sent and received", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 4" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Networking" + }, + "name": "Networking" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name in (\"innodb_data_writes\",\"innodb_data_read\")\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null)), Series = strcat(Computer, \"/\", substring(Name,12))\r\n| make-series Cache = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series\r\n", + "size": 0, + "showAnalytics": true, + "title": "InnoDB Data", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name contains \"innodb_rows\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null)), Series = strcat(Computer, \"/\", substring(Name,12))\r\n| make-series Cache = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series", + "size": 0, + "showAnalytics": true, + "title": "InnoDB Rows", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"mysql\"\r\n| where Name contains \"innodb_pages\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null)), Series = strcat(Computer, \"/\", substring(Name,13))\r\n| make-series Cache = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series", + "size": 0, + "showAnalytics": true, + "title": "InnoDB Pages", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "33", + "showPin": true, + "name": "query - 2" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "InnoDB" + }, + "name": "InnoDB" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Enable monitoring group", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Enable monitoring" + }, + "name": "Enable monitoring group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/MySQL Insights/settings.json b/Workloads/Workbooks/MySQL Insights/settings.json new file mode 100644 index 0000000..0fad972 --- /dev/null +++ b/Workloads/Workbooks/MySQL Insights/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"MySQL Insights", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "order": 300 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/NGINX Insights/NGINX Insights.workbook b/Workloads/Workbooks/NGINX Insights/NGINX Insights.workbook new file mode 100644 index 0000000..8c3c047 --- /dev/null +++ b/Workloads/Workbooks/NGINX Insights/NGINX Insights.workbook @@ -0,0 +1,1092 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "a9f2f311-a9a7-45ae-93d7-f1fe6e07fa02", + "version": "KqlParameterItem/1.0", + "name": "WorkloadTag", + "type": 1, + "isRequired": true, + "value": "nginx", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components", + "label": "Workload tag" + }, + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All subscriptions with virtual machines", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines'\r\n| project id = tolower(id), subscriptionId\r\n| join kind = leftouter (Resources\r\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\r\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\r\n | where Vm != '' and Insight == '{WorkloadTag}'\r\n ) on $left.id == $right.Vm\r\n| summarize Onboarded = countif(Vm != ''), All = count() by subscriptionId\r\n| order by Onboarded desc, All desc\r\n| extend Row = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Row == 1\r\n", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "f60ea0a0-3703-44ca-a59b-df0246423f41", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "All virtual machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines'\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = name, selected = false, group = resourceGroup", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "5e510131-51a9-40c0-b1a8-328932b5f46e", + "version": "KqlParameterItem/1.0", + "name": "OnboardedComputers", + "label": "Monitored virtual machines", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": " Resources\n| where id in~ ({Resources})\n| project ['Virtual machine'] = tolower(id), Name = name\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == '{WorkloadTag}'\n ) on $left.['Virtual machine'] == $right.Vm\n| project Name\n", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "", + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "4908b8cf-7658-4356-9aa5-5dc5aca7a1aa", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "619bf90b-5093-47cc-83a3-bf009257bc7d", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({Resources})\n| project ['Virtual machine'] = tolower(id), Name = name, ['Resource group'] = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), Subscription = subscriptionId, Location = location, OsType = iff(properties.osProfile.windowsConfiguration == '', 'Linux', 'Windows'), Offer = tostring(properties.storageProfile.imageReference.offer)\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == 'nginx'\n ) on $left.['Virtual machine'] == $right.Vm\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), WorkspaceId = tostring(properties.settings.workspaceId)\n | where Vm != ''\n ) on $left.['Virtual machine'] == $right.Vm\n| project-away Vm, Vm1\n| join kind = leftouter (Resources\n| where type =~ 'microsoft.operationalinsights/workspaces'\n| project Workspace = id, location, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\n| summarize by Workspace\n| project value = Workspace, label = Workspace, selected = true\n", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e6598941-f9f5-4deb-bd0d-48658ade8297", + "version": "KqlParameterItem/1.0", + "name": "OnboardedComputerCount", + "type": 1, + "isRequired": true, + "query": " Resources\n| where id in~ ({Resources})\n| project ['Virtual machine'] = tolower(id), Name = name\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == '{WorkloadTag}'\n ) on $left.['Virtual machine'] == $right.Vm\n| count\n| project Count = tostring(Count)\n", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "label": "Onboarded computer count" + }, + { + "id": "bb7b9387-0445-4ee2-9fc7-f52cb9f59e8c", + "version": "KqlParameterItem/1.0", + "name": "TotalComputers", + "type": 1, + "query": "Resources\n| where type =~ 'microsoft.compute/virtualmachines'\n| count\n| project Count = tostring(Count)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "label": "Total computers count" + }, + { + "id": "73b7e4ff-24da-405c-9ad3-c9f398447f6b", + "version": "KqlParameterItem/1.0", + "name": "OnboardingTemplate", + "label": "Onboarding template", + "type": 1, + "isRequired": true, + "value": "Community-Workbooks/Workloads/Onboard Nginx Insights", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "*Virtual machines*\n# {OnboardedComputerCount} / {TotalComputers}\n*with NGINX monitoring*" + }, + "name": "text - 8", + "styleSettings": { + "margin": "15px 0 10px 0" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Requests", + "subTarget": "Requests", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "CPU", + "subTarget": "CPU", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Memory", + "subTarget": "Memory", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Network", + "subTarget": "Network", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Jobs", + "subTarget": "Jobs", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Alerts", + "subTarget": "Alerts", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Explore metrics", + "subTarget": "Explore metrics", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Enable monitoring", + "subTarget": "Enable monitoring", + "style": "link" + } + ] + }, + "name": "links - 3", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == 'nginx' and Name in~ ('requests', 'waiting')\n| order by Computer asc, Name asc, TimeGenerated asc\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null))\n| where isnull(Value) == false;\ndata\n| summarize \n RequestCount = sumif(Value, Name == 'requests'),\n WaitingRequestsRate = avgif(Value, Name == 'waiting') / (({TimeRange:end} - {TimeRange:start}) / 1s)\n by Computer\n| join kind = inner (data\n| where Name == 'requests'\n| make-series RequestTrend = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer) on Computer\n| join kind = leftouter (data\n| where Name == 'waiting'\n| make-series WaitingTrend = avg(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer) on Computer\n| join kind = inner (InsightsMetrics \n | where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == ('cpu') and Name == 'usage_idle'\n | where todynamic(Tags).cpu == 'cpu-total'\n | summarize Cpu = avg(100 - Val) by Computer\n ) on Computer\n| join kind = inner (InsightsMetrics \n | where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == 'mem' and Name == 'used_percent'\n | summarize MemoryUsed = avg(Val) by Computer\n ) on Computer\n| project Computer, RequestCount, RequestTrend, WaitingRequestsRate, WaitingTrend, Cpu, MemoryUsed\n| join kind = rightouter (datatable(Computer:string)[{OnboardedComputers}]) on Computer\n| extend Computer = Computer1\n| project-away Computer1\n", + "size": 0, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "RequestCount", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "RequestTrend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green" + } + }, + { + "columnMatch": "WaitingRequestsRate", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "yellow" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "WaitingTrend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "yellow" + } + }, + { + "columnMatch": "Cpu", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "blue" + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "MemoryUsed", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "blue" + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + } + ], + "sortBy": [ + { + "itemKey": "$gen_heatmap_RequestCount_1", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_RequestCount_1", + "sortOrder": 2 + } + ] + }, + "conditionalVisibility": { + "parameterName": "OnboardedComputerCount", + "comparison": "isNotEqualTo", + "value": "0" + }, + "showPin": true, + "name": "Overview" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "
\n### NGINX monitoring is not enabled for any virtual machine in this scope\n" + }, + "name": "text - 0" + } + ] + }, + "customWidth": "55", + "conditionalVisibility": { + "parameterName": "OnboardedComputerCount", + "comparison": "isEqualTo", + "value": "0" + }, + "name": "Empty overview" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "![Nginx logo](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Nginx/nginx-logo.jpg)\n\n" + }, + "name": "text - 0", + "styleSettings": { + "margin": "0 0 0 100px" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "OnboardedComputerCount", + "comparison": "isEqualTo", + "value": "0" + }, + "name": "Empty overview - Copy" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "
\nUse the scope picker on topto find configured virtual machines in other subscriptions or resource groups. You can also turn on NGINX monitoring on your virtual machines in this scope using the **Enable monitoring** tab\n\n" + }, + "name": "text - 0" + } + ] + }, + "customWidth": "55", + "conditionalVisibility": { + "parameterName": "OnboardedComputerCount", + "comparison": "isEqualTo", + "value": "0" + }, + "name": "Empty overview - Copy" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == 'nginx' and Name == 'requests'\n| order by Computer asc, Name asc, TimeGenerated asc\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name), Val - prev(Val), real(null))\n| where isnull(Value) == false\n| make-series Trend = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer\n", + "size": 0, + "showAnalytics": true, + "title": "Requests (sum)", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart" + }, + "showPin": true, + "name": "Requests" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == 'nginx' and Name != 'requests'\n| order by Computer asc, Name asc, TimeGenerated asc\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val >= prev(Val), Val - prev(Val), real(null))\n| where isnull(Value) == false\n| make-series Trend = avg(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Name\n", + "size": 0, + "aggregation": 3, + "showAnalytics": true, + "title": "Request state snapshots (average)", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "areachart" + }, + "showPin": true, + "name": "Status snapshots" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Requests" + }, + "name": "Requests group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == 'net' and Name == 'bytes_recv'\n| order by Computer asc, Name asc, TimeGenerated asc\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name), Val - prev(Val), real(null))\n| where isnull(Value) == false\n| make-series Trend = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer\n", + "size": 0, + "showAnalytics": true, + "title": "Bytes received", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "chartSettings": { + "xSettings": {}, + "ySettings": { + "numberFormatSettings": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "Bytes received" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == 'net' and Name == 'bytes_sent'\n| order by Computer asc, Name asc, TimeGenerated asc\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name), Val - prev(Val), real(null))\n| where isnull(Value) == false\n| make-series Trend = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer\n", + "size": 0, + "showAnalytics": true, + "title": "Bytes sent", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "chartSettings": { + "xSettings": {}, + "ySettings": { + "numberFormatSettings": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "Bytes sent" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == 'net' and Name == 'tcp_activeopens'\n| order by Computer asc, Name asc, TimeGenerated asc\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name), Val - prev(Val), real(null))\n| where isnull(Value) == false\n| make-series Trend = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer\n", + "size": 0, + "showAnalytics": true, + "title": "TCP - active opens", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "TCP active opens" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == 'net' and Name == 'tcp_estabresets'\n| order by Computer asc, Name asc, TimeGenerated asc\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name), Val - prev(Val), real(null))\n| where isnull(Value) == false\n| make-series Trend = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer\n", + "size": 0, + "showAnalytics": true, + "title": "TCP - estabresets", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "TCP estabresets" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Network" + }, + "name": "Network group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == 'cpu' and Name == 'usage_idle'\n| make-series Trend = avg(100 - Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer\n", + "size": 0, + "aggregation": 3, + "showAnalytics": true, + "title": "CPU utilization by Computer", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart" + }, + "showPin": true, + "name": "CPU" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == 'cpu' and Name != 'usage_idle'\n| make-series Trend = avg(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Name\n", + "size": 0, + "aggregation": 3, + "showAnalytics": true, + "title": "CPU utilization by type", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "areachart" + }, + "showPin": true, + "name": "CPU - Copy" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "CPU" + }, + "name": "CPU group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == 'mem' and Name in ('available')\n| make-series Trend = avg(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer\n", + "size": 0, + "aggregation": 3, + "showAnalytics": true, + "title": "Memory available", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "chartSettings": { + "xSettings": {}, + "ySettings": { + "min": 0 + } + } + }, + "showPin": true, + "name": "Memory available" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Memory" + }, + "name": "Memory group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Namespace == \"nginx\"\r\n| where Name == \"requests\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name), Val - prev(Val), real(null))\r\n| where isnull(Value) == false\r\n| make-series Trend = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "All Requests", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Namespace == \"nginx\"\r\n| where Name == \"active\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Actives", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "sortBy": [] + }, + "customWidth": "50", + "showPin": true, + "name": "active" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Namespace == \"nginx\"\r\n| where Name == \"accepts\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name), Val - prev(Val), real(null))\r\n| where isnull(Value) == false\r\n| make-series Trend = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "showAnalytics": true, + "title": "Accepts", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "sortBy": [] + }, + "customWidth": "50", + "showPin": true, + "name": "accepts" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Namespace == \"nginx\"\r\n| where Name == \"handled\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name), Val - prev(Val), real(null))\r\n| where isnull(Value) == false\r\n| make-series Trend = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Handled", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "sortBy": [] + }, + "customWidth": "50", + "showPin": true, + "name": "handled" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Namespace == \"nginx\"\r\n| where Name == \"reading\"\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Reading", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "sortBy": [] + }, + "customWidth": "50", + "showPin": true, + "name": "Reading" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Namespace == \"nginx\"\r\n| where Name == \"waiting\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "showAnalytics": true, + "title": "Waiting", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Namespace == \"nginx\"\r\n| where Name == \"writing\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name), Val - prev(Val), real(null))\r\n| where isnull(Value) == false\r\n| make-series Trend = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "showAnalytics": true, + "title": "Writing", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 6" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Jobs" + }, + "name": "group - 10" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "167a4f9a-2280-451e-8fb8-4bf3dacdc4ec", + "version": "KqlParameterItem/1.0", + "name": "SuggestedAlerts", + "type": 1, + "isRequired": true, + "value": "[ { \"AlertName\": \"host-high-cpu\", \"AlertDescription\": \"Fires when high CPU usage is detected on the host\", \"AlertThreshold\": 70, \"AlertTemplate\": \"https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Alerts/Host/Cpu/azuredeploy.json\" }, { \"AlertName\": \"host-used-memory-percentage\", \"AlertDescription\": \"Fires when Used Memory percentage on the host exceeds a threshold\", \"AlertThreshold\": 85, \"AlertTemplate\": \"https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Alerts/Host/Memory/azuredeploy.json\" } ]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 0" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Alerts group", + "items": [] + }, + "name": "Alert" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Alerts" + }, + "name": "Alert group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Explore metrics group", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Explore metrics" + }, + "name": "Explore metrics group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Enable monitoring group", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Enable monitoring" + }, + "name": "Onboarding group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/NGINX Insights/settings.json b/Workloads/Workbooks/NGINX Insights/settings.json new file mode 100644 index 0000000..411ed05 --- /dev/null +++ b/Workloads/Workbooks/NGINX Insights/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"NGINX Insights", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "order": 500 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/Onboard MSSQL Insights/Onboard MSSQL Insights.workbook b/Workloads/Workbooks/Onboard MSSQL Insights/Onboard MSSQL Insights.workbook new file mode 100644 index 0000000..0eb739a --- /dev/null +++ b/Workloads/Workbooks/Onboard MSSQL Insights/Onboard MSSQL Insights.workbook @@ -0,0 +1,389 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "0d87fd70-3f59-4824-b3ac-9867394090a5", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachine", + "type": 5, + "isRequired": true, + "value": "value::1", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5f0382e3-69e0-40be-ad21-cca781fe81e1", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring' and id startswith '{VirtualMachine}'\r\n| project WorkspaceId = tostring(properties.settings.workspaceId)\r\n| join kind = inner (Resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\r\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "b189ae66-10a0-417b-8e1e-dc3b9b4ae028", + "version": "KqlParameterItem/1.0", + "name": "WorkspaceLocation", + "type": 8, + "isRequired": true, + "query": "Resources\r\n| where id =~ '{Workspace}'\r\n| project value = location, label = location, selected = true\r\n", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "504c4e1f-42e8-4628-adfe-17fa76991377", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroup", + "type": 1, + "isRequired": true, + "query": "Resources\r\n| where id =~ '{VirtualMachine}'\r\n| project rg = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)", + "crossComponentResources": [ + "value::all" + ], + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "ddd077a9-ac70-4970-a6b3-1cf74224e9d8", + "version": "KqlParameterItem/1.0", + "name": "VmRegion", + "type": 8, + "isRequired": true, + "query": "Resources\r\n| where id =~ '{VirtualMachine}'\r\n| project value = location, label = location, selected = true", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "armparameters" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Azure Monitor for Microsoft SQL Server" + }, + "name": "infoText" + }, + { + "type": 1, + "content": { + "json": "![SQL logo](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Logos/sql-logo.jpg)\r\n" + }, + "name": "mssqllogo", + "styleSettings": { + "margin": "20px 0 0 20px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Prerequisites", + "subTarget": "Prerequisites", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Configure monitoring", + "subTarget": "Configure", + "style": "link" + } + ] + }, + "name": "tabs", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "SQL Server environments are becoming more complex while remaining a critical component of your application architecture. It’s a struggle to keep up with this continual growth without the right SQL monitoring tools. What if you could proactively manage your SQL Server environment and diagnose database performance issues by viewing the health of all your SQL Server instances on a single screen, anytime, anywhere on any device? You can with the right SQL Server monitoring tool.