{ "__requires": [ { "type": "grafana", "id": "grafana", "name": "Grafana", "version": "7.4.3" }, { "type": "datasource", "id": "grafana-azure-monitor-datasource", "name": "Azure Monitor", "version": "0.3.0" }, { "type": "panel", "id": "graph", "name": "Graph", "version": "" }, { "type": "panel", "id": "stat", "name": "Stat", "version": "" }, { "type": "panel", "id": "table", "name": "Table", "version": "" } ], "editable": true, "gnetId": null, "graphTooltip": 0, "id": null, "iteration": 1620924220014, "links": [], "panels": [ { "collapsed": false, "datasource": "$ds", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 0 }, "id": 25, "panels": [], "title": "Overview", "type": "row" }, { "datasource": "$ds", "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "custom": {}, "mappings": [], "thresholds": { "mode": "percentage", "steps": [ { "color": "green", "value": null } ] } }, "overrides": [] }, "gridPos": { "h": 7, "w": 19, "x": 0, "y": 1 }, "id": 9, "options": { "colorMode": "value", "graphMode": "none", "justifyMode": "center", "orientation": "auto", "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "text": {}, "textMode": "auto" }, "pluginVersion": "7.4.3", "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "//change this example to create your own time series query\n //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated) //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by , bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": ["None", "Average", "Minimum", "Maximum", "Total", "Count"], "aggregation": "Average", "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000], "dimensionFilter": "*", "dimensionFilters": [], "dimensions": [ { "text": "Activity Type", "value": "ActivityType" }, { "text": "Activity Name", "value": "ActivityName" }, { "text": "Status Code", "value": "StatusCode" }, { "text": "Status Code Class", "value": "StatusCodeClass" } ], "metricDefinition": "Microsoft.KeyVault/vaults", "metricName": "Availability", "metricNamespace": "Microsoft.KeyVault/vaults", "resourceGroup": "$rg", "resourceName": "$resource", "timeGrain": "auto", "timeGrains": [ { "text": "auto", "value": "auto" }, { "text": "1 minute", "value": "PT1M" }, { "text": "5 minutes", "value": "PT5M" }, { "text": "15 minutes", "value": "PT15M" }, { "text": "30 minutes", "value": "PT30M" }, { "text": "1 hour", "value": "PT1H" }, { "text": "6 hours", "value": "PT6H" }, { "text": "12 hours", "value": "PT12H" }, { "text": "1 day", "value": "P1D" } ], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Monitor", "refId": "A", "subscription": "$sub" }, { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "//change this example to create your own time series query\n
//the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated) //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by , bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": ["None", "Average", "Minimum", "Maximum", "Total", "Count"], "aggregation": "Count", "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000], "dimensionFilter": "*", "dimensionFilters": [], "dimensions": [ { "text": "Activity Type", "value": "ActivityType" }, { "text": "Activity Name", "value": "ActivityName" }, { "text": "Status Code", "value": "StatusCode" }, { "text": "Status Code Class", "value": "StatusCodeClass" } ], "metricDefinition": "Microsoft.KeyVault/vaults", "metricName": "ServiceApiResult", "metricNamespace": "Microsoft.KeyVault/vaults", "resourceGroup": "$rg", "resourceName": "$resource", "timeGrain": "P1D", "timeGrains": [ { "text": "auto", "value": "auto" }, { "text": "1 minute", "value": "PT1M" }, { "text": "5 minutes", "value": "PT5M" }, { "text": "15 minutes", "value": "PT15M" }, { "text": "30 minutes", "value": "PT30M" }, { "text": "1 hour", "value": "PT1H" }, { "text": "6 hours", "value": "PT6H" }, { "text": "12 hours", "value": "PT12H" }, { "text": "1 day", "value": "P1D" } ], "top": "10" }, "hide": false, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Monitor", "refId": "B", "subscription": "f7152080-b4e8-47ee-9c85-7f1d0e6b72dc" }, { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "//change this example to create your own time series query\n
