Giter Club home page Giter Club logo

Comments (6)

gardnerjr avatar gardnerjr commented on May 10, 2024

If you need computer and workspace, you can export those as specific parameters with those names, and the values will each be an array of multiple values of just computer and just workspace, which you could use like

let computers = dynamic([{Computers}]);
let workspaces = dynamic([{Workspaces}]);
// then in your query
something something | where Computer in (computers);

otherwise, in your query, you'd do something like

let values = dynamic([{SelectedRow}]);

and now values would be an array of objects, and you'd use standard kql array, json, dynamic functions on the values array to get what you need?

from application-insights-workbooks.

mclgoerg avatar mclgoerg commented on May 10, 2024

Hi, thanks for your quick reply.

Sadly I can't use your first suggestion. A computer is only unique inside one workspace - I need the combination of computer and workspaces to get unique results.

If I just display normal values in my grid view.
Computer/Workspace/Average/P90th
than I can do the following:

print d = dynamic([{SelectedRow}])
| mv-expand d
| evaluate bag_unpack(d)
| project Computer, Workspace

and it does work.

But I build my query to also show me the applications (make_set) which are running on those computers.
I did this by doing the following:

let metric = dynamic({"counter":"% Committed Bytes In Use","object":"Memory"}) //dynamic({Counter});

let VMProcessWS = union withsource=WorkSpace VMProcess,
workspace("az1-dedicated-large-log").VMProcess,
workspace("az2-dedicated-large-log").VMProcess;

let PerfWS = union withsource=WorkSpace Perf,
workspace("az1-dedicated-large-log").Perf,
workspace("az2-dedicated-large-log").Perf;

let summaryPerComputer = totable(PerfWS      // hier die workspaces mergen
| where WorkSpace != "Perf"
| where TimeGenerated > ago (1d)  //{TimeRange}  
| where Computer contains ''  //{ComputerFilter}
| where ObjectName == metric.object and CounterName == metric.counter
| extend WS = substring(WorkSpace, indexof(WorkSpace, "az"), indexof(WorkSpace, "')")-indexof(WorkSpace, "az"))   
| where WS has_any(...) // {WorkSpaceFilter}
| summarize hint.shufflekey = Computer Average = avg(CounterValue), Max = max(CounterValue), Min = min(CounterValue), percentiles(CounterValue, 5, 10, 50, 80, 90, 95) by Computer, WS
| project Computer, WS, Average, Max, Min, P5th = percentile_CounterValue_5, P10th = percentile_CounterValue_10, P50th = percentile_CounterValue_50, P80th = percentile_CounterValue_80, P90th = percentile_CounterValue_90, P95th = percentile_CounterValue_95
| order by {TableTrend:label} {tableTrendOrder}, Computer);  

let AppsForeachWorker = VMProcessWS
| where TimeGenerated {TimeRange}
| where WorkSpace != "VMProcess"
| where UserName contains "..."
| extend WS = substring(WorkSpace, indexof(WorkSpace, "az"), indexof(WorkSpace, "')")-indexof(WorkSpace, "az"))
| summarize Apps=make_set(UserName) by TimeGenerated, Computer, WS
| summarize ["Last Data"]=arg_max(TimeGenerated, *) by Computer, WS;


summaryPerComputer 
| join kind=leftouter (AppsProWorker) on $left.Computer == $right.Computer and $left.WS == $right.WS
| project Computer, Workspace=WS, Average, P90th, Apps

If I just display Computer, Workspace, Average and P90th it does work.
If I also add Apps to my output it doesnt work. Apps itself is a dictionary inside the JSON.
Do you know how it should be parsed so I can use it?

from application-insights-workbooks.

mclgoerg avatar mclgoerg commented on May 10, 2024

I don't know what I changed but somehow it works!

from application-insights-workbooks.

mclgoerg avatar mclgoerg commented on May 10, 2024

If I have the selected Computer and Workspace in a grid.
e.g.

Computer Workspace  
Comp1 az1-dedicated-large-log
Comp2 az1-dedicated-large-log
Comp2 az2-dedicated-large-log

How can I access this data inside my query to check if my huge dataset contains those selected computer/workspaces?


Last question:
Is it possible to do this easier?
Instead of:

let VMProcessWS = union withsource=WorkSpace VMProcess,
workspace("az1-dedicated-large-log").VMProcess,
workspace("az2-dedicated-large-log").VMProcess;

Build it inside JSON or something else with the data which is selected?

from application-insights-workbooks.

gardnerjr avatar gardnerjr commented on May 10, 2024

if you have selected workspaces in the grid, and those workspace entries are full workspace azure resource ids, you can export that workspace column as a parameter, and explicitly set it to be type "resource picker". then downstream in the workbook, you can target a query at that resource parameter, and it would query both workspaces. If they aren't full resource ids, i'm not sure there's any easy way to do this. I don't know if logs has any workspace operator that lets you pass many values to it?

from application-insights-workbooks.

gardnerjr avatar gardnerjr commented on May 10, 2024

Closing from no activity

from application-insights-workbooks.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.