\n\nWith Azure Monitor for SQL Server, you can manage your SQL Server environment while also gaining visibility into your operating system – Windows or Linux – and also monitor your virtualization infrastructure. Make configuration a breeze with templates, automated alerts and customizable actions. Spend less time fighting fires by accurately diagnosing real-time and historical database performance issues, and focus on more proactive measures like query tuning.\n\n" + }, + "name": "mssqlinformation" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "#### Create SQL user accounts\nYou have to create a login on every instance you want to monitor, with following script:\n\n```\nUSE master;\nGO\nCREATE LOGIN [telegraf] WITH PASSWORD = N'mystrongpassword';\nGO\nGRANT VIEW SERVER STATE TO [telegraf];\nGO\nGRANT VIEW ANY DEFINITION TO [telegraf];\nGO\n```\n\nFor Azure SQL Database, you require the View Database State permission and can create a user with a password directly in the database.\n\n```\nCREATE USER [telegraf] WITH PASSWORD = N'mystrongpassword';\nGO\nGRANT VIEW DATABASE STATE TO [telegraf];\nGO\n```\n\n#### Enable firewall rules\nEnable firewall rules to allow the remote monitoring virtual machine to access the SQL Server instance." + }, + "name": "prerequisitesmssqlremote" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Prerequisites" + }, + "name": "Prerequisites group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "Azure Monitor needs access to the health information stored in SQL Server dynamic management view tables. Please provide the *connection string* to allow this access below. More information about the format of connection strings can be found below." + }, + "name": "samplemysqlconnectionstring" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "0fcd1a59-1ca7-4e29-a0c7-6eb5b032ef6a", + "version": "KqlParameterItem/1.0", + "name": "TelegrafConfig", + "label": "MSSQL connection strings", + "type": 1, + "isRequired": true, + "value": "[[inputs.sqlserver]]\r\n servers = [\r\n 'Server=mysqlserver.database.windows.net;Port=1433;database=mydb;User Id=;Password=;app name=telegraf;log=1;',\r\n ]\r\n query_version = 2\r\n exclude_query = [ 'Schedulers' , 'SqlRequests']\r\n\r\n [inputs.sqlserver.tags]\r\n insight = \"mssql\"", + "typeSettings": { + "multiLineText": true, + "editorLanguage": "text" + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "293d29d9-d41b-43fa-9f39-cca636c83b23", + "version": "KqlParameterItem/1.0", + "name": "ServerUpdated", + "type": 1, + "isRequired": true, + "query": "Resources\n| take 1\n| project x = iff(\"{TelegrafConfig:escapejson}\" !contains \"Server=mysqlserver.database.windows.net;Port=1433;database=mydb;User Id=;Password=;app name=telegraf;log=1;\", \"updated\", \"not updated\")", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "formVertical", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "telegrafconfigfield" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "f", + "linkTarget": "ArmTemplate", + "linkLabel": "Enable SQL monitoring", + "style": "primary", + "linkIsContextBlade": true, + "templateRunContext": { + "componentIdSource": "parameter", + "componentId": "ResourceGroup", + "templateUriSource": "static", + "templateUri": "https://azmonsolutions.blob.core.windows.net/workloadinsights/MSSql-watcherWorkload.json", + "templateParameters": [ + { + "name": "vmId", + "source": "parameter", + "value": "VirtualMachine", + "kind": "value" + }, + { + "name": "omsWorkspaceId", + "source": "parameter", + "value": "Workspace", + "kind": "value" + }, + { + "name": "workspaceRegion", + "source": "parameter", + "value": "WorkspaceLocation", + "kind": "value" + }, + { + "name": "serializedTelegrafConfig", + "source": "parameter", + "value": "TelegrafConfig", + "kind": "value" + }, + { + "name": "vmRegion", + "source": "parameter", + "value": "VmRegion", + "kind": "value" + } + ], + "titleSource": "static", + "title": "Enable Azure Monitor for Microsoft SQL Server", + "descriptionSource": "static", + "description": "![SQL logo](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Logos/sql-logo.jpg)\r\n\r\n
\r\n
\r\nWe're ready to enable Azure Monitor for SQL Server to your virtual machine! Choose **Enable monitoring** to start monitoring with the recommended settings.\r\n", + "runLabelSource": "static", + "runLabel": "Enable monitoring" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "TelegrafConfig", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "TelegrafConfig", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "VirtualMachine", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "Workspace", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "WorkspaceLocation", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "VmRegion", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ResourceGroup", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ServerUpdated", + "comparison": "isEqualTo", + "value": "updated" + } + ], + "name": "enablemssqlmonitoringlink", + "styleSettings": { + "margin": "20px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "💡 Please update the `servers` array in the MSSQL Telegraf config to enable monitoring." + }, + "conditionalVisibility": { + "parameterName": "ServerUpdated", + "comparison": "isEqualTo", + "value": "not updated" + }, + "name": "checkconfigvalidity" + }, + { + "type": 1, + "content": { + "json": "
\r\n**Learn about connection strings**\r\n\r\nProvide one ore more connection strings as a comma seperated collection of strings (within double-quotes):\r\n\r\n```\r\n\"Server=mysqlserver.database.windows.net;Port=1433;database=mydb;User Id=;Password=;app name=telegraf;log=1;\",\r\n\"Server=myothersqlserver.database.windows.net;Port=1433;database=mydb3;User Id=;Password=;app name=telegraf;log=1;\"\r\n```\r\nOr,\r\n```\r\n\"Server=127.0.0.1;Port=1433;database=mydb;User Id=;Password=;app name=telegraf;log=1;\"\r\n```\r\n\r\n\r\nSee https://github.com/denisenkom/go-mssqldb for detailed connection parameters." + }, + "name": "mysqlsampleconnectionstring" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Configure" + }, + "name": "Configure group" + } + ] + }, + "name": "Overview group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/Onboard MSSQL Insights/settings.json b/Workloads/Workbooks/Onboard MSSQL Insights/settings.json new file mode 100644 index 0000000..a37e3ab --- /dev/null +++ b/Workloads/Workbooks/Onboard MSSQL Insights/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Onboard MS SQL Insights", + "author": "Microsoft", + "galleries": [ + { "type": "workload-insights", "resourceType": "Azure Monitor", "order": 400 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/Onboard MySQL Insights/Onboard MySQL Insights.workbook b/Workloads/Workbooks/Onboard MySQL Insights/Onboard MySQL Insights.workbook new file mode 100644 index 0000000..6b3f1a9 --- /dev/null +++ b/Workloads/Workbooks/Onboard MySQL Insights/Onboard MySQL Insights.workbook @@ -0,0 +1,372 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "0d87fd70-3f59-4824-b3ac-9867394090a5", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachine", + "type": 5, + "isRequired": true, + "value": "value::1", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5f0382e3-69e0-40be-ad21-cca781fe81e1", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring' and id startswith '{VirtualMachine}'\r\n| project WorkspaceId = tostring(properties.settings.workspaceId)\r\n| join kind = inner (Resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\r\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "b189ae66-10a0-417b-8e1e-dc3b9b4ae028", + "version": "KqlParameterItem/1.0", + "name": "WorkspaceLocation", + "type": 8, + "isRequired": true, + "query": "Resources\r\n| where id =~ '{Workspace}'\r\n| project value = location, label = location, selected = true\r\n", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7b1d0a3f-4341-47a5-9f2c-990d5b1faaab", + "version": "KqlParameterItem/1.0", + "name": "VmRegion", + "type": 1, + "isRequired": true, + "query": "Resources\r\n| where id =~ '{VirtualMachine}'\r\n| project location", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "504c4e1f-42e8-4628-adfe-17fa76991377", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroup", + "type": 1, + "isRequired": true, + "query": "Resources\r\n| where id =~ '{VirtualMachine}'\r\n| project rg = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "armparameters" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Azure Monitor for MySQL" + }, + "name": "infoText" + }, + { + "type": 1, + "content": { + "json": "![MySQL logo](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Logos/mysql-logo.jpg)\r\n" + }, + "name": "mysqllogo", + "styleSettings": { + "margin": "20px 0 0 20px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Prerequisites", + "subTarget": "Prerequisites", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Configure monitoring", + "subTarget": "Configure", + "style": "link" + } + ] + }, + "name": "tabs", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "MySQL is the world's most popular Open Source SQL database management system. MySQL is highly scalable and can be operated from single desktops to clusters of machines. MySQL also offers hallmark reliability and availability features from master/slave replication configurations and specialized failover clusters. \n\nWith Azure Monitor for MySQL you can manage your MySQL servers with ease. With insights on performance, networking, and InnoDB, Azure Monitor for MySQL summarizes all the important metrics to keep your MySQL server up and running. Make configuration a breeze with templates, automated alerts and customizable actions.\n\n" + }, + "name": "MySQLInformation" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "Create a MySQL user with access to the monitoring tables:\n\n```\nCREATE USER 'telegraf'@'localhost' IDENTIFIED BY 'password';\n\nGRANT PROCESS ON *.* TO 'telegraf'@'localhost' REQUIRE NONE WITH \n MAX_QUERIES_PER_HOUR 0 MAX_CONNECTIONS_PER_HOUR 0 \n MAX_UPDATES_PER_HOUR 0 MAX_USER_CONNECTIONS 0;\n \nGRANT REPLICATION CLIENT ON *.* TO 'telegraf'@'localhost';\nGRANT SELECT ON `cluster\\_replication`.* TO 'telegraf'@'localhost';\nGRANT SELECT ON `information\\_schema`.* TO 'telegraf'@'localhost';\nGRANT SELECT ON `performance\\_schema`.* TO 'telegraf'@'localhost';\n```\nFor slow queries monitoring enable by setting slow_query_log for your MySQL configuration." + }, + "name": "prerequisitesmysql" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Prerequisites" + }, + "name": "Prerequisites group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "0fcd1a59-1ca7-4e29-a0c7-6eb5b032ef6a", + "version": "KqlParameterItem/1.0", + "name": "TelegrafConfig", + "label": "MySQL Telegraf config", + "type": 1, + "isRequired": true, + "value": "[[inputs.mysql]]\r\n servers = [\"telegraf:@tcp(127.0.0.1:3306)/\"]\r\n\t\r\n gather_table_schema = false\r\n gather_process_list = true\r\n gather_user_statistics = true\r\n gather_info_schema_auto_inc = false\r\n gather_innodb_metrics = false\r\n gather_slave_status = true\r\n gather_binary_logs = false\r\n gather_global_variables = false\r\n gather_table_io_waits = false\r\n gather_table_lock_waits = false\r\n gather_index_io_waits = false\r\n gather_event_waits = false\r\n gather_file_events_stats = false\r\n gather_perf_events_statements = false\r\n\r\n ## the limits for metrics form perf_events_statements\r\n perf_events_statements_digest_text_limit = 120\r\n perf_events_statements_limit = 250\r\n perf_events_statements_time_limit = 86400\r\n\r\n ## Some queries we may want to run less often (such as SHOW GLOBAL VARIABLES)\r\n ## example: interval_slow = \"30m\"\r\n # interval_slow = \"15m\"\r\n\r\n ## Optional TLS Config (will be used if tls=custom parameter specified in server uri)\r\n # tls_ca = \"/etc/telegraf/ca.pem\"\r\n # tls_cert = \"/etc/telegraf/cert.pem\"\r\n # tls_key = \"/etc/telegraf/key.pem\"\r\n ## Use TLS but skip chain & host verification\r\n # insecure_skip_verify = false\r\n\r\n metric_version = 2\r\n\r\n[[inputs.cpu]]\r\n percpu = true\r\n totalcpu = true\r\n collect_cpu_time = false\r\n report_active = false\r\n\r\n[[inputs.mem]]\r\n\r\n[[inputs.netstat]]\r\n\r\n[[inputs.disk]]\r\n\r\n[[inputs.diskio]]", + "typeSettings": { + "multiLineText": true, + "editorLanguage": "text" + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "293d29d9-d41b-43fa-9f39-cca636c83b23", + "version": "KqlParameterItem/1.0", + "name": "ServerUpdated", + "type": 1, + "isRequired": true, + "query": "Resources\n| take 1\n| project x = iff(\"{TelegrafConfig:escapejson}\" !contains \"telegraf:@tcp(127.0.0.1:3306)\", \"updated\", \"not updated\")", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "formVertical", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "telegrafconfigfield" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "f", + "linkTarget": "ArmTemplate", + "linkLabel": "Enable MySQL monitoring", + "style": "primary", + "linkIsContextBlade": true, + "templateRunContext": { + "componentIdSource": "parameter", + "componentId": "ResourceGroup", + "templateUriSource": "static", + "templateUri": "https://azmonsolutions.blob.core.windows.net/workloadinsights/MySQLWorkload.json", + "templateParameters": [ + { + "name": "vmId", + "source": "parameter", + "value": "VirtualMachine", + "kind": "value" + }, + { + "name": "omsWorkspaceId", + "source": "parameter", + "value": "Workspace", + "kind": "value" + }, + { + "name": "workspaceRegion", + "source": "parameter", + "value": "WorkspaceLocation", + "kind": "value" + }, + { + "name": "serializedTelegrafConfig", + "source": "parameter", + "value": "TelegrafConfig", + "kind": "value" + }, + { + "name": "vmRegion", + "source": "parameter", + "value": "VmRegion", + "kind": "value" + } + ], + "titleSource": "static", + "title": "Enable Azure Monitor for MySQL", + "descriptionSource": "static", + "description": "![MySQL logo](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Logos/mysql-logo.jpg)\r\n\r\n
\r\n
\r\nWe're ready to enable Azure Monitor for MySQL to your virtual machine! Choose **Enable monitoring** to start monitoring with the recommended settings.\r\n", + "runLabelSource": "static", + "runLabel": "Enable monitoring" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "TelegrafConfig", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "TelegrafConfig", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "VirtualMachine", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "Workspace", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "WorkspaceLocation", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "VmRegion", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ResourceGroup", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ServerUpdated", + "comparison": "isEqualTo", + "value": "updated" + } + ], + "name": "enablemysqlmonitoringlink", + "styleSettings": { + "margin": "20px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "💡 Please update the `servers` array in the MySQL Telegraf config to enable monitoring." + }, + "conditionalVisibility": { + "parameterName": "ServerUpdated", + "comparison": "isEqualTo", + "value": "not updated" + }, + "name": "checkconfigvalidity" + }, + { + "type": 1, + "content": { + "json": "Specify server using a URL matching this form: \r\n\r\n```\r\nuser:password@tcp(127.0.0.1:3306)/\r\n```\r\nFor instance,\r\n```\r\ntelegraf:password@tcp(127.0.0.1:3306)/\r\n```" + }, + "name": "ServerUriSample" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Configure" + }, + "name": "Configure group" + } + ] + }, + "name": "Overview group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/Onboard MySQL Insights/settings.json b/Workloads/Workbooks/Onboard MySQL Insights/settings.json new file mode 100644 index 0000000..4e8da4b --- /dev/null +++ b/Workloads/Workbooks/Onboard MySQL Insights/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Onboard MySQL Insights", + "author": "Microsoft", + "galleries": [ + { "type": "workload-insights", "resourceType": "Azure Monitor", "order": 600 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/Onboard Nginx Insights/Onboard Nginx Insights.workbook b/Workloads/Workbooks/Onboard Nginx Insights/Onboard Nginx Insights.workbook new file mode 100644 index 0000000..fc4cd63 --- /dev/null +++ b/Workloads/Workbooks/Onboard Nginx Insights/Onboard Nginx Insights.workbook @@ -0,0 +1,341 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "0d87fd70-3f59-4824-b3ac-9867394090a5", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachine", + "type": 5, + "isRequired": true, + "value": "value::1", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5f0382e3-69e0-40be-ad21-cca781fe81e1", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring' and id startswith '{VirtualMachine}'\r\n| project WorkspaceId = tostring(properties.settings.workspaceId)\r\n| join kind = inner (Resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\r\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "b189ae66-10a0-417b-8e1e-dc3b9b4ae028", + "version": "KqlParameterItem/1.0", + "name": "WorkspaceLocation", + "type": 8, + "isRequired": true, + "query": "Resources\r\n| where id =~ '{Workspace}'\r\n| project value = location, label = location, selected = true\r\n", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7b1d0a3f-4341-47a5-9f2c-990d5b1faaab", + "version": "KqlParameterItem/1.0", + "name": "VmRegion", + "type": 1, + "isRequired": true, + "query": "Resources\r\n| where id =~ '{VirtualMachine}'\r\n| project location", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "504c4e1f-42e8-4628-adfe-17fa76991377", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroup", + "type": 1, + "isRequired": true, + "query": "Resources\r\n| where id =~ '{VirtualMachine}'\r\n| project rg = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "armparameters" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Azure Monitor for NGINX" + }, + "name": "infoText" + }, + { + "type": 1, + "content": { + "json": "![Nginx logo](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Logos/nginx-logo.jpg)\r\n" + }, + "name": "nginxlogo", + "styleSettings": { + "margin": "20px 0 0 20px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Prerequisites", + "subTarget": "Prerequisites", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Configure monitoring", + "subTarget": "Configure", + "style": "link" + } + ] + }, + "name": "tabs", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "NGINX is a high performance open source software designed for a variety of uses ranging from web serving to load balancing. As one of the fastest web servers, NGINX powers the majority of the top websites. NGINX can serve as a replacement for your physical hardware load balancers and improve the performance of your server, while reducing CPU and RAM consumption.\n\nWith Azure Monitor for NGINX, you can manage your NGINX cluster while also gaining visibility into your operating system – Windows or Linux. Make configuration a breeze with templates, automated alerts and customizable actions. Spend less time fighting fires by accurately diagnosing real-time and historical load balancer performance issues, and focus on more proactive measures scale outs.\n\n" + }, + "name": "NginxInformation" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "NGINX needs to be configured with http_stub_status_module to enable collection of usage metrics. This can be done by enabling sub_status in the local config file (e.g. `/etc/nginx/conf.d/status.conf`)\n```\nserver { \n \n listen 127.0.0.1:9090;\n location /nginx_status {\n stub_status on;\n\n access_log off;\n allow 127.0.0.1;\n deny all;\n }\n}\n```\n\n" + }, + "name": "prerequisitesnginx" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Prerequisites" + }, + "name": "Prerequisites group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "0fcd1a59-1ca7-4e29-a0c7-6eb5b032ef6a", + "version": "KqlParameterItem/1.0", + "name": "TelegrafConfig", + "label": "Nginx Telegraf config", + "type": 1, + "isRequired": true, + "value": "[inputs.nginx]\r\n urls = [\"http://127.0.0.1:9090/nginx_status\"] \r\n response_timeout = '5s'\r\n\r\n[inputs.nginx.tags]\r\n insight = 'nginx'\r\n\r\n[inputs.cpu]\r\n percpu = true\r\n totalcpu = true\r\n collect_cpu_time = false\r\n report_active = false\r\n\r\n[inputs.cpu.tags]\r\n insight = 'nginx'\r\n\r\n[inputs.mem.tags]\r\n insight = 'nginx'\r\n\r\n[inputs.netstat.tags]\r\n insight = 'nginx'\r\n\r\n[inputs.net.tags]\r\n insight = 'nginx'\r\n\r\n[inputs.procstat]\r\n pid_file = '/var/run/nginx.pid'\r\n\r\n[inputs.procstat.tags]\r\n insight = 'nginx'", + "typeSettings": { + "multiLineText": true, + "editorLanguage": "text" + }, + "resourceType": "microsoft.insights/components" + } + ], + "style": "formVertical", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "telegrafconfigfield" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "f", + "linkTarget": "ArmTemplate", + "linkLabel": "Enable NGINX monitoring", + "style": "primary", + "linkIsContextBlade": true, + "templateRunContext": { + "componentIdSource": "parameter", + "componentId": "ResourceGroup", + "templateUriSource": "static", + "templateUri": "https://azmonsolutions.blob.core.windows.net/workloadinsights/NginxWorkload.json", + "templateParameters": [ + { + "name": "vmId", + "source": "parameter", + "value": "VirtualMachine", + "kind": "value" + }, + { + "name": "omsWorkspaceId", + "source": "parameter", + "value": "Workspace", + "kind": "value" + }, + { + "name": "workspaceRegion", + "source": "parameter", + "value": "WorkspaceLocation", + "kind": "value" + }, + { + "name": "serializedTelegrafConfig", + "source": "parameter", + "value": "TelegrafConfig", + "kind": "value" + }, + { + "name": "vmRegion", + "source": "parameter", + "value": "VmRegion", + "kind": "value" + } + ], + "titleSource": "static", + "title": "Enable Azure Monitor for NGINX", + "descriptionSource": "static", + "description": "![Nginx logo](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Logos/nginx-logo.jpg)\r\n\r\n
\r\n