//the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated) //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by , bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": ["None", "Average", "Minimum", "Maximum", "Total", "Count"], "aggregation": "Average", "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000], "dimensionFilter": "*", "dimensionFilters": [], "dimensions": [ { "text": "Activity Type", "value": "ActivityType" }, { "text": "Activity Name", "value": "ActivityName" }, { "text": "Status Code", "value": "StatusCode" }, { "text": "Status Code Class", "value": "StatusCodeClass" } ], "metricDefinition": "Microsoft.KeyVault/vaults", "metricName": "ServiceApiLatency", "metricNamespace": "Microsoft.KeyVault/vaults", "resourceGroup": "$rg", "resourceName": "$resource", "timeGrain": "P1D", "timeGrains": [ { "text": "auto", "value": "auto" }, { "text": "1 minute", "value": "PT1M" }, { "text": "5 minutes", "value": "PT5M" }, { "text": "15 minutes", "value": "PT15M" }, { "text": "30 minutes", "value": "PT30M" }, { "text": "1 hour", "value": "PT1H" }, { "text": "6 hours", "value": "PT6H" }, { "text": "12 hours", "value": "PT12H" }, { "text": "1 day", "value": "P1D" } ], "top": "10" }, "hide": false, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Monitor", "refId": "C", "subscription": "f7152080-b4e8-47ee-9c85-7f1d0e6b72dc" } ], "title": "Availability, Requests and Latency", "type": "stat" }, { "aliasColors": {}, "bars": false, "dashLength": 10, "dashes": false, "datasource": "$ds", "fieldConfig": { "defaults": { "custom": {} }, "overrides": [] }, "fill": 1, "fillGradient": 0, "gridPos": { "h": 8, "w": 6, "x": 0, "y": 8 }, "hiddenSeries": false, "id": 11, "legend": { "avg": false, "current": false, "max": false, "min": false, "show": true, "total": true, "values": true }, "lines": true, "linewidth": 1, "nullPointMode": "null", "options": { "alertThreshold": true }, "percentage": false, "pluginVersion": "7.4.3", "pointradius": 2, "points": false, "renderer": "flot", "seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "//change this example to create your own time series query\n
//the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated) //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by , bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": ["None", "Average", "Minimum", "Maximum", "Total", "Count"], "aggregation": "Count", "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000], "dimensionFilter": "*", "dimensionFilters": [], "dimensions": [ { "text": "Activity Type", "value": "ActivityType" }, { "text": "Activity Name", "value": "ActivityName" } ], "metricDefinition": "Microsoft.KeyVault/vaults", "metricName": "ServiceApiHit", "metricNamespace": "Microsoft.KeyVault/vaults", "resourceGroup": "$rg", "resourceName": "$resource", "timeGrain": "auto", "timeGrains": [ { "text": "auto", "value": "auto" }, { "text": "1 minute", "value": "PT1M" }, { "text": "5 minutes", "value": "PT5M" }, { "text": "15 minutes", "value": "PT15M" }, { "text": "30 minutes", "value": "PT30M" }, { "text": "1 hour", "value": "PT1H" }, { "text": "6 hours", "value": "PT6H" }, { "text": "12 hours", "value": "PT12H" }, { "text": "1 day", "value": "P1D" } ], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Monitor", "refId": "A", "subscription": "f7152080-b4e8-47ee-9c85-7f1d0e6b72dc" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Transactions Over Time", "tooltip": { "shared": true, "sort": 0, "value_type": "individual" }, "type": "graph", "xaxis": { "buckets": null, "mode": "time", "name": null, "show": true, "values": [] }, "yaxes": [ { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true }, { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true } ], "yaxis": { "align": false, "alignLevel": null } }, { "aliasColors": {}, "bars": false, "dashLength": 10, "dashes": false, "datasource": "$ds", "fieldConfig": { "defaults": { "color": {}, "custom": {}, "thresholds": { "mode": "absolute", "steps": [] }, "unit": "ms" }, "overrides": [] }, "fill": 0, "fillGradient": 0, "gridPos": { "h": 8, "w": 6, "x": 6, "y": 8 }, "hiddenSeries": false, "id": 13, "legend": { "avg": true, "current": false, "max": false, "min": false, "show": true, "total": false, "values": true }, "lines": true, "linewidth": 1, "nullPointMode": "connected", "options": { "alertThreshold": true }, "percentage": false, "pluginVersion": "7.4.3", "pointradius": 2, "points": false, "renderer": "flot", "seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "//change this example to create your own time series query\n