\r\nWe're ready to enable Azure Monitor for NGINX to your virtual machine! Choose **Enable monitoring** to start monitoring with the recommended settings.\r\n", + "runLabelSource": "static", + "runLabel": "Enable monitoring" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "TelegrafConfig", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "TelegrafConfig", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "VirtualMachine", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "Workspace", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "WorkspaceLocation", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "VmRegion", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ResourceGroup", + "comparison": "isNotEqualTo" + } + ], + "name": "enablenginxmonitoringlink", + "styleSettings": { + "margin": "20px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "Specify stub_status URI matching this form: \r\n\r\n```\r\n[http://]@address[:port]/nginx_status\r\n```\r\nFor instance,\r\n```\r\nhttp://127.0.0.1:9090/nginx_status\r\n```" + }, + "name": "StubStatusUriSample" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Configure" + }, + "name": "Configure group" + } + ] + }, + "name": "Overview group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/Onboard Nginx Insights/settings.json b/Workloads/Workbooks/Onboard Nginx Insights/settings.json new file mode 100644 index 0000000..6d507c0 --- /dev/null +++ b/Workloads/Workbooks/Onboard Nginx Insights/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Onboard NGINX Insights", + "author": "Microsoft", + "galleries": [ + { "type": "workload-insights", "resourceType": "Azure Monitor", "order": 400 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/Onboard Redis Insights/Onboard Redis Insights.workbook b/Workloads/Workbooks/Onboard Redis Insights/Onboard Redis Insights.workbook new file mode 100644 index 0000000..d2eeb9e --- /dev/null +++ b/Workloads/Workbooks/Onboard Redis Insights/Onboard Redis Insights.workbook @@ -0,0 +1,372 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "0d87fd70-3f59-4824-b3ac-9867394090a5", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachine", + "type": 5, + "isRequired": true, + "value": "value::1", + "typeSettings": { + "resourceTypeFilter": { + "microsoft.compute/virtualmachines": true + }, + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "5f0382e3-69e0-40be-ad21-cca781fe81e1", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring' and id startswith '{VirtualMachine}'\r\n| project WorkspaceId = tostring(properties.settings.workspaceId)\r\n| join kind = inner (Resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\r\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "b189ae66-10a0-417b-8e1e-dc3b9b4ae028", + "version": "KqlParameterItem/1.0", + "name": "WorkspaceLocation", + "type": 8, + "isRequired": true, + "query": "Resources\r\n| where id =~ '{Workspace}'\r\n| project value = location, label = location, selected = true\r\n", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "7b1d0a3f-4341-47a5-9f2c-990d5b1faaab", + "version": "KqlParameterItem/1.0", + "name": "VmRegion", + "type": 1, + "isRequired": true, + "query": "Resources\r\n| where id =~ '{VirtualMachine}'\r\n| project location", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "504c4e1f-42e8-4628-adfe-17fa76991377", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroup", + "type": 1, + "isRequired": true, + "query": "Resources\r\n| where id =~ '{VirtualMachine}'\r\n| project rg = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "armparameters" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Azure Monitor for Redis" + }, + "name": "infoText" + }, + { + "type": 1, + "content": { + "json": "![Redis logo](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Logos/redis-logo.jpg)\r\n" + }, + "name": "redislogo", + "styleSettings": { + "margin": "20px 0 0 20px" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Prerequisites", + "subTarget": "Prerequisites", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Configure monitoring", + "subTarget": "Configure", + "style": "link" + } + ] + }, + "name": "tabs", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "Redis is an open source, in-memory data structure store that has rapidly gained popularity from developers. Redis is known for its fast performance and niche as a system that serves as both a store and cache. Redis functions most commonly as a key-value database, but has also gain prominence as a powerful NoSQL database.\n\nAzure Monitor for Redis combines all the important information you need to manage your Redis servers. Azure Monitor for Redis highlights important performance metrics to ensure your Redis server is running at optimal levels. Make configuration a breeze with templates, automated alerts and customizable actions.\n\n" + }, + "name": "redisinformation" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "Configuring a Redis password enables secure access to Redis. This can be done by editing the Redis config file: \n\n ```sudo nano /etc/redis/redis.conf```\n\n Uncomment the following directive and save the file: \n\n ```requirepass ```\n\n Restart redis service :\n\n ```sudo systemctl restart redis.service```\n\n This same password is needed for configuring the monitoring in the next step." + }, + "name": "prerequisitesredis" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Prerequisites" + }, + "name": "Prerequisites group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "0fcd1a59-1ca7-4e29-a0c7-6eb5b032ef6a", + "version": "KqlParameterItem/1.0", + "name": "TelegrafConfig", + "label": "Redis Telegraf config", + "type": 1, + "isRequired": true, + "value": "[inputs.redis]\r\n servers = [\"tcp://:@127.0.0.1:6379\"]\r\n\r\n[inputs.redis.tags]\r\n insight = 'redis'\r\n\r\n[inputs.mem.tags]\r\n insight = 'redis'\r\n\r\n[inputs.netstat.tags]\r\n insight = 'redis'\r\n\r\n[inputs.net.tags]\r\n insight = 'redis'", + "typeSettings": { + "multiLineText": true, + "editorLanguage": "text" + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "293d29d9-d41b-43fa-9f39-cca636c83b23", + "version": "KqlParameterItem/1.0", + "name": "ServerUpdated", + "type": 1, + "isRequired": true, + "query": "Resources\n| take 1\n| project x = iff(\"{TelegrafConfig:escapejson}\" !contains \"tcp://:@127.0.0.1:6379\", \"updated\", \"not updated\")", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "formVertical", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "telegrafconfigfield" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "f", + "linkTarget": "ArmTemplate", + "linkLabel": "Enable Redis monitoring", + "style": "primary", + "linkIsContextBlade": true, + "templateRunContext": { + "componentIdSource": "parameter", + "componentId": "ResourceGroup", + "templateUriSource": "static", + "templateUri": "https://azmonsolutions.blob.core.windows.net/workloadinsights/RedisWorkload.json", + "templateParameters": [ + { + "name": "vmId", + "source": "parameter", + "value": "VirtualMachine", + "kind": "value" + }, + { + "name": "omsWorkspaceId", + "source": "parameter", + "value": "Workspace", + "kind": "value" + }, + { + "name": "workspaceRegion", + "source": "parameter", + "value": "WorkspaceLocation", + "kind": "value" + }, + { + "name": "serializedTelegrafConfig", + "source": "parameter", + "value": "TelegrafConfig", + "kind": "value" + }, + { + "name": "vmRegion", + "source": "parameter", + "value": "VmRegion", + "kind": "value" + } + ], + "titleSource": "static", + "title": "Enable Azure Monitor for Redis", + "descriptionSource": "static", + "description": "![Redis logo](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Logos/redis-logo.jpg)\r\n\r\n
\r\n
\r\nWe're ready to enable Azure Monitor for Redis to your virtual machine! Choose **Enable monitoring** to start monitoring with the recommended settings.\r\n", + "runLabelSource": "static", + "runLabel": "Enable monitoring" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "TelegrafConfig", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "TelegrafConfig", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "VirtualMachine", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "Workspace", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "WorkspaceLocation", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "VmRegion", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ResourceGroup", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ServerUpdated", + "comparison": "isEqualTo", + "value": "updated" + } + ], + "name": "enableredismonitoringlink", + "styleSettings": { + "margin": "20px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "💡 Please update the `servers` array in the Redis Telegraf config to enable monitoring." + }, + "conditionalVisibility": { + "parameterName": "ServerUpdated", + "comparison": "isEqualTo", + "value": "not updated" + }, + "name": "checkconfigvalidity" + }, + { + "type": 1, + "content": { + "json": "Specify server using a URL matching this form: \r\n\r\n```\r\n[protocol://][:password]@address[:port]\r\n```\r\nFor instance,\r\n```\r\ntcp://:password@127.0.0.1:6379/\r\n```" + }, + "name": "samplelocalredisurl" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Configure" + }, + "name": "Configure group" + } + ] + }, + "name": "Overview group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/Onboard Redis Insights/settings.json b/Workloads/Workbooks/Onboard Redis Insights/settings.json new file mode 100644 index 0000000..db4f164 --- /dev/null +++ b/Workloads/Workbooks/Onboard Redis Insights/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Onboard Redis Insights", + "author": "Microsoft", + "galleries": [ + { "type": "workload-insights", "resourceType": "Azure Monitor", "order": 600 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/Onboard SQL Azure Insights/Onboard SQL Azure Insights.workbook b/Workloads/Workbooks/Onboard SQL Azure Insights/Onboard SQL Azure Insights.workbook new file mode 100644 index 0000000..94d2d1a --- /dev/null +++ b/Workloads/Workbooks/Onboard SQL Azure Insights/Onboard SQL Azure Insights.workbook @@ -0,0 +1,568 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "834e8df6-01eb-4524-a245-7feebd184c1d", + "version": "KqlParameterItem/1.0", + "name": "SqlDatabase", + "type": 5, + "isRequired": true, + "value": "value::1", + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "0d87fd70-3f59-4824-b3ac-9867394090a5", + "version": "KqlParameterItem/1.0", + "name": "SQLServer", + "label": "SQL Server", + "type": 5, + "isRequired": true, + "query": "Resources\n| where id =~ '{SqlDatabase}'\n| project SqlServer = extract('(.+/microsoft.sql/(managedinstances|servers)/.+)/databases/.+', 1, tolower(id))\n| project value = SqlServer, label = SqlServer, selected = true", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.sql/managedinstances": true, + "microsoft.sql/servers": true + }, + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "conditionalVisibility": { + "parameterName": "1", + "comparison": "isEqualTo", + "value": "2" + }, + "name": "parameters - 0" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Azure Monitor for Microsoft SQL Azure\r\n
\r\n\r\n![SQL logo](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Logos/sql-azure-logo.jpg)\r\n" + }, + "name": "text - 2" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Prerequisites", + "subTarget": "Prerequisites", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Configure monitoring", + "subTarget": "Configure", + "style": "link" + } + ] + }, + "name": "links - 5", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "SQL Server environments are becoming more complex while remaining a critical component of your application architecture. It’s a struggle to keep up with this continual growth without the right SQL monitoring tools. What if you could proactively manage your SQL Server environment and diagnose database performance issues by viewing the health of all your SQL Server instances on a single screen, anytime, anywhere on any device? You can with the right SQL Server monitoring tool.\n\nWith Azure Monitor for SQL Server, you can manage your SQL Server environment while also gaining visibility into your operating system – Windows or Linux – and also monitor your virtualization infrastructure. Make configuration a breeze with templates, automated alerts and customizable actions. Spend less time fighting fires by accurately diagnosing real-time and historical database performance issues, and focus on more proactive measures like query tuning.\n\n" + }, + "name": "text - 0" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "#### Create SQL user accounts\nYou have to create a login on every instance you want to monitor, with following script:\n\n```\nCREATE USER [telegraf] WITH PASSWORD = N'mystrongpassword';\nGO\nGRANT VIEW DATABASE STATE TO [telegraf];\nGO\n```\n\n#### Enable firewall rules\nEnable firewall rules to allow the remote monitoring virtual machine to access the SQL Server instance." + }, + "name": "text - 0" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Prerequisites" + }, + "name": "Prerequisites group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "{SqlDatabase}", + "linkTarget": "Resource", + "linkLabel": "{SqlDatabase:name}", + "preText": "Enable monitoring for:", + "style": "link" + } + ] + }, + "name": "links - 5" + }, + { + "type": 1, + "content": { + "json": "**SQL user information**\n\nAzure Monitor needs access to the health information stored in SQL Server dynamic management view tables. Please create a user with the privileges specified in the `Prerequisite` tab and provide the user credentials below. In order to protect secrets, we require the SQL password to be referred from an Azure Key Vault." + }, + "name": "text - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "32c19967-de7d-4271-bb5b-49d442975c84", + "version": "KqlParameterItem/1.0", + "name": "User", + "label": "SQL user", + "type": 1, + "isRequired": true, + "value": "telegraf", + "resourceType": "microsoft.insights/components" + }, + { + "id": "0fcd1a59-1ca7-4e29-a0c7-6eb5b032ef6a", + "version": "KqlParameterItem/1.0", + "name": "SqlServerName", + "label": "Sql server name", + "type": 1, + "isRequired": true, + "query": "Resources\n| where id =~ '{SQLServer}'\n| project server = tostring(properties.fullyQualifiedDomainName)", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "68ebbee9-6f73-45a0-b13c-5bc85ea913ff", + "version": "KqlParameterItem/1.0", + "name": "SqlDatabaseName", + "label": "Sql database name", + "type": 1, + "isRequired": true, + "query": "Resources\n| where id =~ '{SQLServer}'\n| project database = extract('.+/microsoft.sql/servers/.+/databases/(.+)', 1, tolower('{SqlDatabase}'))\n", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "**SQL password from Azure Key Vault**\r\n" + }, + "name": "text - 7" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "32c19967-de7d-4271-bb5b-49d442975c84", + "version": "KqlParameterItem/1.0", + "name": "KVSubscription", + "label": "Key vault subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| summarize by subscriptionId\n| project value = subscriptionId, label = subscriptionId, selected = ('{SQLServer}' startswith strcat('/subscriptions/', subscriptionId))\n", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2201e66d-6d1f-453b-9043-dfee2c8d435e", + "version": "KqlParameterItem/1.0", + "name": "KeyVault", + "label": "Key vault", + "type": 5, + "isRequired": true, + "query": "Resources\n| where type =~ 'microsoft.keyvault/vaults'\n| project value = id, label = id, selected = false, group = resourceGroup", + "crossComponentResources": [ + "{KVSubscription}" + ], + "value": null, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "4246980a-539a-4228-ab89-86d5260a00f9", + "version": "KqlParameterItem/1.0", + "name": "SecretName", + "label": "Secret name", + "type": 1, + "isRequired": true, + "resourceType": "microsoft.insights/components" + }, + { + "id": "a52b8dc2-80a1-4b9a-b5e6-a0910769f727", + "version": "KqlParameterItem/1.0", + "name": "KeyVaultSecretReference", + "type": 1, + "isRequired": true, + "query": "Resources\n| where id == '{KeyVault}'\n| project value = strcat('{ \"keyVault\": { \"id\": \"', id, '\" }, \"secretName\": \"{SecretName}\" }')", + "crossComponentResources": [ + "{KVSubscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "Keyvault parameters" + }, + { + "type": 1, + "content": { + "json": "**Remote monitoring virtual machine**\n\nSelect a virtual machine that will remotely monitor the SQL Azure instances using the credentials provided above. The machine will need to be onboarded with the OMS agent configured to send data to a Log Analytics workspaces that you have access to. It is also required to be an Ubuntu VM in East, West or Central US for the time being." + }, + "name": "text - 4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{VmSubscription}" + ], + "parameters": [ + { + "id": "32c19967-de7d-4271-bb5b-49d442975c84", + "version": "KqlParameterItem/1.0", + "name": "VmSubscription", + "label": "Monitoring VM Subs", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| summarize by subscriptionId\n| project value = subscriptionId, label = subscriptionId, selected = ('{SQLServer}' startswith strcat('/subscriptions/', subscriptionId))\n", + "crossComponentResources": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "2201e66d-6d1f-453b-9043-dfee2c8d435e", + "version": "KqlParameterItem/1.0", + "name": "VirtualMachine", + "label": "Monitoring virtual machine", + "type": 5, + "isRequired": true, + "query": "Resources\n | where type =~ 'microsoft.compute/virtualmachines'\n | project Vm = tolower(id), resourceGroup, VmLocation = location\n | join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), WorkspaceId = tostring(properties.settings.workspaceId), name\n | where Vm != ''and WorkspaceId != ''\n ) on $left.Vm == $right.Vm\n | project-away Vm1\n | join kind = leftouter (Resources\n | where type =~ 'microsoft.operationalinsights/workspaces'\n | project Workspace = id, location, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\n| where Workspace != '' and VmLocation in ('eastus', 'centralus', 'westus', 'eastus2', 'westus2', 'eastasia', 'southeastasia', 'northeurope', 'westeurope', 'francecentral', 'uksouth', 'ukwest', 'centralindia', 'japanwest')\n| project value = Vm, label = Vm, selected = false, group = resourceGroup", + "crossComponentResources": [ + "{VmSubscription}" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "value": null + }, + { + "id": "9b02eb23-3e8b-45bd-8ab7-d78b2afe177d", + "version": "KqlParameterItem/1.0", + "name": "Workspace", + "type": 5, + "isRequired": true, + "query": "Resources\n| where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring' and id startswith '{VirtualMachine}'\n| project WorkspaceId = tostring(properties.settings.workspaceId)\n| join kind = inner (Resources\n| where type =~ 'microsoft.operationalinsights/workspaces'\n| project id, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\n| project value = id, label = id, selected = true", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "af9541a0-c777-4135-97b0-0588838105fc", + "version": "KqlParameterItem/1.0", + "name": "WorkspaceLocation", + "type": 8, + "isRequired": true, + "query": "Resources\n| where id =~ '{Workspace}'\n| project value = location, label = location, selected = true\n", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "00b7e08c-215e-47f6-9de4-0e771636e4a9", + "version": "KqlParameterItem/1.0", + "name": "VmName", + "type": 1, + "isRequired": true, + "query": "Resources\n| where id =~ '{VirtualMachine}'\n| project name", + "crossComponentResources": [ + "{VmSubscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "cc59a918-8843-438e-9796-d4cfa5928eb8", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroup", + "type": 1, + "isRequired": true, + "query": "Resources\n| where id =~ '{VirtualMachine}'\n| project rg = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)", + "crossComponentResources": [ + "{VmSubscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 1 - Copy" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "cellValue": "", + "linkTarget": "ArmTemplate", + "linkLabel": "Enable SQL monitoring >", + "style": "primary", + "linkIsContextBlade": true, + "templateRunContext": { + "componentIdSource": "parameter", + "componentId": "ResourceGroup", + "templateUriSource": "static", + "templateUri": "https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/SqlAzure-watcher/keyvaultdeploy.json", + "templateParameters": [ + { + "name": "vmName", + "source": "parameter", + "value": "VmName", + "kind": "value" + }, + { + "name": "omsWorkspaceId", + "source": "parameter", + "value": "Workspace", + "kind": "value" + }, + { + "name": "workspaceRegion", + "source": "parameter", + "value": "WorkspaceLocation", + "kind": "value" + }, + { + "name": "sqlAzureResourceId", + "source": "parameter", + "value": "SqlDatabase", + "kind": "value" + }, + { + "name": "sqlServer", + "source": "parameter", + "value": "SqlServerName", + "kind": "value" + }, + { + "name": "sqlDatabase", + "source": "parameter", + "value": "SqlDatabaseName", + "kind": "value" + }, + { + "name": "sqlUserName", + "source": "parameter", + "value": "User", + "kind": "value" + }, + { + "name": "sqlPassword", + "source": "parameter", + "value": "KeyVaultSecretReference", + "kind": "reference" + } + ], + "titleSource": "static", + "title": "Enable Azure Monitor for Microsoft SQL Server", + "descriptionSource": "static", + "description": "![SQL logo](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Logos/sql-azure-logo.jpg)\r\n\r\n
\r\n
\r\nWe're ready to enable Azure Monitor for SQL Server to your virtual machine! Choose **Enable monitoring** to start monitoring with the recommended settings.\r\n", + "runLabelSource": "static", + "runLabel": "Enable monitoring" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "Workspace", + "comparison": "isNotEqualTo" + }, + "conditionalVisibilities": [ + { + "parameterName": "Workspace", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "WorkspaceLocation", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "VmName", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "ResourceGroup", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "User", + "comparison": "isNotEqualTo" + }, + { + "parameterName": "KeyVaultSecretReference", + "comparison": "isNotEqualTo" + } + ], + "name": "links - 4", + "styleSettings": { + "margin": "20px 0 0 0" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Configure" + }, + "name": "Configure group" + } + ] + }, + "name": "Overview group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/Onboard SQL Azure Insights/settings.json b/Workloads/Workbooks/Onboard SQL Azure Insights/settings.json new file mode 100644 index 0000000..4c4dfc7 --- /dev/null +++ b/Workloads/Workbooks/Onboard SQL Azure Insights/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Onboard SQL Azure Insights", + "author": "Microsoft", + "galleries": [ + { "type": "workload-insights", "resourceType": "Azure Monitor", "order": 100 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/Redis Insights/Redis Insights.workbook b/Workloads/Workbooks/Redis Insights/Redis Insights.workbook new file mode 100644 index 0000000..d052a33 --- /dev/null +++ b/Workloads/Workbooks/Redis Insights/Redis Insights.workbook @@ -0,0 +1,945 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "a9f2f311-a9a7-45ae-93d7-f1fe6e07fa02", + "version": "KqlParameterItem/1.0", + "name": "WorkloadTag", + "type": 1, + "isRequired": true, + "value": "redis", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components" + }, + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All subscriptions with virtual machines", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines'\r\n| project id = tolower(id), subscriptionId\r\n| join kind = leftouter (Resources\r\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\r\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\r\n | where Vm != '' and Insight == '{WorkloadTag}'\r\n ) on $left.id == $right.Vm\r\n| summarize Onboarded = countif(Vm != ''), All = count() by subscriptionId\r\n| order by Onboarded desc, All desc\r\n| extend Row = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Row == 1\r\n", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "f60ea0a0-3703-44ca-a59b-df0246423f41", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "All virtual machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines'\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = name, selected = false, group = resourceGroup", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "5e510131-51a9-40c0-b1a8-328932b5f46e", + "version": "KqlParameterItem/1.0", + "name": "OnboardedComputers", + "label": "Monitored virtual machines", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": " Resources\n| where id in~ ({Resources})\n| project ['Virtual machine'] = tolower(id), Name = name\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == '{WorkloadTag}'\n ) on $left.['Virtual machine'] == $right.Vm\n| project Name\n", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "", + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "4908b8cf-7658-4356-9aa5-5dc5aca7a1aa", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "619bf90b-5093-47cc-83a3-bf009257bc7d", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({Resources})\n| project ['Virtual machine'] = tolower(id), Name = name, ['Resource group'] = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), Subscription = subscriptionId, Location = location, OsType = iff(properties.osProfile.windowsConfiguration == '', 'Linux', 'Windows'), Offer = tostring(properties.storageProfile.imageReference.offer)\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == '{WorkloadTag}'\n ) on $left.['Virtual machine'] == $right.Vm\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), WorkspaceId = tostring(properties.settings.workspaceId)\n | where Vm != ''\n ) on $left.['Virtual machine'] == $right.Vm\n| project-away Vm, Vm1\n| join kind = leftouter (Resources\n| where type =~ 'microsoft.operationalinsights/workspaces'\n| project Workspace = id, location, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\n| summarize by Workspace\n| project value = Workspace, label = Workspace, selected = true\n", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e6598941-f9f5-4deb-bd0d-48658ade8297", + "version": "KqlParameterItem/1.0", + "name": "OnboardedComputerCount", + "type": 1, + "query": " Resources\n| where id in~ ({Resources})\n| project ['Virtual machine'] = tolower(id), Name = name\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == '{WorkloadTag}'\n ) on $left.['Virtual machine'] == $right.Vm\n| count\n| project Count = tostring(Count)\n", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "bb7b9387-0445-4ee2-9fc7-f52cb9f59e8c", + "version": "KqlParameterItem/1.0", + "name": "TotalComputers", + "type": 1, + "query": "Resources\n| where type =~ 'microsoft.compute/virtualmachines'\n| count\n| project Count = tostring(Count)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "00276202-3d70-439f-a733-57a16691e908", + "version": "KqlParameterItem/1.0", + "name": "OnboardingTemplate", + "label": "Onboarding template ", + "type": 1, + "value": "Community-Workbooks/Workloads/Onboard Redis Insights", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "*Virtual machines*\n# {OnboardedComputerCount} / {TotalComputers}\n*with Redis monitoring*" + }, + "name": "text - 8", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Performance", + "subTarget": "Performance", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Connections", + "subTarget": "Connections", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Commands", + "subTarget": "Commands", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Alerts", + "subTarget": "Alerts", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Explore metrics", + "subTarget": "Explore metrics", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Enable monitoring", + "subTarget": "Enable monitoring", + "style": "link" + } + ] + }, + "name": "links - 3", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Name in~ ('total_connections_received','total_commands_processed','calls')\r\n| order by Computer asc, Name asc, Tags asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Tags == prev(Tags) and Val > prev(Val), Val - prev(Val), real(null))\r\n| where isnull(Value) == false;\r\ndata| order by Computer asc, Name asc, TimeGenerated asc\r\n| summarize \r\n ReceivedConnections = sumif(Value, Name == 'total_connections_received'),\r\n ReceivedConnectionsRate = avgif(Value, Name == 'total_connections_received') / (({TimeRange:end} - {TimeRange:start}) / 1s),\r\n Commands = sumif(Value, Name == 'calls'),\r\n CommandsRate = avgif(Value, Name == 'calls') / (({TimeRange:end} - {TimeRange:start}) / 1s)\r\n by Computer\r\n| join kind = inner (data\r\n| where Name == 'total_connections_received'\r\n| make-series ConnectionTrend = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer) on Computer\r\n| join kind = inner (InsightsMetrics \r\n | where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Name == 'used_cpu_sys'\r\n | order by Computer asc, Name asc, TimeGenerated asc\r\n | extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null))\r\n | where isnull(Value) == false\r\n | summarize Cpu = avg(Value) by Computer\r\n ) on Computer\r\n| project Computer, ReceivedConnections,ReceivedConnectionsRate, Commands, CommandsRate, Cpu\r\n| join kind = rightouter (datatable(Computer:string)[{OnboardedComputers}]) on Computer\r\n| extend Computer = Computer1\r\n| project-away Computer1\r\n", + "size": 0, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "showExpandCollapseGrid": true, + "gridSettings": { + "formatters": [ + { + "columnMatch": "ReceivedConnections", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "ReceivedConnectionsRate", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "ProcessedTrend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Commands", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "CommandsRate", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Cpu", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": ">", + "thresholdValue": "90", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 2 + }, + "emptyValCustomText": "-" + } + } + ], + "sortBy": [ + { + "itemKey": "$gen_heatmap_ReceivedConnections_1", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Computer" + }, + { + "columnId": "ReceivedConnections", + "label": "Connections Received" + }, + { + "columnId": "ReceivedConnectionsRate", + "label": "Connections Rate" + }, + { + "columnId": "Commands", + "label": "Total Commands" + }, + { + "columnId": "CommandsRate", + "label": "Commands Rate" + }, + { + "columnId": "Cpu", + "label": "CPU Usage" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_ReceivedConnections_1", + "sortOrder": 2 + } + ] + }, + "showPin": true, + "name": "query - 4" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Name == \"keyspace_hitrate\"\r\n| make-series Ratio = avg(Val) default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "title": "Cache Hit Ratio", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "chartSettings": { + "xSettings": {}, + "ySettings": { + "min": 0, + "max": 1 + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "query - 1 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Name == \"mem_fragmentation_ratio\"\r\n| make-series Ratio = avg(Val) default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "MemoryRSS to Memory Usage Ratio", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 0 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Name in (\"expired_keys\",\"evicted_keys\")\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null))\r\n| where isnull(Value) == false\r\n| summarize UsedRatio = sumif(Value, Name == 'evicted_keys') / sumif(Value, Name == 'expired_keys') by Computer", + "size": 0, + "aggregation": 1, + "showAnalytics": true, + "title": "Evicted/Expired Key Ratio", + "noDataMessage": "No available data", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "chartSettings": { + "xSettings": {}, + "ySettings": { + "min": 0, + "max": 1 + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "query - 1 - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers}))\r\n| where Name == \"avg_ttl\"\r\n| make-series Ratio = avg(Val) default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "showAnalytics": true, + "title": "Average Time to Live per Key", + "noDataMessage": "No available data", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "sortBy": [] + }, + "customWidth": "50", + "showPin": true, + "name": "query - 3" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Performance" + }, + "name": "group - 6" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Name == \"total_connections_received\" or Name == \"rejected_connections\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null)), Series = strcat(Computer, \"/\", Name)\r\n| where isnull(Value) == false\r\n| make-series Connections = sum(Value) default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series", + "size": 0, + "aggregation": 3, + "showAnalytics": true, + "title": "Connections", + "noDataMessage": "No connections detected in this time range", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Active", + "formatter": 9, + "formatOptions": {} + } + ] + } + }, + "customWidth": "50", + "showPin": true, + "name": "query - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Name == \"connected_slaves\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null))\r\n| where isnull(Value) == false\r\n| make-series Connections = sum(Value) default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "aggregation": 3, + "showAnalytics": true, + "title": "Connected Slaves", + "noDataMessage": "No connected slaves", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) \r\n| where Name == \"master_repl_offset\"\r\n| order by Computer asc, Name asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Val > prev(Val), Val - prev(Val), real(null))\r\n| where isnull(Value) == false\r\n| make-series Connections = sum(Value) default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Computer", + "size": 0, + "aggregation": 3, + "showAnalytics": true, + "title": "Master Replication Offset", + "noDataMessage": "No connected slaves", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart" + }, + "customWidth": "50", + "showPin": true, + "name": "query - 2" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Connections" + }, + "name": "group - 7" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "091ad821-3f07-490e-8d58-b474a0bfb6a8", + "version": "KqlParameterItem/1.0", + "name": "Command", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"redis_cmdstat\"\r\n| where Name == \"usec_per_call\"\r\n| extend Call = tostring(split(Tags,'\"')[3])\r\n| summarize count() by Call\r\n| project Call", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"redis_cmdstat\"\r\n| where Name == \"usec_per_call\"\r\n| extend Call = tostring(split(Tags,'\"')[3])\r\n| where Call in ({Command})\r\n| extend Series = strcat(Computer, \"/\", Call)\r\n| order by Computer asc, Name asc, Series asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Series == prev(Series) and Val > prev(Val), Val - prev(Val), real(null))\r\n| where isnull(Value) == false\r\n| make-series CallRate = avg(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series", + "size": 0, + "showAnalytics": true, + "title": "Command Stats (Time per Call)", + "noDataMessage": "No data found matching the selected command(s)", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "gridSettings": { + "sortBy": [ + { + "itemKey": "CallRate", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "CallRate", + "sortOrder": 1 + } + ], + "chartSettings": { + "xSettings": {}, + "ySettings": { + "numberFormatSettings": { + "unit": 22, + "options": { + "style": "decimal", + "useGrouping": true + } + } + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "microseconds per call" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where (Computer in ({OnboardedComputers}) or '*' in ({OnboardedComputers})) and Namespace == \"redis_cmdstat\"\r\n| where Name == \"calls\"\r\n| extend Call = tostring(split(Tags,'\"')[3])\r\n| where Call in ({Command})\r\n| extend Series = strcat(Computer, \"/\", Call)\r\n| order by Computer asc, Name asc, Series asc, TimeGenerated asc\r\n| extend Value = iff(Computer == prev(Computer) and Name == prev(Name) and Series == prev(Series) and Val > prev(Val), Val - prev(Val), real(null))\r\n| where isnull(Value) == false\r\n| make-series CallRate = sum(Value) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Series", + "size": 0, + "showAnalytics": true, + "title": "Command Stats (# of Call)", + "noDataMessage": "No data found matching the selected command(s)", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "linechart", + "gridSettings": { + "sortBy": [ + { + "itemKey": "CallRate", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "CallRate", + "sortOrder": 1 + } + ], + "chartSettings": { + "xSettings": {}, + "ySettings": { + "numberFormatSettings": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 1 + } + } + } + } + }, + "customWidth": "50", + "showPin": true, + "name": "number of calls" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Commands" + }, + "name": "Commands" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "167a4f9a-2280-451e-8fb8-4bf3dacdc4ec", + "version": "KqlParameterItem/1.0", + "name": "SuggestedAlerts", + "type": 1, + "isRequired": true, + "value": "[ { \"AlertName\": \"host-high-cpu\", \"AlertDescription\": \"Fires when high CPU usage is detected on the host\", \"AlertThreshold\": 70, \"AlertTemplate\": \"https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Alerts/Host/Cpu/azuredeploy.json\" }, { \"AlertName\": \"host-used-memory-percentage\", \"AlertDescription\": \"Fires when Used Memory percentage on the host exceeds a threshold\", \"AlertThreshold\": 85, \"AlertTemplate\": \"https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Alerts/Host/Memory/azuredeploy.json\" } ]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.insights/components" + }, + "name": "parameters - 0" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Alerts group", + "items": [] + }, + "name": "Alert" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Alerts" + }, + "name": "Alert group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Explore metrics group", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Explore metrics" + }, + "name": "Explore metrics group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Enable monitoring group", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Enable monitoring" + }, + "name": "Onboarding group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/Redis Insights/settings.json b/Workloads/Workbooks/Redis Insights/settings.json new file mode 100644 index 0000000..08d8ed3 --- /dev/null +++ b/Workloads/Workbooks/Redis Insights/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Redis Insights", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "order": 400 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/SQL Azure Insights/SQL Azure Insights.workbook b/Workloads/Workbooks/SQL Azure Insights/SQL Azure Insights.workbook new file mode 100644 index 0000000..8bf1625 --- /dev/null +++ b/Workloads/Workbooks/SQL Azure Insights/SQL Azure Insights.workbook @@ -0,0 +1,3619 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "value::all" + ], + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.sql/servers'\r\n| summarize Count = count() by subscriptionId\r\n| order by Count desc\r\n| extend Rank = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Rank == 1", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "a5a0f53c-4281-4156-96e9-14012c270e11", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroups", + "label": "Resource groups", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.sql/servers'\r\n| extend resourceGroupId = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)\r\n| summarize by resourceGroupId\r\n", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*", + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "f60ea0a0-3703-44ca-a59b-df0246423f41", + "version": "KqlParameterItem/1.0", + "name": "SqlServers", + "label": "Sql servers", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type in~ ('microsoft.sql/servers', 'microsoft.sql/managedinstances')\r\n| extend resourceGroupId = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)\r\n| where resourceGroupId in~ ({ResourceGroups}) or '*' in ({ResourceGroups})\r\n| project value = id, label = id, selected = false, group = resourceGroup\r\n", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "ff8123ff-7a9d-4402-b356-6f0d4d35824d", + "version": "KqlParameterItem/1.0", + "name": "SqlDatabases", + "label": "Sql databases", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where type in~ ('microsoft.sql/servers/databases', 'microsoft.sql/managedinstances/databases')\n| where name != 'master'\n| project id, name, Server = extract(@'(.+/microsoft.sql/(managedinstances|servers)/.+)/databases/.+', 1, tolower(id))\n| where Server in~ ({SqlServers})\n| extend ServerName = extract(@'.+/microsoft.sql/(managedinstances|servers)/(.+)', 1, Server)\n| project value = id, label = name, selected = false, group = ServerName", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d5914355-76ce-46d5-a1a3-bdd20765d825", + "version": "KqlParameterItem/1.0", + "name": "OnboardedComputers", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in ({SqlDatabases})\n| project id = tolower(id), name\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines'\n | project Vm = tolower(id)\n | join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name in~ ('workload.linuxconfigagent')\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"]), MonitoredResource = tolower(tostring(tags[\"monitored-resource\"]))\n | where Vm != '' and Insight =~ 'sql-azure'\n ) on $left.Vm == $right.Vm\n | project-away Vm1\n) on $left.id == $right.MonitoredResource\n| project value = Vm, label = Vm, selected = true\n", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "17d15663-c149-487f-8ea9-fe91cbbb53f5", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({OnboardedComputers})\n| project ['Virtual machine'] = tolower(id), Name = name, ['Resource group'] = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), Subscription = subscriptionId, Location = location, OsType = iff(properties.osProfile.windowsConfiguration == '', 'Linux', 'Windows'), Offer = tostring(properties.storageProfile.imageReference.offer)\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == 'sql-azure'\n ) on $left.['Virtual machine'] == $right.Vm\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), WorkspaceId = tostring(properties.settings.workspaceId)\n | where Vm != ''\n ) on $left.['Virtual machine'] == $right.Vm\n| project-away Vm, Vm1\n| join kind = leftouter (Resources\n| where type =~ 'microsoft.operationalinsights/workspaces'\n| project Workspace = id, location, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\n| summarize by Workspace\n| project value = Workspace, label = Workspace, selected = true\n", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "9d700f0f-fa4b-48bf-9183-2cfae0f88787", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ] + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "8522d92a-430d-477d-aeb1-ca8c5564af52", + "version": "KqlParameterItem/1.0", + "name": "OnboardedComputerNames", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({OnboardedComputers})\n| project value = name, label = name, selected = true", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "0ed89f54-8f99-4236-af26-0e36e86a090d", + "version": "KqlParameterItem/1.0", + "name": "SqlServerMapping", + "type": 1, + "isRequired": true, + "query": "Resources\n| where type =~ 'microsoft.sql/servers/databases'\n| where id in~ ({SqlDatabases})\n| project Database = id, DatabaseName = name, Server = extract('(.+/microsoft.sql/servers/.+)/databases/.+', 1, tolower(id)), ServerName = extract('.+/microsoft.sql/servers/(.+)/databases/.+', 1, tolower(id))\n| summarize Data = tostring(makelist(pack('db', Database, 'dbName', DatabaseName, 'server', Server, 'serverName', ServerName), 10000))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "98047fe9-0573-4377-8371-6f19f4b41bfe", + "version": "KqlParameterItem/1.0", + "name": "OnboardedComputerCount", + "type": 1, + "isRequired": true, + "query": "Resources\n| where id in ({SqlDatabases})\n| project id = tolower(id), name\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines'\n | project Vm = tolower(id)\n | join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name in~ ('workload.linuxconfigagent')\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"]), MonitoredResource = tolower(tostring(tags[\"monitored-resource\"]))\n | where Vm != '' and Insight =~ 'sql-azure'\n ) on $left.Vm == $right.Vm\n | project-away Vm1\n) on $left.id == $right.MonitoredResource\n| project value = Vm, label = Vm, selected = true\n| count\n| project tostring(Count)\n", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "d2162b85-ca90-40db-9aae-825e91c5a664", + "version": "KqlParameterItem/1.0", + "name": "TotalComputers", + "type": 1, + "isRequired": true, + "query": "Resources\n| where type =~ 'microsoft.sql/servers/databases'\n| where name != 'master'\n| project id, name, Server = extract(@'(.+/microsoft.sql/servers/.+)/databases/.+', 1, tolower(id))\n| where Server in~ ({SqlServers})\n| extend ServerName = extract(@'.+/microsoft.sql/servers/(.