//the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated) //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by , bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": ["None", "Average", "Minimum", "Maximum", "Total", "Count"], "aggregation": "Average", "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000], "dimensionFilter": "*", "dimensionFilters": [], "dimensions": [ { "text": "Activity Type", "value": "ActivityType" }, { "text": "Activity Name", "value": "ActivityName" }, { "text": "Status Code", "value": "StatusCode" }, { "text": "Status Code Class", "value": "StatusCodeClass" } ], "metricDefinition": "Microsoft.KeyVault/vaults", "metricName": "ServiceApiLatency", "metricNamespace": "Microsoft.KeyVault/vaults", "resourceGroup": "$rg", "resourceName": "$resource", "timeGrain": "auto", "timeGrains": [ { "text": "auto", "value": "auto" }, { "text": "1 minute", "value": "PT1M" }, { "text": "5 minutes", "value": "PT5M" }, { "text": "15 minutes", "value": "PT15M" }, { "text": "30 minutes", "value": "PT30M" }, { "text": "1 hour", "value": "PT1H" }, { "text": "6 hours", "value": "PT6H" }, { "text": "12 hours", "value": "PT12H" }, { "text": "1 day", "value": "P1D" } ], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Monitor", "refId": "A", "subscription": "$sub" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Overall Latency", "tooltip": { "shared": true, "sort": 0, "value_type": "individual" }, "type": "graph", "xaxis": { "buckets": null, "mode": "time", "name": null, "show": true, "values": [] }, "yaxes": [ { "format": "ms", "label": null, "logBase": 1, "max": null, "min": null, "show": true }, { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true } ], "yaxis": { "align": false, "alignLevel": null } }, { "aliasColors": {}, "bars": false, "dashLength": 10, "dashes": false, "datasource": "$ds", "fieldConfig": { "defaults": { "custom": {} }, "overrides": [] }, "fill": 1, "fillGradient": 0, "gridPos": { "h": 8, "w": 6, "x": 12, "y": 8 }, "hiddenSeries": false, "id": 15, "legend": { "avg": true, "current": false, "max": false, "min": false, "show": true, "total": false, "values": true }, "lines": true, "linewidth": 1, "nullPointMode": "null", "options": { "alertThreshold": true }, "percentage": false, "pluginVersion": "7.4.3", "pointradius": 2, "points": false, "renderer": "flot", "seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "//change this example to create your own time series query\n
//the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated) //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by , bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": ["None", "Average", "Minimum", "Maximum", "Total", "Count"], "aggregation": "Average", "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000], "dimensionFilter": "*", "dimensionFilters": [], "dimensions": [ { "text": "Activity Type", "value": "ActivityType" }, { "text": "Activity Name", "value": "ActivityName" }, { "text": "Status Code", "value": "StatusCode" }, { "text": "Status Code Class", "value": "StatusCodeClass" } ], "metricDefinition": "Microsoft.KeyVault/vaults", "metricName": "Availability", "metricNamespace": "Microsoft.KeyVault/vaults", "resourceGroup": "$rg", "resourceName": "$resource", "timeGrain": "auto", "timeGrains": [ { "text": "auto", "value": "auto" }, { "text": "1 minute", "value": "PT1M" }, { "text": "5 minutes", "value": "PT5M" }, { "text": "15 minutes", "value": "PT15M" }, { "text": "30 minutes", "value": "PT30M" }, { "text": "1 hour", "value": "PT1H" }, { "text": "6 hours", "value": "PT6H" }, { "text": "12 hours", "value": "PT12H" }, { "text": "1 day", "value": "P1D" } ], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Monitor", "refId": "A", "subscription": "$sub" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Availability", "tooltip": { "shared": true, "sort": 0, "value_type": "individual" }, "type": "graph", "xaxis": { "buckets": null, "mode": "time", "name": null, "show": true, "values": [] }, "yaxes": [ { "format": "percent", "label": null, "logBase": 1, "max": null, "min": null, "show": true }, { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true } ], "yaxis": { "align": false, "alignLevel": null } }, { "aliasColors": {}, "bars": false, "dashLength": 10, "dashes": false, "datasource": "$ds", "fieldConfig": { "defaults": { "custom": {} }, "overrides": [] }, "fill": 1, "fillGradient": 0, "gridPos": { "h": 8, "w": 6, "x": 18, "y": 8 }, "hiddenSeries": false, "id": 17, "legend": { "avg": false, "current": false, "max": false, "min": false, "show": true, "total": true, "values": true }, "lines": true, "linewidth": 1, "nullPointMode": "null", "options": { "alertThreshold": true }, "percentage": false, "pluginVersion": "7.4.3", "pointradius": 2, "points": false, "renderer": "flot", "seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "//change this example to create your own time series query\n
//the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated) //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by , bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": ["None", "Average", "Minimum", "Maximum", "Total", "Count"], "aggregation": "Count", "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000], "dimensionFilter": "*", "dimensionFilters": [], "dimensions": [ { "text": "Activity Type", "value": "ActivityType" }, { "text": "Activity Name", "value": "ActivityName" } ], "metricDefinition": "Microsoft.KeyVault/vaults", "metricName": "ServiceApiHit", "metricNamespace": "Microsoft.KeyVault/vaults", "resourceGroup": "$rg", "resourceName": "$resource", "timeGrain": "auto", "timeGrains": [ { "text": "auto", "value": "auto" }, { "text": "1 minute", "value": "PT1M" }, { "text": "5 minutes", "value": "PT5M" }, { "text": "15 minutes", "value": "PT15M" }, { "text": "30 minutes", "value": "PT30M" }, { "text": "1 hour", "value": "PT1H" }, { "text": "6 hours", "value": "PT6H" }, { "text": "12 hours", "value": "PT12H" }, { "text": "1 day", "value": "P1D" } ], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Monitor", "refId": "A", "subscription": "$sub" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Request Types over Time", "tooltip": { "shared": true, "sort": 0, "value_type": "individual" }, "type": "graph", "xaxis": { "buckets": null, "mode": "time", "name": null, "show": true, "values": [] }, "yaxes": [ { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true }, { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true } ], "yaxis": { "align": false, "alignLevel": null } }, { "collapsed": false, "datasource": "$ds", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 16 }, "id": 23, "panels": [], "title": "Failures", "type": "row" }, { "aliasColors": {}, "bars": false, "dashLength": 10, "dashes": false, "datasource": "$ds", "fieldConfig": { "defaults": { "custom": {} }, "overrides": [] }, "fill": 1, "fillGradient": 0, "gridPos": { "h": 8, "w": 6, "x": 0, "y": 17 }, "hiddenSeries": false, "id": 2, "legend": { "avg": false, "current": false, "max": false, "min": false, "show": true, "total": true, "values": true }, "lines": true, "linewidth": 1, "nullPointMode": "null", "options": { "alertThreshold": true }, "percentage": false, "pluginVersion": "7.4.3", "pointradius": 2, "points": false, "renderer": "flot", "seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "//change this example to create your own time series query\n