+)', 1, Server)\n| project value = id, label = name, selected = false, group = ServerName\n| count\n| project tostring(Count)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "\n\n*SQL Azure databases*\n# {OnboardedComputerCount} / {TotalComputers}\n*monitored remotely*" + }, + "name": "text - 13", + "styleSettings": { + "margin": "10px 0 0 0" + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Metrics", + "subTarget": "Metrics", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Activities", + "subTarget": "Activities", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Memory clerks", + "subTarget": "Memory clerks", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Wait stats", + "subTarget": "Wait stats", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Replicas", + "subTarget": "Replicas", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "File sizes", + "subTarget": "File sizes", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Transactions", + "subTarget": "Transactions", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Database IO", + "subTarget": "Database IO", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Alerts", + "subTarget": "Alerts", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Sql counters", + "subTarget": "Sql counters", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Enable monitoring", + "subTarget": "Enable monitoring", + "style": "link" + } + ] + }, + "name": "Tabs", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Namespace contains 'sqlserver_server_properties'\r\n| extend Tags = todynamic(Tags)\r\n| extend Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| extend DatabaseKey = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| where Computer in ({OnboardedComputerNames})\r\n| where Name in ('db_online', 'db_offline', 'db_offline', 'db_recovering', 'db_recoveryPending', 'db_restoring', 'db_suspect');\r\nlet summary = data\r\n| summarize arg_max(TimeGenerated, Name, Val) by Name, DatabaseKey\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), 0.0, Val)\r\n| summarize Val = sum(Val) by Name\r\n| project Name, Value = Val;\r\nlet trend = data\r\n| where Name != 'db_online'\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Name\r\n| union (data\r\n| where Name == 'db_online'\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Name);\r\nsummary\r\n| join kind = inner (trend) on Name\r\n| join kind = inner (datatable(Name:string, Rank:int)[\r\n'db_online', 1, 'db_offline', 2, 'db_recovering', 3, 'db_recoveryPending', 4, 'db_restoring', 5, 'db_suspect', 6\r\n]) on Name\r\n| order by Rank asc\r\n| project Name, Value, Trend\r\n| extend Name = case(\r\n Name == 'db_online', 'Online databases',\r\n Name == 'db_offline', 'Offline',\r\n Name == 'db_recovering', 'Recovering',\r\n Name == 'db_recoveryPending', 'Recovery pending',\r\n Name == 'db_restoring', 'Restoring',\r\n Name == 'db_suspect', 'Suspect',\r\n Name\r\n)\r\n", + "size": 4, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "tiles", + "gridSettings": { + "sortBy": [ + { + "itemKey": "Name", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "Name", + "sortOrder": 1 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "name": "query - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let azuresqlservers = dynamic({SqlServerMapping});\r\nlet data = InsightsMetrics\r\n| where Namespace contains 'sqlserver_server_properties'\r\n| extend Tags = todynamic(Tags)\r\n| extend Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| extend DatabaseKey = tolower(strcat(Instance, '/', Database))\r\n| where Computer in ({OnboardedComputerNames});\r\ndata\r\n| summarize arg_max(TimeGenerated, Val) by Name, Database, Instance, Computer, DatabaseKey\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| summarize Online = sumif(Val, Name == 'db_online'),\r\n Offline = sumif(Val, Name == 'db_offline'),\r\n Recovering = sumif(Val, Name == 'db_recovering'),\r\n ['Recovery pending'] = sumif(Val, Name == 'db_recoveryPending'),\r\n Restoring = sumif(Val, Name == 'db_restoring'),\r\n Suspect = sumif(Val, Name == 'db_suspect'),\r\n CPUs = sumif(Val, Name == 'cpu_count'),\r\n ['Server memory'] = sumif(Val, Name == 'server_memory'),\r\n ['Total storage'] = sumif(Val, Name == 'total_storage_mb'),\r\n ['Engine edition'] = sumif(Val, Name == 'engine_edition')\r\n by Database, Instance, Computer, DatabaseKey\r\n| extend jkey = strcat(Instance, '/', Database)\r\n| join kind = inner (data\r\n | where Name == 'db_online'\r\n | make-series Trend = min(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Database, Instance\r\n | extend jkey = strcat(Instance, '/', Database)\r\n ) on jkey\r\n| join kind = fullouter (range i from 1 to 1 step 1\r\n | extend d = dynamic({SqlServerMapping})\r\n | mv-expand d\r\n | project DatabaseId = tostring(d.db), ServerId = tostring(d.server), DatabaseKey = tolower(strcat(d.serverName, '/', d.dbName))\r\n) on $left.DatabaseKey == $right.DatabaseKey\r\n| extend Rank = iff(Computer == '', 0, 1)\r\n| order by Rank desc, DatabaseKey asc\r\n| project ['Database'] = iff(DatabaseId == '', Database, DatabaseId), ['Monitored by'] = Computer, Online, ['Online trend'] = Trend, Offline, Recovering, ['Recovery pending'], Restoring, Suspect, CPUs, ['Server memory'], ['Total storage'], ['Engine edition']\r\n", + "size": 2, + "showAnalytics": true, + "title": "Server details", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Monitored by", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "CPUs", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + }, + { + "columnMatch": "Engine edition", + "formatter": 0, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + }, + "emptyValCustomText": "-" + } + } + ], + "rowLimit": 1000, + "filter": true + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "Server details" + } + ] + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + { + "parameterName": "OnboardedComputerCount", + "comparison": "isNotEqualTo", + "value": "0" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 10, + "content": { + "chartId": "workbookea04ad54-7ec8-41c7-9ca8-ed43960458ac", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 0, + "metricScope": 0, + "resourceIds": [ + "{SqlDatabases}" + ], + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.sql/servers/databases", + "resourceParameter": "SqlDatabases", + "metrics": [ + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases-Basic-cpu_percent", + "aggregation": 4 + }, + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases-Basic-storage_percent", + "aggregation": 3 + }, + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases-Basic-physical_data_read_percent", + "aggregation": 4 + }, + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases-Basic-log_write_percent", + "aggregation": 4 + }, + { + "namespace": "microsoft.sql/servers/databases", + "metric": "microsoft.sql/servers/databases-Basic-connection_successful", + "aggregation": 1 + } + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Subscription", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Name", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-cpu_percent", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue" + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-cpu_percent Timeline", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue" + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-storage_percent", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 1, + "options": null + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-storage_percent Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-physical_data_read_percent", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 1, + "options": null + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-physical_data_read_percent Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-log_write_percent", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 1, + "options": null + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-log_write_percent Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-connection_successful", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 0, + "options": null + } + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-connection_successful Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-dtu_consumption_percent Timeline", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "microsoft.sql/servers/databases-Basic-dtu_consumption_percent", + "formatter": 1, + "formatOptions": {}, + "numberFormat": { + "unit": 1, + "options": null + } + } + ], + "rowLimit": 10000, + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.sql/servers/databases-Basic-cpu_percent_2", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "microsoft.sql/servers/databases-Basic-cpu_percent", + "label": "CPU percentage (Average)" + }, + { + "columnId": "microsoft.sql/servers/databases-Basic-cpu_percent Timeline", + "label": "CPU percentage Timeline" + }, + { + "columnId": "microsoft.sql/servers/databases-Basic-storage_percent", + "label": "Data space used percent (Max)" + }, + { + "columnId": "microsoft.sql/servers/databases-Basic-storage_percent Timeline", + "label": "Data space used percent Timeline" + }, + { + "columnId": "microsoft.sql/servers/databases-Basic-physical_data_read_percent", + "label": "Data IO percentage (Average)" + }, + { + "columnId": "microsoft.sql/servers/databases-Basic-physical_data_read_percent Timeline", + "label": "Data IO percentage Timeline" + }, + { + "columnId": "microsoft.sql/servers/databases-Basic-log_write_percent", + "label": "Log IO percentage (Average)" + }, + { + "columnId": "microsoft.sql/servers/databases-Basic-log_write_percent Timeline", + "label": "Log IO percentage Timeline" + }, + { + "columnId": "microsoft.sql/servers/databases-Basic-connection_successful", + "label": "Successful Connections (Sum)" + }, + { + "columnId": "microsoft.sql/servers/databases-Basic-connection_successful Timeline", + "label": "Successful Connections Timeline" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_microsoft.sql/servers/databases-Basic-cpu_percent_2", + "sortOrder": 2 + } + ], + "showExportToExcel": true + }, + "showPin": true, + "name": "metric - 0" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Metrics" + }, + "name": "Metrics group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## The SQL Azure databases in this scope are not configured with remote monitoring." + }, + "name": "text - 0", + "styleSettings": { + "margin": "20px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "![Microsoft SQL Server logot](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Logos/sql-azure-logo.jpg)\r\n" + }, + "name": "text - 0 - Copy", + "styleSettings": { + "margin": "20px 0 15px 0" + } + }, + { + "type": 1, + "content": { + "json": "Use the **Enable monitoring** tab to configure machines to begin monitoring SQL Servers.\r\n" + }, + "name": "text - 0 - Copy" + } + ] + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + { + "parameterName": "OnboardedComputerCount", + "comparison": "isEqualTo", + "value": "0" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Onboarding message" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'User connections'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "User connections", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 17, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "User connections" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'Transactions/sec'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Transtions./sec", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 31, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "Transtions/sec" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'Batch requests/sec'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Batch requests/sec", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 31, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "Batch requests per second" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'SQL compilations/sec'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "SQL compilations/sec", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 31, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "SQL compilations/sec" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'SQL re-compilations/sec'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "SQL re-compilations/sec", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 31, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "SQL re-compilations/sec" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'Processes blocked'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Processes blocked", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 17, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "Processes blocked" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'Number of deadlocks/sec'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Number of deadlocks/sec", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 31, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "Number of deadlocks/sec" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Activities" + }, + "name": "Activities" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| where Namespace =~ 'sqlserver_memory_clerks'\r\n| extend Tags = todynamic(Tags)\r\n| extend Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance), ClerkType = tostring(Tags.clerk_type);\r\ndata\r\n| summarize arg_max(TimeGenerated, Val) by ClerkType, Database, Instance\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| project Database = iff(Database == Instance, Database, strcat(Database, ' on ', Instance)), ClerkType, Size = Val\r\n| extend jkey = strcat(Database, '/', ClerkType)\r\n| join kind = inner (data\r\n | make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ClerkType, Instance, Database\r\n | project Database = iff(Database == Instance, Database, strcat(Database, ' on ', Instance)), DbKey = tolower(strcat(Instance, '/', Database)), ClerkType, Trend\r\n | extend jkey = strcat(Database, '/', ClerkType)\r\n ) on jkey\r\n| join kind = leftouter (range i from 1 to 1 step 1\r\n | extend d = dynamic({SqlServerMapping})\r\n | mv-expand d\r\n | project DatabaseId = tostring(d.db), ServerId = tostring(d.server), DatabaseKey = tolower(strcat(d.serverName, '/', d.dbName))\r\n) on $left.DbKey == $right.DatabaseKey\r\n| project Database = iff(DatabaseId == '', Database, DatabaseId), DbKey, ClerkType, Size, ['Size trend'] = Trend\r\n\r\n\r\n", + "size": 2, + "showAnalytics": true, + "title": "By memory clerks", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "DbKey", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "ClerkType", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Size", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 3, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Size trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "ClerkType" + ], + "finalBy": "Database" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Size_4", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Size_4", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "customWidth": "50", + "showPin": true, + "name": "Memory clerks" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| where Namespace contains 'sqlserver_memory_clerks'\r\n| extend Tags = todynamic(Tags)\r\n| extend Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance), ClerkType = tostring(Tags.clerk_type);\r\ndata\r\n| summarize arg_max(TimeGenerated, Val) by ClerkType, Database, Instance\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| project Database = iff(Database == Instance, Database, strcat(Database, ' on ', Instance)), ClerkType, Size = Val\r\n| extend jkey = strcat(Database, '/', ClerkType)\r\n| join kind = inner (data\r\n | make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ClerkType, Instance, Database\r\n | project Database = iff(Database == Instance, Database, strcat(Database, ' on ', Instance)), DbKey = tolower(strcat(Instance, '/', Database)), ClerkType, Trend\r\n | extend jkey = strcat(Database, '/', ClerkType)\r\n ) on jkey\r\n| join kind = leftouter (range i from 1 to 1 step 1\r\n | extend d = dynamic({SqlServerMapping})\r\n | mv-expand d\r\n | project DatabaseId = tostring(d.db), ServerId = tostring(d.server), DatabaseKey = tolower(strcat(d.serverName, '/', d.dbName))\r\n) on $left.DbKey == $right.DatabaseKey\r\n| project Database = iff(DatabaseId == '', Database, DatabaseId), DbKey, ClerkType, Size, ['Size trend'] = Trend\r\n\r\n", + "size": 2, + "showAnalytics": true, + "title": "By databases", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "$gen_group", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "DbKey", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "ClerkType", + "formatter": 5, + "formatOptions": {} + }, + { + "columnMatch": "Size", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 3, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Size trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "aggregation": "Sum" + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Database" + ], + "finalBy": "ClerkType" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Size_4", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Size_4", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "customWidth": "50", + "showPin": true, + "name": "Memory clerks by databases" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Memory clerks" + }, + "name": "Memory clerks" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| where Namespace contains 'sqlserver_azuredb_waitstats'\r\n| extend Tags = todynamic(Tags)\r\n| extend Database = tostring(Tags[\"database_name'\"]), Instance = tostring(Tags.sql_instance), WaitType = tostring(Tags.wait_type);\r\ndata\r\n| summarize arg_max(TimeGenerated, Val) by WaitType, Database, Instance\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| project Database = iff(Database == Instance, Database, strcat(Database, ' on ', Instance)), WaitType, Size = Val\r\n| extend jkey = strcat(Database, '/', WaitType)\r\n| join kind = inner (data\r\n | make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by WaitType, Instance, Database\r\n | project Database = iff(Database == Instance, Database, strcat(Database, ' on ', Instance)), WaitType, Trend\r\n | extend jkey = strcat(Database, '/', WaitType)\r\n ) on jkey\r\n| project Database, WaitType, Size, ['Size trend'] = Trend\r\n\r\n", + "size": 2, + "showAnalytics": true, + "title": "By wait type", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "WaitType", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Size", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 3, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Size trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "WaitType" + ], + "finalBy": "Database" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Size_3", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Size_3", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "customWidth": "50", + "showPin": true, + "name": "Wait types" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| where Namespace contains 'sqlserver_azuredb_waitstats'\r\n| extend Tags = todynamic(Tags)\r\n| extend Database = tostring(Tags[\"database_name'\"]), Instance = tostring(Tags.sql_instance), WaitType = tostring(Tags.wait_type);\r\ndata\r\n| summarize arg_max(TimeGenerated, Val) by WaitType, Database, Instance\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| project Database = iff(Database == Instance, Database, strcat(Database, ' on ', Instance)), WaitType, Size = Val\r\n| extend jkey = strcat(Database, '/', WaitType)\r\n| join kind = inner (data\r\n | make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by WaitType, Instance, Database\r\n | project Database = iff(Database == Instance, Database, strcat(Database, ' on ', Instance)), WaitType, Trend\r\n | extend jkey = strcat(Database, '/', WaitType)\r\n ) on jkey\r\n| project Database, WaitType, Size, ['Size trend'] = Trend\r\n\r\n", + "size": 2, + "showAnalytics": true, + "title": "By database", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "WaitType", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Size", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 3, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Size trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Database" + ], + "expandTopLevel": false, + "finalBy": "WaitType" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Size_3", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Size_3", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "customWidth": "50", + "showPin": true, + "name": "Wait types by database" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Wait stats" + }, + "name": "Wait stats" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| extend Tags = todynamic(Tags)\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Object = tostring(Tags.object)\r\n| where Object endswith 'availability replica'\r\n| extend Counter = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.instance), SqlInstance = tostring(Tags.sql_instance)\r\n| where Instance !~ 'Total';\r\ndata\r\n| summarize (t1, StartValue) = arg_min(TimeGenerated, Val), (t2, EndValue) = arg_max(TimeGenerated, Val) by Database, SqlInstance, Counter, Instance\r\n| project Value = EndValue - StartValue, Database, SqlInstance, Counter, Instance\r\n| summarize \r\n SendsToTransportsPerSec = sumif(Value, Counter =~ 'Sends to Transport/sec'),\r\n SendsToReplicasPerSec = sumif(Value, Counter =~ 'Sends to Replica/sec'),\r\n ReceivesFromReplicasPerSec = sumif(Value, Counter =~ 'Receives from Replica/sec'),\r\n ResentMessagesPerSec = sumif(Value, Counter =~ 'Resent Messages/sec'),\r\n FlowControlPerSec = sumif(Value, Counter =~ 'Flow Control/sec'),\r\n FlowControlTimeMsPerSec = sumif(Value, Counter =~ 'Flow Control Time (ms/sec)')\r\n by SqlInstance, Database, Instance", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "SqlInstance", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Instance", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SendsTo.*|Receives.*", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "ResentMessagesPerSec", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "FlowControlPerSec", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "FlowControlTimeMsPerSec", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "SqlInstance", + "Database" + ], + "expandTopLevel": true, + "finalBy": "Instance" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_SendsTo.*|Receives.