//the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated) //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by , bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": ["None", "Average", "Minimum", "Maximum", "Total", "Count"], "aggregation": "Count", "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000], "dimensionFilter": "*", "dimensionFilters": [ { "dimension": "StatusCodeClass", "filter": "2xx", "operator": "eq" } ], "dimensions": [ { "text": "Activity Type", "value": "ActivityType" }, { "text": "Activity Name", "value": "ActivityName" }, { "text": "Status Code", "value": "StatusCode" }, { "text": "Status Code Class", "value": "StatusCodeClass" } ], "metricDefinition": "Microsoft.KeyVault/vaults", "metricName": "ServiceApiResult", "metricNamespace": "Microsoft.KeyVault/vaults", "resourceGroup": "$rg", "resourceName": "$resource", "timeGrain": "auto", "timeGrains": [ { "text": "auto", "value": "auto" }, { "text": "1 minute", "value": "PT1M" }, { "text": "5 minutes", "value": "PT5M" }, { "text": "15 minutes", "value": "PT15M" }, { "text": "30 minutes", "value": "PT30M" }, { "text": "1 hour", "value": "PT1H" }, { "text": "6 hours", "value": "PT6H" }, { "text": "12 hours", "value": "PT12H" }, { "text": "1 day", "value": "P1D" } ], "top": "" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Monitor", "refId": "A", "subscription": "$sub" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Successes (2xx)", "tooltip": { "shared": true, "sort": 0, "value_type": "individual" }, "type": "graph", "xaxis": { "buckets": null, "mode": "time", "name": null, "show": true, "values": [] }, "yaxes": [ { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true }, { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true } ], "yaxis": { "align": false, "alignLevel": null } }, { "aliasColors": {}, "bars": false, "dashLength": 10, "dashes": false, "datasource": "$ds", "fieldConfig": { "defaults": { "custom": {} }, "overrides": [] }, "fill": 1, "fillGradient": 0, "gridPos": { "h": 8, "w": 6, "x": 6, "y": 17 }, "hiddenSeries": false, "id": 7, "legend": { "avg": false, "current": false, "max": false, "min": false, "show": true, "total": true, "values": true }, "lines": true, "linewidth": 1, "nullPointMode": "null", "options": { "alertThreshold": true }, "percentage": false, "pluginVersion": "7.4.3", "pointradius": 2, "points": false, "renderer": "flot", "seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "//change this example to create your own time series query\n
//the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated) //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by , bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": ["None", "Average", "Minimum", "Maximum", "Total", "Count"], "aggregation": "Count", "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000], "dimensionFilter": "*", "dimensionFilters": [ { "dimension": "StatusCodeClass", "filter": "4xx", "operator": "eq" } ], "dimensions": [ { "text": "Activity Type", "value": "ActivityType" }, { "text": "Activity Name", "value": "ActivityName" }, { "text": "Status Code", "value": "StatusCode" }, { "text": "Status Code Class", "value": "StatusCodeClass" } ], "metricDefinition": "Microsoft.KeyVault/vaults", "metricName": "ServiceApiResult", "metricNamespace": "Microsoft.KeyVault/vaults", "resourceGroup": "$rg", "resourceName": "$resource", "timeGrain": "auto", "timeGrains": [ { "text": "auto", "value": "auto" }, { "text": "1 minute", "value": "PT1M" }, { "text": "5 minutes", "value": "PT5M" }, { "text": "15 minutes", "value": "PT15M" }, { "text": "30 minutes", "value": "PT30M" }, { "text": "1 hour", "value": "PT1H" }, { "text": "6 hours", "value": "PT6H" }, { "text": "12 hours", "value": "PT12H" }, { "text": "1 day", "value": "P1D" } ], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Monitor", "refId": "A", "subscription": "$sub" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Failures (4xx)", "tooltip": { "shared": true, "sort": 0, "value_type": "individual" }, "type": "graph", "xaxis": { "buckets": null, "mode": "time", "name": null, "show": true, "values": [] }, "yaxes": [ { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true }, { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true } ], "yaxis": { "align": false, "alignLevel": null } }, { "aliasColors": {}, "bars": false, "dashLength": 