*_4", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "SqlInstance" + }, + { + "columnId": "Database" + }, + { + "columnId": "Instance" + }, + { + "columnId": "SendsToTransportsPerSec", + "label": "Sends to transports" + }, + { + "columnId": "SendsToReplicasPerSec", + "label": "Sendsv to replicas" + }, + { + "columnId": "ReceivesFromReplicasPerSec", + "label": "Receives from replocas" + }, + { + "columnId": "ResentMessagesPerSec", + "label": "Resent messages" + }, + { + "columnId": "FlowControlPerSec", + "label": "Flow control" + }, + { + "columnId": "FlowControlTimeMsPerSec", + "label": "Flow control time (ms/sec)" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_SendsTo.*|Receives.*_4", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "Replicas" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Replicas" + }, + "name": "Replicas" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| extend Tags = todynamic(Tags)\r\n| where Namespace =~ 'sqlserver_performance' and tostring(Tags.object) endswith ':Databases' and tostring(Tags.instance) !~ 'total'\r\n| extend Database = tostring(Tags.database_name), SqlInstance = tostring(Tags.sql_instance), Counter = tostring(Tags.counter), DbInstance = tostring(Tags.instance)\r\n| summarize arg_max(TimeGenerated, Val) by Counter, Database, SqlInstance, DbInstance\r\n| extend Database = iff(Database == SqlInstance, Database, strcat(Database, ' on ', SqlInstance))\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| summarize \r\n DataFilesSize = sumif(Val, Counter == 'Data File(s) Size (KB)'),\r\n LogFilesSize = sumif(Val, Counter == 'Log File(s) Size (KB)'),\r\n LogFilesUsedSize = sumif(Val, Counter == 'Log File(s) Used Size (KB)'),\r\n PercentLogUsed = sumif(Val, Counter == 'Percent Log Used'),\r\n XTPMemoryUsed = sumif(Val, Counter == 'XTP Memory Used (KB)')\r\n by Database, DbInstance\r\n\r\n", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DbInstance", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DataFilesSize|LogFilesSize|LogFilesUsedSize", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 3, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "PercentLogUsed", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "XTPMemoryUsed", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 3, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Database" + ], + "expandTopLevel": false, + "finalBy": "DbInstance" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_DataFilesSize|LogFilesSize|LogFilesUsedSize_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Database" + }, + { + "columnId": "DbInstance" + }, + { + "columnId": "DataFilesSize", + "label": "Data file(s) size" + }, + { + "columnId": "LogFilesSize", + "label": "Log file(s) size" + }, + { + "columnId": "LogFilesUsedSize", + "label": "Data file(s) used size" + }, + { + "columnId": "PercentLogUsed", + "label": "Percent log used" + }, + { + "columnId": "XTPMemoryUsed", + "label": "XTP memory used" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_DataFilesSize|LogFilesSize|LogFilesUsedSize_3", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "File sizes" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "File sizes" + }, + "name": "File sizes" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| extend Tags = todynamic(Tags)\r\n| where Namespace =~ 'sqlserver_performance' and tostring(Tags.object) endswith ':Databases' and tostring(Tags.instance) !~ 'total'\r\n| extend Database = tostring(Tags.database_name), SqlInstance = tostring(Tags.sql_instance), Counter = tostring(Tags.counter), DbInstance = tostring(Tags.instance)\r\n| summarize arg_max(TimeGenerated, Val) by Counter, Database, SqlInstance, DbInstance\r\n| extend Database = iff(Database == SqlInstance, Database, strcat(Database, ' on ', SqlInstance))\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| summarize \r\n TransactionsPerSec = sumif(Val, Counter == 'Transactions/sec'),\r\n WriteTransactionsPerSec = sumif(Val, Counter == 'Write Transactions/sec'),\r\n LogFlushesPerSec = sumif(Val, Counter == 'Log Flushes/sec'),\r\n LogBytesFlushedPerSec = sumif(Val, Counter == 'Log Bytes Flushed/sec'),\r\n LogFlushWaitTime = sumif(Val, Counter == 'Log Flush Wait Time')\r\n by Database, DbInstance\r\n\r\n", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DbInstance", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TransactionsPerSec|WriteTransactionsPerSec", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "LogFlushesPerSec", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "LogBytesFlushedPerSec", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "LogFlushWaitTime", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "$gen_group", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Database" + ], + "expandTopLevel": false, + "finalBy": "DbInstance" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_TransactionsPerSec|WriteTransactionsPerSec_2", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Database" + }, + { + "columnId": "DbInstance" + }, + { + "columnId": "TransactionsPerSec", + "label": "Transactions/sec" + }, + { + "columnId": "WriteTransactionsPerSec", + "label": "Write transactions/sec" + }, + { + "columnId": "LogFlushesPerSec", + "label": "Log flushes/ses" + }, + { + "columnId": "LogBytesFlushedPerSec", + "label": "Log bytes flushed/sec" + }, + { + "columnId": "LogFlushWaitTime", + "label": "Log flush wait time" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_TransactionsPerSec|WriteTransactionsPerSec_2", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "Transactions" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Transactions" + }, + "name": "Transactions" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| extend Tags = todynamic(Tags)\r\n| where Namespace =~ 'sqlserver_database_io'\r\n| extend Database = tostring(Tags.database_name), SqlInstance = tostring(Tags.sql_instance), FileType = tostring(Tags.file_type)\r\n| summarize arg_max(TimeGenerated, Val) by Name, Database, SqlInstance, FileType\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| summarize\r\n DataReadBytes = sumif(Val, Name == 'read_bytes' and FileType == 'DATA'),\r\n DataWriteBytes = sumif(Val, Name == 'write_bytes' and FileType == 'DATA'),\r\n DataReadLatency = sumif(Val, Name == 'read_latency_ms' and FileType == 'DATA'),\r\n DataWriteLatency = sumif(Val, Name == 'write_latency_ms' and FileType == 'DATA'),\r\n LogReadBytes = sumif(Val, Name == 'read_bytes' and FileType == 'LOG'),\r\n LogWriteBytes = sumif(Val, Name == 'write_bytes' and FileType == 'LOG'),\r\n LogReadLatency = sumif(Val, Name == 'read_latency_ms' and FileType == 'LOG'),\r\n LogWriteLatency = sumif(Val, Name == 'write_latency_ms' and FileType == 'LOG')\r\n by SqlInstance, Database\r\n", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "SqlInstance", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DataReadBytes|DataWriteBytes", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "DataReadLatency|DataWriteLatency", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true, + "aggregation": "Max" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "LogReadBytes|LogWriteBytes", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "LogReadLatency|LogWriteLatency", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true, + "aggregation": "Max" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "SqlInstance" + ], + "finalBy": "Database" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_DataReadBytes|DataWriteBytes_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "SqlInstance" + }, + { + "columnId": "Database" + }, + { + "columnId": "DataReadBytes", + "label": "Data read bytes" + }, + { + "columnId": "DataWriteBytes", + "label": "Data write bytes" + }, + { + "columnId": "DataReadLatency", + "label": "Data read latency" + }, + { + "columnId": "DataWriteLatency", + "label": "Data write latency" + }, + { + "columnId": "LogReadBytes", + "label": "Log read bytes" + }, + { + "columnId": "LogWriteBytes", + "label": "Log write bytes" + }, + { + "columnId": "LogReadLatency", + "label": "Log read latency" + }, + { + "columnId": "LogWriteLatency", + "label": "Log write latency" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_DataReadBytes|DataWriteBytes_3", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "Transactions" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Database IO" + }, + "name": "Database IO" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "67abcecf-6d70-4cbc-bea8-cd2b82f4cabc", + "version": "KqlParameterItem/1.0", + "name": "SuggestedAlerts", + "type": 1, + "isRequired": true, + "value": "[ { \"AlertName\": \"SQL-deadlocks-per-sec\", \"AlertDescription\": \"Fires when SQL deadlocks are detected\", \"AlertThreshold\": 0, \"AlertTemplate\": \"https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Alerts/Sql/sql-deadlocks-per-second/azuredeploy.json\" }, { \"AlertName\": \"SQL-processes-blocked\", \"AlertDescription\": \"Fires when blocked SQL processes are detected\", \"AlertThreshold\": 0, \"AlertTemplate\": \"https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Alerts/Sql/sql-processes-blocked/azuredeploy.json\" }, { \"AlertName\": \"SQL-memory-grants-pending\", \"AlertDescription\": \"Fires when pending memory grants are detected\", \"AlertThreshold\": 0, \"AlertTemplate\": \"https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Alerts/Sql/sql-memory-grants-pending/azuredeploy.json\" } ]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Alerts group", + "items": [] + }, + "name": "group - 1" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Alerts" + }, + "name": "Alerts group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Workspaces}" + ], + "parameters": [ + { + "id": "ae79ae33-8c8f-4387-a2ed-8586f10ad744", + "version": "KqlParameterItem/1.0", + "name": "Counter", + "type": 2, + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| extend Tags = todynamic(Tags)\r\n| where Namespace =~ 'sqlserver_performance'\r\n| extend Counter = tostring(Tags.counter), Object = tostring(Tags.object)\r\n| extend ObjectFriendlyName = extract(@'.+:(.+)', 1, Object)\r\n| summarize by Object = ObjectFriendlyName, Counter\r\n| order by Object asc, Counter asc\r\n| extend Rank = row_number()\r\n| project value = Counter, label = Counter, selected = Rank == 1, group = Object\r\n", + "crossComponentResources": [ + "{Workspaces}" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "a14c74d6-4abb-4684-95eb-3a699da03313", + "version": "KqlParameterItem/1.0", + "name": "Aggregation", + "type": 2, + "value": "avg(Val)", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": \"sum(Val)\", \"label\":\"Sum\" },\r\n { \"value\": \"avg(Val)\", \"label\":\"Average\" },\r\n { \"value\": \"min(Val)\", \"label\":\"Min\" },\r\n { \"value\": \"max(Val)\", \"label\":\"Max\" },\r\n { \"value\": \"count()\", \"label\":\"Count\" }\r\n]", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputerNames})\r\n| extend Tags = todynamic(Tags)\r\n| where Namespace =~ 'sqlserver_performance'\r\n| extend Database = tostring(Tags.database_name), SqlInstance = tostring(Tags.sql_instance), Counter = tostring(Tags.counter)\r\n| where Counter == '{Counter}'\r\n| make-series Trend = {Aggregation} default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Database", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "rowLimit": 1000, + "filter": true, + "labelSettings": [ + { + "columnId": "Database" + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "Sql counters" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Sql counters" + }, + "name": "Sql counters" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Resources\n| where id in ({SqlDatabases})\n| project id = tolower(id), name\n| join kind = leftouter (Resources\n | where type =~ 'microsoft.compute/virtualmachines'\n | project Vm = tolower(id)\n | join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name in~ ('workload.linuxconfigagent') or properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"]), MonitoredResource = tolower(tostring(tags[\"monitored-resource\"])), WorkspaceId = tostring(properties.settings.workspaceId), name, type=properties.type, publisher=properties.publisher\n | where Vm != ''\n | where ((Insight =~ 'sql-azure') and (name =~ 'workload.linuxconfigagent')) or ((type == 'OmsAgentForLinux' and publisher == 'Microsoft.EnterpriseCloud.Monitoring') and (WorkspaceId != ''))\n | summarize MonitoredResource = any(MonitoredResource), WorkspaceId = any(WorkspaceId) by Vm\n ) on $left.Vm == $right.Vm\n | project-away Vm1\n | join kind = leftouter (Resources\n | where type =~ 'microsoft.operationalinsights/workspaces'\n | project Workspace = id, location, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\n) on $left.id == $right.MonitoredResource\n| project-away MonitoredResource, WorkspaceId, WorkspaceId1\n| project ['Sql database'] = id, ['Monitored by'] = Vm, Workspace, Rank = iff(Vm == '', 0, 1), name, ['Monitoring status'] = iff(Vm == '', 'Disabled', 'Enabled'), Action = iff(Vm == '', 'Enable monitoring', 'Update settings')\n| order by Rank desc, name asc\n| project-away name, Rank", + "size": 0, + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "value::all" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Monitoring status", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Enabled", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "4", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Action", + "formatter": 7, + "formatOptions": { + "linkTarget": "WorkbookTemplate", + "linkIsContextBlade": true, + "workbookContext": { + "componentIdSource": "column", + "componentId": "Sql database", + "resourceIdsSource": "column", + "resourceIds": "Sql database", + "templateIdSource": "static", + "templateId": "Community-Workbooks/Workloads/Onboard SQL Azure Insights", + "typeSource": "static", + "type": "workload-insights", + "gallerySource": "static", + "gallery": "Azure Monitor", + "locationSource": "workbook" + } + } + } + ], + "filter": true + }, + "sortBy": [] + }, + "showPin": true, + "name": "Onboarding step" + } + ] + }, + "name": "Onboarding group" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Enable monitoring" + }, + "name": "Onboarding group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/SQL Azure Insights/settings.json b/Workloads/Workbooks/SQL Azure Insights/settings.json new file mode 100644 index 0000000..b25dfe7 --- /dev/null +++ b/Workloads/Workbooks/SQL Azure Insights/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"SQL Azure Insights", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "order": 100 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/SQL Insights/SQL Insights.workbook b/Workloads/Workbooks/SQL Insights/SQL Insights.workbook new file mode 100644 index 0000000..6866cb6 --- /dev/null +++ b/Workloads/Workbooks/SQL Insights/SQL Insights.workbook @@ -0,0 +1,2844 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "1f74ed9a-e3ed-498d-bd5b-f68f3836a117", + "version": "KqlParameterItem/1.0", + "name": "Subscription", + "label": "Subscriptions", + "type": 6, + "description": "All subscriptions with virtual machines", + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines'\r\n| project id = tolower(id), subscriptionId\r\n| join kind = leftouter (Resources\r\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\r\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\r\n | where Vm != '' and Insight == 'mssql'\r\n ) on $left.id == $right.Vm\r\n| summarize Onboarded = countif(Vm != ''), All = count() by subscriptionId\r\n| order by Onboarded desc, All desc\r\n| extend Row = row_number()\r\n| project value = subscriptionId, label = subscriptionId, selected = Row == 1\r\n", + "crossComponentResources": [ + "value::selected" + ], + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "f60ea0a0-3703-44ca-a59b-df0246423f41", + "version": "KqlParameterItem/1.0", + "name": "Resources", + "label": "All virtual machines", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\r\n| where type =~ 'microsoft.compute/virtualmachines'\r\n| order by name asc\r\n| extend Rank = row_number()\r\n| project value = id, label = name, selected = false, group = resourceGroup", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "5e510131-51a9-40c0-b1a8-328932b5f46e", + "version": "KqlParameterItem/1.0", + "name": "OnboardedComputers", + "label": "Monitored VMs", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": " Resources\n| where id in~ ({Resources})\n| project ['Virtual machine'] = tolower(id), Name = name, ['Resource group'] = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), Subscription = subscriptionId, Location = location, OsType = iff(properties.osProfile.windowsConfiguration == '', 'Linux', 'Windows'), Offer = tostring(properties.storageProfile.imageReference.offer)\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == 'mssql'\n ) on $left.['Virtual machine'] == $right.Vm\n| project Name\n", + "crossComponentResources": [ + "{Subscription}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "", + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "619bf90b-5093-47cc-83a3-bf009257bc7d", + "version": "KqlParameterItem/1.0", + "name": "Workspaces", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "Resources\n| where id in~ ({Resources})\n| project ['Virtual machine'] = tolower(id), Name = name, ['Resource group'] = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), Subscription = subscriptionId, Location = location, OsType = iff(properties.osProfile.windowsConfiguration == '', 'Linux', 'Windows'), Offer = tostring(properties.storageProfile.imageReference.offer)\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == 'mssql'\n ) on $left.['Virtual machine'] == $right.Vm\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and properties.type == 'OmsAgentForLinux' and properties.publisher == 'Microsoft.EnterpriseCloud.Monitoring'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), WorkspaceId = tostring(properties.settings.workspaceId)\n | where Vm != ''\n ) on $left.['Virtual machine'] == $right.Vm\n| project-away Vm, Vm1\n| join kind = leftouter (Resources\n| where type =~ 'microsoft.operationalinsights/workspaces'\n| project Workspace = id, location, WorkspaceId = tostring(properties.customerId)) on WorkspaceId\n| summarize by Workspace\n| project value = Workspace, label = Workspace, selected = true\n", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "e6598941-f9f5-4deb-bd0d-48658ade8297", + "version": "KqlParameterItem/1.0", + "name": "OnboardedComputerCount", + "type": 1, + "isRequired": true, + "query": " Resources\n| where id in~ ({Resources})\n| project ['Virtual machine'] = tolower(id), Name = name, ['Resource group'] = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup), Subscription = subscriptionId, Location = location, OsType = iff(properties.osProfile.windowsConfiguration == '', 'Linux', 'Windows'), Offer = tostring(properties.storageProfile.imageReference.offer)\n| join kind = inner (Resources\n | where type =~ 'microsoft.compute/virtualmachines/extensions' and name =~ 'workload.linuxconfigagent'\n | project Vm = extract(@'(.+)/extensions/.+', 1, tolower(id)), Insight = tostring(tags[\"monitoring-insight\"])\n | where Vm != '' and Insight == 'mssql'\n ) on $left.['Virtual machine'] == $right.Vm\n| project Name\n| count\n| project Count = tostring(Count)\n", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "label": "Onboarded computer count" + }, + { + "id": "8f9e3ccf-8531-4e91-b040-48f894187676", + "version": "KqlParameterItem/1.0", + "name": "SqlServers", + "label": "Sql servers", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "InsightsMetrics\n| project Instance = tostring(todynamic(Tags).sql_instance)\n| summarize by Instance\n| where Instance <> '' \n\n", + "crossComponentResources": [ + "{Workspaces}" + ], + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "*" + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "4908b8cf-7658-4356-9aa5-5dc5aca7a1aa", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time range", + "type": 4, + "value": { + "durationMs": 14400000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ], + "allowCustom": true + }, + "resourceType": "microsoft.insights/components" + }, + { + "id": "bb7b9387-0445-4ee2-9fc7-f52cb9f59e8c", + "version": "KqlParameterItem/1.0", + "name": "TotalComputers", + "type": 1, + "query": "Resources\n| where type =~ 'microsoft.compute/virtualmachines'\n| extend resourceGroupId = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)\n| count\n| project Count = tostring(Count)", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "label": "Total computer count" + }, + { + "id": "763c4b4e-d6f0-4666-b19f-6caf14a534fd", + "version": "KqlParameterItem/1.0", + "name": "SqlServerMapping", + "type": 1, + "query": "Resources\n| where type =~ 'microsoft.sql/servers'\n| summarize Data = tostring(makelist(pack('id', id, 'name', name), 10000))", + "crossComponentResources": [ + "value::all" + ], + "isHiddenWhenLocked": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "label": "Sql mappings" + }, + { + "id": "4db95b3b-1e67-4e9c-87ec-6b4a38baf694", + "version": "KqlParameterItem/1.0", + "name": "OnboardingTemplate", + "type": 1, + "isRequired": true, + "value": "Community-Workbooks/Workloads/Onboard MSSQL Insights", + "isHiddenWhenLocked": true, + "resourceType": "microsoft.insights/components", + "label": "Onboarding template" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "*Virtual machines*\n# {OnboardedComputerCount} / {TotalComputers}\n*Remotely monitoring SQL Servers*" + }, + "name": "text - 11" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Overview", + "subTarget": "Overview", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Activities", + "subTarget": "Activities", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Memory clerks", + "subTarget": "Memory clerks", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Wait stats", + "subTarget": "Wait stats", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Replicas", + "subTarget": "Replicas", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "File sizes", + "subTarget": "File sizes", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Transactions", + "subTarget": "Transactions", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Database IO", + "subTarget": "Database IO", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Alerts", + "subTarget": "Alerts", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Sql counters", + "subTarget": "Sql counters", + "style": "link" + }, + { + "cellValue": "selectedTab", + "linkTarget": "parameter", + "linkLabel": "Enable monitoring", + "subTarget": "Enable monitoring", + "style": "link" + } + ] + }, + "name": "links - 1", + "styleSettings": { + "margin": "15px 0 0 0" + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| where Namespace contains 'sqlserver_server_properties'\r\n| extend Tags = todynamic(Tags)\r\n| extend Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| extend DatabaseKey = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| where Instance in ({SqlServers}) or '*' in ({SqlServers})\r\n| where Name in ('db_online', 'db_offline', 'db_offline', 'db_recovering', 'db_recoveryPending', 'db_restoring', 'db_suspect');\r\nlet summary = data\r\n| summarize arg_max(TimeGenerated, Name, Val) by Name, DatabaseKey, Computer\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), 0.0, Val)\r\n| summarize Val = sum(Val) by Name\r\n| project Name, Value = Val;\r\nlet trend = data\r\n| where Name != 'db_online'\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Name\r\n| union (data\r\n| where Name == 'db_online'\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Name);\r\nsummary\r\n| join kind = inner (trend) on Name\r\n| join kind = inner (datatable(Name:string, Rank:int)[\r\n'db_online', 1, 'db_offline', 2, 'db_recovering', 3, 'db_recoveryPending', 4, 'db_restoring', 5, 'db_suspect', 6\r\n]) on Name\r\n| order by Rank asc\r\n| project Name, Value, Trend\r\n| extend Name = case(\r\n Name == 'db_online', 'Online databases',\r\n Name == 'db_offline', 'Offline',\r\n Name == 'db_recovering', 'Recovering',\r\n Name == 'db_recoveryPending', 'Recovery pending',\r\n Name == 'db_restoring', 'Restoring',\r\n Name == 'db_suspect', 'Suspect',\r\n Name\r\n)\r\n", + "size": 4, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "tiles", + "gridSettings": { + "sortBy": [ + { + "itemKey": "Name", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "Name", + "sortOrder": 1 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "name": "query - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let azuresqlservers = dynamic({SqlServerMapping});\r\nlet data = InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| where Namespace contains 'sqlserver_server_properties'\r\n| extend Tags = todynamic(Tags)\r\n| extend Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| extend DatabaseKey = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| where Instance in ({SqlServers}) or '*' in ({SqlServers});\r\ndata\r\n| summarize arg_max(TimeGenerated, Val) by Name, Database, Instance, Computer\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| summarize Online = sumif(Val, Name == 'db_online'),\r\n Offline = sumif(Val, Name == 'db_offline'),\r\n Recovering = sumif(Val, Name == 'db_recovering'),\r\n ['Recovery pending'] = sumif(Val, Name == 'db_recoveryPending'),\r\n Restoring = sumif(Val, Name == 'db_restoring'),\r\n Suspect = sumif(Val, Name == 'db_suspect'),\r\n CPUs = sumif(Val, Name == 'cpu_count'),\r\n ['Server memory'] = sumif(Val, Name == 'server_memory'),\r\n ['Total storage'] = sumif(Val, Name == 'total_storage_mb'),\r\n ['Engine edition'] = sumif(Val, Name == 'engine_edition')\r\n by Database, Instance, Computer\r\n| extend jkey = strcat(Instance, '/', Database)\r\n| join kind = inner (data\r\n | where Name == 'db_online'\r\n | make-series Trend = min(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Database, Instance\r\n | extend jkey = strcat(Instance, '/', Database)\r\n ) on jkey\r\n| join kind = leftouter (range i from 1 to 1 step 1\r\n | extend d = dynamic({SqlServerMapping})\r\n | mv-expand d\r\n | project id = tostring(d.id), name = tostring(d.name)\r\n) on $left.Instance == $right.name\r\n| project ['Sql database'] = iff(id == '', strcat(Instance, '/', Database), strcat(id, '/databases/', Database)), ['Monitored by'] = Computer, Online, ['Online trend'] = Trend, Offline, Recovering, ['Recovery pending'], Restoring, Suspect, CPUs, ['Server memory'], ['Total storage'], ['Engine edition']\r\n", + "size": 2, + "showAnalytics": true, + "title": "Server details", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Online_2", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Online_2", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "Server details" + } + ] + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + { + "parameterName": "OnboardedComputerCount", + "comparison": "isNotEqualTo", + "value": "0" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Overview" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## The virtual machines in this scope are not configured to monitor remote SQL Servers." + }, + "name": "text - 0", + "styleSettings": { + "margin": "20px 0 0 0" + } + }, + { + "type": 1, + "content": { + "json": "![Microsoft SQL Server logot](https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/DeployVme/sql-logo.jpg)\r\n" + }, + "name": "text - 0 - Copy", + "styleSettings": { + "margin": "20px 0 15px 0" + } + }, + { + "type": 1, + "content": { + "json": "Use the **Enable monitoring** tab to configure machines to beging monitoring SQL Servers.\r\n" + }, + "name": "text - 0 - Copy" + } + ] + }, + "conditionalVisibilities": [ + { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + { + "parameterName": "OnboardedComputerCount", + "comparison": "isEqualTo", + "value": "0" + } + ], + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Overview" + }, + "name": "Onboarding message" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'User connections'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "User connections", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 17, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "User connections" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'Transactions/sec'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Transtions./sec", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 31, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "Transtions/sec" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'Batch requests/sec'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Batch requests/sec", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 31, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "Batch requests per second" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'SQL compilations/sec'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "SQL compilations/sec", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 31, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "SQL compilations/sec" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'SQL re-compilations/sec'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "SQL re-compilations/sec", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 31, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "SQL re-compilations/sec" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'Processes blocked'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Processes blocked", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 17, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "Processes blocked" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Tags = todynamic(Tags)\r\n| extend Name = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance)\r\n| where Name =~ 'Number of deadlocks/sec'\r\n| extend SeriesName = iff(Database == Instance, Database, strcat(Database, ' on ', Instance))\r\n| make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SeriesName", + "size": 0, + "aggregation": 5, + "showAnalytics": true, + "title": "Number of deadlocks/sec", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "timechart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Online", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "minimumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Online trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + } + }, + { + "columnMatch": "Offline|Recovering|Recovery pending|Restoring|Suspect", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "red", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 1 + } + } + }, + { + "columnMatch": "Server memory", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 4, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Total storage", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 38, + "options": { + "style": "decimal" + } + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + }, + "chartSettings": { + "ySettings": { + "unit": 31, + "min": null, + "max": null + } + } + }, + "customWidth": "33", + "showPin": true, + "name": "Number of deadlocks/sec" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Activities" + }, + "name": "Activities" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| where Namespace contains 'sqlserver_memory_clerks'\r\n| extend Tags = todynamic(Tags)\r\n| extend Database = tostring(Tags.database_name), Instance = tostring(Tags.sql_instance), ClerkType = tostring(Tags.clerk_type);\r\ndata\r\n| summarize arg_max(TimeGenerated, Val) by ClerkType, Database, Instance\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| project Database = iff(Database == Instance, Database, strcat(Database, ' on ', Instance)), ClerkType, Size = Val\r\n| extend jkey = strcat(Database, '/', ClerkType)\r\n| join kind = inner (data\r\n | make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ClerkType, Instance, Database\r\n | project Database = iff(Database == Instance, Database, strcat(Database, ' on ', Instance)), ClerkType, Trend\r\n | extend jkey = strcat(Database, '/', ClerkType)\r\n ) on jkey\r\n| project Database, ClerkType, Size, ['Size trend'] = Trend\r\n\r\n", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ClerkType", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Size", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 3, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Size trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Database" + ], + "finalBy": "ClerkType" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Size_3", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Size_3", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "Memory clerks by databases" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Memory clerks" + }, + "name": "Memory clerks" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| where Namespace in~ ('sqlserver_azuredb_waitstats', 'sqlserver_waitstats')\r\n| extend Tags = todynamic(Tags)\r\n| extend Database = tostring(Tags[\"database_name'\"]), Instance = tostring(Tags.sql_instance), WaitType = tostring(Tags.wait_type);\r\ndata\r\n| summarize arg_max(TimeGenerated, Val) by WaitType, Database, Instance\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| project Database = iff(Database == Instance, Database, strcat(Database, ' on ', Instance)), WaitType, Size = Val\r\n| extend jkey = strcat(Database, '/', WaitType)\r\n| join kind = inner (data\r\n | make-series Trend = sum(Val) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by WaitType, Instance, Database\r\n | project Database = iff(Database == Instance, Database, strcat(Database, ' on ', Instance)), WaitType, Trend\r\n | extend jkey = strcat(Database, '/', WaitType)\r\n ) on jkey\r\n| project Database, WaitType, Size, ['Size trend'] = Trend\r\n\r\n", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "WaitType", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Size", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 3, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "Size trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "useGrouping": false + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Database" + ], + "expandTopLevel": false, + "finalBy": "WaitType" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Size_3", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_Size_3", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "Wait types by database" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Wait stats" + }, + "name": "Wait stats" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| extend Tags = todynamic(Tags)\r\n| where Namespace =~ 'sqlserver_performance' \r\n| extend Object = tostring(Tags.object)\r\n| where Object endswith 'availability replica'\r\n| extend Counter = tostring(Tags.counter), Database = tostring(Tags.database_name), Instance = tostring(Tags.instance), SqlInstance = tostring(Tags.sql_instance)\r\n| where Instance !~ 'Total';\r\ndata\r\n| summarize (t1, StartValue) = arg_min(TimeGenerated, Val), (t2, EndValue) = arg_max(TimeGenerated, Val) by Database, SqlInstance, Counter, Instance\r\n| project Value = EndValue - StartValue, Database, SqlInstance, Counter, Instance\r\n| summarize \r\n SendsToTransportsPerSec = sumif(Value, Counter =~ 'Sends to Transport/sec'),\r\n SendsToReplicasPerSec = sumif(Value, Counter =~ 'Sends to Replica/sec'),\r\n ReceivesFromReplicasPerSec = sumif(Value, Counter =~ 'Receives from Replica/sec'),\r\n ResentMessagesPerSec = sumif(Value, Counter =~ 'Resent Messages/sec'),\r\n FlowControlPerSec = sumif(Value, Counter =~ 'Flow Control/sec'),\r\n FlowControlTimeMsPerSec = sumif(Value, Counter =~ 'Flow Control Time (ms/sec)')\r\n by SqlInstance, Database, Instance", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "SqlInstance", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Instance", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "SendsTo.*|Receives.*", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 11, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "ResentMessagesPerSec", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "FlowControlPerSec", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "FlowControlTimeMsPerSec", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "SqlInstance", + "Database" + ], + "expandTopLevel": true, + "finalBy": "Instance" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_SendsTo.*|Receives.*_4", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "SqlInstance" + }, + { + "columnId": "Database" + }, + { + "columnId": "Instance" + }, + { + "columnId": "SendsToTransportsPerSec", + "label": "Sends to transports" + }, + { + "columnId": "SendsToReplicasPerSec", + "label": "Sendsv to replicas" + }, + { + "columnId": "ReceivesFromReplicasPerSec", + "label": "Receives from replocas" + }, + { + "columnId": "ResentMessagesPerSec", + "label": "Resent messages" + }, + { + "columnId": "FlowControlPerSec", + "label": "Flow control" + }, + { + "columnId": "FlowControlTimeMsPerSec", + "label": "Flow control time (ms/sec)" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_SendsTo.*|Receives.*_4", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "Replicas" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Replicas" + }, + "name": "Replicas" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| extend Tags = todynamic(Tags)\r\n| where Namespace =~ 'sqlserver_performance' and tostring(Tags.object) endswith ':Databases' and tostring(Tags.instance) !~ 'total'\r\n| extend Database = tostring(Tags.database_name), SqlInstance = tostring(Tags.sql_instance), Counter = tostring(Tags.counter), DbInstance = tostring(Tags.instance)\r\n| summarize arg_max(TimeGenerated, Val) by Counter, Database, SqlInstance, DbInstance\r\n| extend Database = iff(Database == SqlInstance, Database, strcat(Database, ' on ', SqlInstance))\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| summarize \r\n DataFilesSize = sumif(Val, Counter == 'Data File(s) Size (KB)'),\r\n LogFilesSize = sumif(Val, Counter == 'Log File(s) Size (KB)'),\r\n LogFilesUsedSize = sumif(Val, Counter == 'Log File(s) Used Size (KB)'),\r\n PercentLogUsed = sumif(Val, Counter == 'Percent Log Used'),\r\n XTPMemoryUsed = sumif(Val, Counter == 'XTP Memory Used (KB)')\r\n by Database, DbInstance\r\n\r\n", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DbInstance", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DataFilesSize|LogFilesSize|LogFilesUsedSize", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 3, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "PercentLogUsed", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "XTPMemoryUsed", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 3, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Database" + ], + "expandTopLevel": false, + "finalBy": "DbInstance" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_DataFilesSize|LogFilesSize|LogFilesUsedSize_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Database" + }, + { + "columnId": "DbInstance" + }, + { + "columnId": "DataFilesSize", + "label": "Data file(s) size" + }, + { + "columnId": "LogFilesSize", + "label": "Log file(s) size" + }, + { + "columnId": "LogFilesUsedSize", + "label": "Data file(s) used size" + }, + { + "columnId": "PercentLogUsed", + "label": "Percent log used" + }, + { + "columnId": "XTPMemoryUsed", + "label": "XTP memory used" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_DataFilesSize|LogFilesSize|LogFilesUsedSize_3", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "File sizes" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "File sizes" + }, + "name": "File sizes" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| extend Tags = todynamic(Tags)\r\n| where Namespace =~ 'sqlserver_performance' and tostring(Tags.object) endswith ':Databases' and tostring(Tags.instance) !~ 'total'\r\n| extend Database = tostring(Tags.database_name), SqlInstance = tostring(Tags.sql_instance), Counter = tostring(Tags.counter), DbInstance = tostring(Tags.instance)\r\n| summarize arg_max(TimeGenerated, Val) by Counter, Database, SqlInstance, DbInstance\r\n| extend Database = iff(Database == SqlInstance, Database, strcat(Database, ' on ', SqlInstance))\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| summarize \r\n TransactionsPerSec = sumif(Val, Counter == 'Transactions/sec'),\r\n WriteTransactionsPerSec = sumif(Val, Counter == 'Write Transactions/sec'),\r\n LogFlushesPerSec = sumif(Val, Counter == 'Log Flushes/sec'),\r\n LogBytesFlushedPerSec = sumif(Val, Counter == 'Log Bytes Flushed/sec'),\r\n LogFlushWaitTime = sumif(Val, Counter == 'Log Flush Wait Time')\r\n by Database, DbInstance\r\n\r\n", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DbInstance", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "TransactionsPerSec|WriteTransactionsPerSec", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "LogFlushesPerSec", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "LogBytesFlushedPerSec", + "formatter": 0, + "formatOptions": { + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "LogFlushWaitTime", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "$gen_group", + "formatter": 0, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 31, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Database" + ], + "expandTopLevel": false, + "finalBy": "DbInstance" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_TransactionsPerSec|WriteTransactionsPerSec_2", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Database" + }, + { + "columnId": "DbInstance" + }, + { + "columnId": "TransactionsPerSec", + "label": "Transactions/sec" + }, + { + "columnId": "WriteTransactionsPerSec", + "label": "Write transactions/sec" + }, + { + "columnId": "LogFlushesPerSec", + "label": "Log flushes/ses" + }, + { + "columnId": "LogBytesFlushedPerSec", + "label": "Log bytes flushed/sec" + }, + { + "columnId": "LogFlushWaitTime", + "label": "Log flush wait time" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_TransactionsPerSec|WriteTransactionsPerSec_2", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "Transactions" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Transactions" + }, + "name": "Transactions" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InsightsMetrics\r\n| where Computer in~ ({OnboardedComputers})\r\n| extend Tags = todynamic(Tags)\r\n| where Namespace =~ 'sqlserver_database_io'\r\n| extend Database = tostring(Tags.database_name), SqlInstance = tostring(Tags.sql_instance), FileType = tostring(Tags.file_type)\r\n| summarize arg_max(TimeGenerated, Val) by Name, Database, SqlInstance, FileType\r\n| extend Val = iff(TimeGenerated < ({TimeRange:end} - 15m), real(null), Val)\r\n| summarize\r\n DataReadBytes = sumif(Val, Name == 'read_bytes' and FileType == 'DATA'),\r\n DataWriteBytes = sumif(Val, Name == 'write_bytes' and FileType == 'DATA'),\r\n DataReadLatency = sumif(Val, Name == 'read_latency_ms' and FileType == 'DATA'),\r\n DataWriteLatency = sumif(Val, Name == 'write_latency_ms' and FileType == 'DATA'),\r\n LogReadBytes = sumif(Val, Name == 'read_bytes' and FileType == 'LOG'),\r\n LogWriteBytes = sumif(Val, Name == 'write_bytes' and FileType == 'LOG'),\r\n LogReadLatency = sumif(Val, Name == 'read_latency_ms' and FileType == 'LOG'),\r\n LogWriteLatency = sumif(Val, Name == 'write_latency_ms' and FileType == 'LOG')\r\n by SqlInstance, Database\r\n", + "size": 2, + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspaces}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "SqlInstance", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Database", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "DataReadBytes|DataWriteBytes", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "DataReadLatency|DataWriteLatency", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true, + "aggregation": "Max" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "LogReadBytes|LogWriteBytes", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true, + "aggregation": "Sum" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + { + "columnMatch": "LogReadLatency|LogWriteLatency", + "formatter": 8, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true, + "aggregation": "Max" + }, + "numberFormat": { + "unit": 23, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + } + ], + "rowLimit": 1000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "SqlInstance" + ], + "finalBy": "Database" + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_DataReadBytes|DataWriteBytes_3", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "SqlInstance" + }, + { + "columnId": "Database" + }, + { + "columnId": "DataReadBytes", + "label": "Data read bytes" + }, + { + "columnId": "DataWriteBytes", + "label": "Data write bytes" + }, + { + "columnId": "DataReadLatency", + "label": "Data read latency" + }, + { + "columnId": "DataWriteLatency", + "label": "Data write latency" + }, + { + "columnId": "LogReadBytes", + "label": "Log read bytes" + }, + { + "columnId": "LogWriteBytes", + "label": "Log write bytes" + }, + { + "columnId": "LogReadLatency", + "label": "Log read latency" + }, + { + "columnId": "LogWriteLatency", + "label": "Log write latency" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_DataReadBytes|DataWriteBytes_3", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "Name", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 1 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 21, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + }, + "showBorder": false + } + }, + "showPin": true, + "name": "Transactions" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Database IO" + }, + "name": "Database IO" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Explore metrics group", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Sql counters" + }, + "name": "Sql counters" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "d99b3e86-2216-45cf-9f58-cc1c808241bf", + "version": "KqlParameterItem/1.0", + "name": "SuggestedAlerts", + "type": 1, + "isRequired": true, + "value": "[ { \"AlertName\": \"SQL-deadlocks-per-sec\", \"AlertDescription\": \"Fires when SQL deadlocks are detected\", \"AlertThreshold\": 0, \"AlertTemplate\": \"https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Alerts/Sql/sql-deadlocks-per-second/azuredeploy.json\" }, { \"AlertName\": \"SQL-processes-blocked\", \"AlertDescription\": \"Fires when blocked SQL processes are detected\", \"AlertThreshold\": 0, \"AlertTemplate\": \"https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Alerts/Sql/sql-processes-blocked/azuredeploy.json\" }, { \"AlertName\": \"SQL-memory-grants-pending\", \"AlertDescription\": \"Fires when pending memory grants are detected\", \"AlertThreshold\": 0, \"AlertTemplate\": \"https://raw.githubusercontent.com/acearun/managedsolutions/master/Templates/Alerts/Sql/sql-memory-grants-pending/azuredeploy.json\" } ]", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "resourceType": "microsoft.insights/components" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Alerts group", + "items": [] + }, + "name": "group - 1" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Alerts" + }, + "name": "Alerts group" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "template", + "loadFromTemplateId": "Community-Workbooks/Workloads/Enable monitoring group", + "items": [] + }, + "conditionalVisibility": { + "parameterName": "selectedTab", + "comparison": "isEqualTo", + "value": "Enable monitoring" + }, + "name": "Enable monitoring group" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workloads/Workbooks/SQL Insights/settings.json b/Workloads/Workbooks/SQL Insights/settings.json new file mode 100644 index 0000000..240c15a --- /dev/null +++ b/Workloads/Workbooks/SQL Insights/settings.json @@ -0,0 +1,9 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"SQL Server Insights", + "author": "Microsoft", + "isPreview": true, + "galleries": [ + { "type": "workbook", "resourceType": "Azure Monitor", "order": 200 } + ] +} \ No newline at end of file diff --git a/Workloads/Workbooks/categoryResources.json b/Workloads/Workbooks/categoryResources.json new file mode 100644 index 0000000..54029d6 --- /dev/null +++ b/Workloads/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Workload monitoring", "description": "", "order": 150 } +} \ No newline at end of file diff --git a/Workspace/Alerts/README b/Workspace/Alerts/README new file mode 100644 index 0000000..e7cf202 --- /dev/null +++ b/Workspace/Alerts/README @@ -0,0 +1 @@ +Put alerts in this folder \ No newline at end of file diff --git a/Workspace/Queries/README b/Workspace/Queries/README new file mode 100644 index 0000000..336f0ee --- /dev/null +++ b/Workspace/Queries/README @@ -0,0 +1 @@ +Put Log Analytics queries in this folder \ No newline at end of file diff --git a/Workspace/Workbooks/Agent Health/Agent Health.workbook b/Workspace/Workbooks/Agent Health/Agent Health.workbook new file mode 100644 index 0000000..894cbb4 --- /dev/null +++ b/Workspace/Workbooks/Agent Health/Agent Health.workbook @@ -0,0 +1,541 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Agent health\r\nUse this report to learn about the health of the agents in your workspace. \r\n
\r\n
" + }, + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 1209600000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2592000000 + } + ], + "allowCustom": null + } + }, + { + "id": "c4d8d055-6dbe-451b-bf64-2be8d9e21fd8", + "version": "KqlParameterItem/1.0", + "name": "UnhealthyCriteria", + "label": "Unhealthy Criteria", + "type": 2, + "isRequired": true, + "value": "1h", + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\":\"1m\", \"label\":\"1 minute without heartbeat\", \"selected\":false },\r\n { \"value\":\"5m\", \"label\":\"5 minutes without heartbeat\", \"selected\":false },\r\n { \"value\":\"30m\", \"label\":\"30 minutes without heartbeat\", \"selected\":false },\r\n { \"value\":\"1h\", \"label\":\"1 hour without heartbeat\", \"selected\":true },\r\n { \"value\":\"2h\", \"label\":\"2 hours without heartbeat\", \"selected\":false },\r\n { \"value\":\"8h\", \"label\":\"8 hours without heartbeat\", \"selected\":false },\r\n { \"value\":\"1d\", \"label\":\"1 day without heartbeat\", \"selected\":false },\r\n { \"value\":\"2d\", \"label\":\"2 days without heartbeat\", \"selected\":false },\r\n { \"value\":\"7d\", \"label\":\"7 days without heartbeat\", \"selected\":false }\r\n]" + }, + { + "id": "819e30a0-df07-4a23-b40e-7536c6323f38", + "version": "KqlParameterItem/1.0", + "name": "HasHeartbeat", + "type": 2, + "isRequired": true, + "query": "Heartbeat\r\n| take 1\r\n| summarize count() ", + "value": "value::1", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [ + "value::1" + ] + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 1" + }, + { + "type": 1, + "content": { + "json": "
\r\n### ⚠️ No agent health data found\r\n---\r\n\r\nLooks like no Log Analytics agent is sending health data to this workspace.\r\n\r\nPlease check out the detailed documentation on how to enable Log Analytics agent for your environment [here](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent)." + }, + "conditionalVisibility": { + "parameterName": "HasHeartbeat", + "comparison": "isEqualTo", + "value": "0" + }, + "name": "text - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "datatable(State:string, Rank:int)[\"Unhealthy\", 0, \"Healthy\", 1]\r\n| join kind = leftouter (Heartbeat\r\n| where TimeGenerated {TimeRange:query}\r\n| summarize LastHeartbeat = max(TimeGenerated) by Computer\r\n| extend State = iff(LastHeartbeat < ago({UnhealthyCriteria}), 'Unhealthy', 'Healthy')\r\n| summarize Count = dcount(Computer) by State) on State\r\n| extend Count = iff(isempty(State1), 0, Count)\r\n| project-away State1\r\n| extend Rank = iff(State == 'Unhealthy' and Count == 0, 2, Rank)\r\n| order by Rank asc", + "size": 3, + "exportDefaultValue": "All Tables", + "showAnalytics": true, + "exportToExcelOptions": "visible", + "noDataMessage": "Looks like you have no agents sending heartbeat information in this time range. Pick a larger time range or a different workspace.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "gridSettings": { + "formatters": [ + { + "columnMatch": "ComputerEnvironment", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Computer", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "OSType", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Category", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "LastHeartbeat", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "HasHeartbeat", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ] + }, + "tileSettings": { + "titleContent": { + "columnMatch": "State", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "rightContent": { + "columnMatch": "State", + "formatter": 18, + "formatOptions": { + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Unhealthy", + "representation": "4", + "text": "" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "" + } + ] + } + }, + "secondaryContent": { + "columnMatch": "AgentText", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "showBorder": false + } + }, + "conditionalVisibility": { + "parameterName": "HasHeartbeat", + "comparison": "isNotEqualTo", + "value": "0" + }, + "showPin": true, + "name": "query - 2", + "styleSettings": { + "progressStyle": "spinner" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Heartbeat\r\n| where TimeGenerated {TimeRange:query}\r\n| summarize LastHeartbeat = max(TimeGenerated) by Computer\r\n| extend State = iff(LastHeartbeat < ago({UnhealthyCriteria}), 'Unhealthy', 'Healthy')\r\n| extend TimeFromNow = now() - LastHeartbeat\r\n| extend [\"TimeAgo\"] = strcat(case(TimeFromNow < 2m, strcat(toint(TimeFromNow / 1m), ' seconds'), TimeFromNow < 2h, strcat(toint(TimeFromNow / 1m), ' minutes'), TimeFromNow < 2d, strcat(toint(TimeFromNow / 1h), ' hours'), strcat(toint(TimeFromNow / 1d), ' days')), ' ago')\r\n| join (\r\nHeartbeat\r\n| where TimeGenerated {TimeRange:query}\r\n| extend Packed = pack_all()\r\n) on Computer\r\n| where TimeGenerated == LastHeartbeat\r\n| join (\r\nHeartbeat\r\n| where TimeGenerated {TimeRange:query}\r\n| make-series InternalTrend=iff(count() > 0, 1, 0) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {UnhealthyCriteria} by Computer\r\n| extend Trend=array_slice(InternalTrend, array_length(InternalTrend) - 30, array_length(InternalTrend)-1)\r\n| extend (s_min, s_minId, s_max, s_maxId, s_avg, s_var, s_stdev) = series_stats(Trend)\r\n| project Computer, Trend, s_avg\r\n) on Computer\r\n| order by State, s_avg asc, TimeAgo\r\n| project [\"_ComputerName_\"] = Computer, [\"Computer\"]=strcat('🖥️ ', Computer), State, [\"Environment\"] = iff(ComputerEnvironment == \"Azure\", ComputerEnvironment, Category), [\"OS\"]=iff(isempty(OSName), OSType, OSName), [\"Azure Resource\"]=ResourceId, [\"Time\"]=strcat('🕒 ', TimeAgo), [\"Heartbeat Trend\"]=Trend, [\"Details\"]=Packed", + "size": 2, + "exportFieldName": "_ComputerName_", + "exportParameterName": "ComputerName", + "exportDefaultValue": "\"\"", + "showAnalytics": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "title": "Agent details", + "noDataMessage": "Looks like you have no agents sending heartbeat information in this time range. Pick a larger time range or a different workspace.", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "_ComputerName_", + "formatter": 5, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Computer", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "State", + "formatter": 18, + "formatOptions": { + "linkColumn": "Details", + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "showIcon": true, + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Unhealthy", + "representation": "4", + "text": "{0}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}" + } + ] + }, + "tooltipFormat": { + "tooltip": "Click to see details of the last event sent by this computer." + } + }, + { + "columnMatch": "Environment", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "OS", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Azure Resource", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Time", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Heartbeat Trend", + "formatter": 10, + "formatOptions": { + "palette": "redGreen", + "showIcon": true + }, + "tooltipFormat": { + "tooltip": "Each bar represents the bucket of time based on the Unhealthy Criteria. Showing last 30 buckets max." + } + }, + { + "columnMatch": "Details", + "formatter": 5, + "formatOptions": { + "linkTarget": "CellDetails", + "linkLabel": "🔍 View Details", + "linkIsContextBlade": true, + "showIcon": true + } + }, + { + "columnMatch": "ResourceId", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Category", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "OS Type", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "Time Ago", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "OSType", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "ComputerEnvironment", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "LastHeartbeat", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + } + ], + "filter": true, + "labelSettings": [ + { + "columnId": "_ComputerName_", + "label": "_ComputerName_" + }, + { + "columnId": "Computer", + "label": "Computer" + }, + { + "columnId": "State", + "label": "State" + }, + { + "columnId": "Environment", + "label": "Environment" + }, + { + "columnId": "OS", + "label": "OS" + }, + { + "columnId": "Azure Resource", + "label": "Azure Resource" + }, + { + "columnId": "Time", + "label": "Last Heartbeat" + }, + { + "columnId": "Heartbeat Trend", + "label": "Heartbeat Trend" + }, + { + "columnId": "Details", + "label": "Details" + } + ] + } + }, + "conditionalVisibility": { + "parameterName": "HasHeartbeat", + "comparison": "isNotEqualTo", + "value": "0" + }, + "showPin": true, + "name": "query - 2 - Copy", + "styleSettings": { + "progressStyle": "spinner" + } + }, + { + "type": 1, + "content": { + "json": "💡 _Click on a row to see more details about the machine._" + }, + "conditionalVisibility": { + "parameterName": "HasHeartbeat", + "comparison": "isNotEqualTo", + "value": "0" + }, + "name": "text - 7" + }, + { + "type": 1, + "content": { + "json": "
\r\n### Details about {ComputerName}" + }, + "conditionalVisibility": { + "parameterName": "ComputerName", + "comparison": "isNotEqualTo", + "value": "\"\"" + }, + "name": "text - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Heartbeat\r\n| where Computer == \"{ComputerName}\"\r\n| make-series Trend=count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {UnhealthyCriteria} by Computer", + "size": 0, + "showAnalytics": true, + "exportToExcelOptions": "visible", + "title": "Heartbeat volume trend", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "areachart", + "chartSettings": {} + }, + "conditionalVisibility": { + "parameterName": "ComputerName", + "comparison": "isNotEqualTo", + "value": "\"\"" + }, + "showPin": true, + "name": "query - 6", + "styleSettings": { + "progressStyle": "spinner" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Heartbeat\r\n| where Computer == \"{ComputerName}\"", + "size": 0, + "showAnalytics": true, + "exportToExcelOptions": "visible", + "title": "Heartbeat events", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "ComputerName", + "comparison": "isNotEqualTo", + "value": "\"\"" + }, + "name": "query - 4", + "styleSettings": { + "progressStyle": "spinner" + } + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workspace/Workbooks/Agent Health/settings.json b/Workspace/Workbooks/Agent Health/settings.json new file mode 100644 index 0000000..5216bac --- /dev/null +++ b/Workspace/Workbooks/Agent Health/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Agent Health", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.operationalinsights/workspaces", "order": 100 } + ] +} \ No newline at end of file diff --git a/Workspace/Workbooks/Workspace Usage/Workspace Usage.workbook b/Workspace/Workbooks/Workspace Usage/Workspace Usage.workbook new file mode 100644 index 0000000..55d15d8 --- /dev/null +++ b/Workspace/Workbooks/Workspace Usage/Workspace Usage.workbook @@ -0,0 +1,348 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Workspace Usage\r\nUse this report to analyze the the sizes of the different tables in your workspace. \r\n
\r\n
" + }, + "conditionalVisibility": null, + "name": "text - 0" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [ + "value::selected" + ], + "parameters": [ + { + "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": false, + "isHiddenWhenLocked": false, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000, + "createdTime": "2018-08-06T23:52:38.870Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 900000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 1800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 3600000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 14400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 43200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 86400000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 172800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 259200000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + }, + { + "durationMs": 604800000, + "createdTime": "2018-08-06T23:52:38.871Z", + "isInitialTime": false, + "grain": 1, + "useDashboardTimeRange": false + } + ], + "allowCustom": null + }, + "value": { + "durationMs": 900000 + } + } + ], + "style": "above", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "conditionalVisibility": null, + "name": "parameters - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union withsource=TableName *\r\n| summarize Entries = count(), Size = sum(_BilledSize) by TableName\r\n| order by Size desc\r\n| project ['Table Name'] = TableName, ['Table Entries'] = Entries, ['Table Size'] = Size, ['Size per Entry'] = 1.0 * Size / Entries\r\n", + "size": 0, + "exportFieldName": "Table Name", + "exportParameterName": "Table", + "exportDefaultValue": "All Tables", + "showAnalytics": true, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Table Entries", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Table Size", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Size per Entry", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "orange", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "name": "query - 2" + }, + { + "type": 1, + "content": { + "json": "💡_Click on a row in the table above to see more details_\n
\n
" + }, + "conditionalVisibility": null, + "name": "text - 3" + }, + { + "type": 1, + "content": { + "json": "### Table Entries" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "text - 4" + }, + { + "type": 1, + "content": { + "json": "### Table Size" + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "text - 5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union withsource=TableName *\r\n| where '{Table}' == 'All Tables' or TableName == '{Table}'\r\n| make-series TableSize = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n| mvexpand TableSize to typeof(real), TimeGenerated to typeof(datetime) limit 1000\r\n| project TimeGenerated, ['{Table}'] = TableSize", + "size": 0, + "exportFieldName": "Namespace", + "exportParameterName": "Namespace", + "exportDefaultValue": "All", + "showAnalytics": true, + "color": "green", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "areachart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Table Entries", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Table Size", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Table Size Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "query - 6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union withsource=TableName *\r\n| where '{Table}' == 'All Tables' or TableName == '{Table}'\r\n| make-series TableSize = sum(_BilledSize) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} \r\n| mvexpand TableSize to typeof(real), TimeGenerated to typeof(datetime) limit 1000\r\n| project TimeGenerated, ['{Table}'] = TableSize", + "size": 0, + "exportFieldName": "Namespace", + "exportParameterName": "Namespace", + "exportDefaultValue": "All", + "showAnalytics": true, + "color": "blue", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "areachart", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Table Entries", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "green", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Table Size", + "formatter": 3, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "Table Size Trend", + "formatter": 9, + "formatOptions": { + "min": 0, + "palette": "blue", + "showIcon": true + } + } + ], + "filter": true + } + }, + "conditionalVisibility": null, + "customWidth": "50", + "name": "query - 7" + } + ], + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Workspace/Workbooks/Workspace Usage/settings.json b/Workspace/Workbooks/Workspace Usage/settings.json new file mode 100644 index 0000000..75ecc6a --- /dev/null +++ b/Workspace/Workbooks/Workspace Usage/settings.json @@ -0,0 +1,8 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "name":"Workspace Usage", + "author": "Microsoft", + "galleries": [ + { "type": "workbook", "resourceType": "microsoft.operationalinsights/workspaces", "order": 200 } + ] +} \ No newline at end of file diff --git a/Workspace/Workbooks/categoryResources.json b/Workspace/Workbooks/categoryResources.json new file mode 100644 index 0000000..2fb94c5 --- /dev/null +++ b/Workspace/Workbooks/categoryResources.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/settings.json", + "en-us": {"name":"Workspace Reports", "description": "", "order": 200} +} \ No newline at end of file diff --git a/categoryResources.json b/categoryResources.json new file mode 100644 index 0000000..99db678 --- /dev/null +++ b/categoryResources.json @@ -0,0 +1,64 @@ +{ + "categories": [ + { + "key": "YourUniqueCategoryKey", + "settings": { + "en-us": { + "name": "Your category name", + "description": "Category description", + "order": 100 + } + } + }, + { + "key": "azureMonitorVirtualMachines", + "settings": { + "en-us": { + "name": "Virtual Machines", + "description": "Analyze monitoring data from your VMs", + "order": 100 + } + } + }, + { + "key": "azureMonitorVirtualMachinesPerf", + "settings": { + "en-us": { + "name": "Virtual Machines (Perf)", + "description": "Analyze monitoring data from your VMs", + "order": 105 + } + } + }, + { + "key": "azureMonitorInsights", + "settings": { + "en-us": { + "name": "Insights", + "description": "Provides insights for your Azure Resources", + "order": 2000 + } + } + }, + { + "key": "vmInsightsVirtualMachinesInsightsMetrics", + "settings": { + "en-us": { + "name": "Performance Analysis (Insights Metrics)", + "description": "Look for common issues with your VM via metrics", + "order": 205 + } + } + }, + { + "key": "vmInsightsVirtualMachinesPerf", + "settings": { + "en-us": { + "name": "Performance Analysis (Perf)", + "description": "Look for common issues with your VM via metrics", + "order": 205 + } + } + } + ] +} diff --git a/create_workbooks_dir.py b/create_workbooks_dir.py new file mode 100644 index 0000000..5de8446 --- /dev/null +++ b/create_workbooks_dir.py @@ -0,0 +1,45 @@ +# Python program to explain os.mkdir() method + +# importing os module +import os, shutil, glob + +mode = 0o666 + +#for listedItem in os.listdir('.'): +# if os.path.isdir(listedItem): +# print('working on: ', listedItem) +# wb_path = os.path.join(listedItem, "workbooks") +# if os.path.isdir(wb_path): +# print("Directory '%s' already exists" % wb_path) +# else: +# os.mkdir(wb_path, mode) +# print("Directory '%s' created" % wb_path) +# +# for filePath in glob.glob(listedItem + '\*'): +# if filePath != "workbooks" and filePath!= wb_path: +# print("moving: ", filePath, " to: ", wb_path) +# shutil. move(filePath, wb_path) + + +for listedItem in os.listdir('.'): + if os.path.isdir(listedItem): + print('working on: ', listedItem) + queriesPath = os.path.join(listedItem, "Queries") + alertsPath = os.path.join(listedItem, "Alerts") + if os.path.isdir(queriesPath): + if not os.listdir(queriesPath): + print("Directory '%s' exists and empty, writing readme file" % queriesPath) + with open(os.path.join(queriesPath, "README"), "w") as file: + file.write("Put Log Analytics queries in this folder") + else: + os.mkdir(queriesPath, mode) + print("Directory '%s' created" % queriesPath) + + if os.path.isdir(alertsPath): + if not os.listdir(alertsPath): + print("Directory '%s' exists and empty, writing readme file" % alertsPath) + with open(os.path.join(alertsPath, "README"), "w") as file: + file.write("Put alerts in this folder") + else: + os.mkdir(alertsPath, mode) + print("Directory '%s' created" % alertsPath) \ No newline at end of file