10, "dashes": false, "datasource": "$ds", "fieldConfig": { "defaults": { "custom": {} }, "overrides": [] }, "fill": 1, "fillGradient": 0, "gridPos": { "h": 8, "w": 6, "x": 12, "y": 17 }, "hiddenSeries": false, "id": 6, "legend": { "avg": true, "current": false, "max": false, "min": false, "show": true, "total": false, "values": true }, "lines": true, "linewidth": 1, "nullPointMode": "null", "options": { "alertThreshold": true }, "percentage": false, "pluginVersion": "7.4.3", "pointradius": 2, "points": false, "renderer": "flot", "seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "//change this example to create your own time series query\n
//the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated) //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by , bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": ["None", "Average", "Minimum", "Maximum", "Total", "Count"], "aggregation": "Count", "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000], "dimensionFilter": "*", "dimensionFilters": [ { "dimension": "StatusCode", "filter": "429", "operator": "eq" } ], "dimensions": [ { "text": "Activity Type", "value": "ActivityType" }, { "text": "Activity Name", "value": "ActivityName" }, { "text": "Status Code", "value": "StatusCode" }, { "text": "Status Code Class", "value": "StatusCodeClass" } ], "metricDefinition": "Microsoft.KeyVault/vaults", "metricName": "ServiceApiResult", "metricNamespace": "Microsoft.KeyVault/vaults", "resourceGroup": "$rg", "resourceName": "$resource", "timeGrain": "auto", "timeGrains": [ { "text": "auto", "value": "auto" }, { "text": "1 minute", "value": "PT1M" }, { "text": "5 minutes", "value": "PT5M" }, { "text": "15 minutes", "value": "PT15M" }, { "text": "30 minutes", "value": "PT30M" }, { "text": "1 hour", "value": "PT1H" }, { "text": "6 hours", "value": "PT6H" }, { "text": "12 hours", "value": "PT12H" }, { "text": "1 day", "value": "P1D" } ], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Monitor", "refId": "A", "subscription": "$sub" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Throttling (429)", "tooltip": { "shared": true, "sort": 0, "value_type": "individual" }, "type": "graph", "xaxis": { "buckets": null, "mode": "time", "name": null, "show": true, "values": [] }, "yaxes": [ { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true }, { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true } ], "yaxis": { "align": false, "alignLevel": null } }, { "aliasColors": {}, "bars": false, "dashLength": 10, "dashes": false, "datasource": "$ds", "fieldConfig": { "defaults": { "custom": {} }, "overrides": [] }, "fill": 1, "fillGradient": 0, "gridPos": { "h": 8, "w": 6, "x": 18, "y": 17 }, "hiddenSeries": false, "id": 4, "legend": { "avg": false, "current": false, "max": false, "min": false, "show": true, "total": true, "values": true }, "lines": true, "linewidth": 1, "nullPointMode": "null", "options": { "alertThreshold": true }, "percentage": false, "pluginVersion": "7.4.3", "pointradius": 2, "points": false, "renderer": "flot", "seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "//change this example to create your own time series query\n
//the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated) //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by , bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": ["None", "Average", "Minimum", "Maximum", "Total", "Count"], "aggregation": "Count", "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000], "dimensionFilter": "*", "dimensionFilters": [ { "dimension": "StatusCode", "filter": "401", "operator": "eq" } ], "dimensions": [ { "text": "Activity Type", "value": "ActivityType" }, { "text": "Activity Name", "value": "ActivityName" }, { "text": "Status Code", "value": "StatusCode" }, { "text": "Status Code Class", "value": "StatusCodeClass" } ], "metricDefinition": "Microsoft.KeyVault/vaults", "metricName": "ServiceApiResult", "metricNamespace": "Microsoft.KeyVault/vaults", "resourceGroup": "$rg", "resourceName": "$resource", "timeGrain": "auto", "timeGrains": [ { "text": "auto", "value": "auto" }, { "text": "1 minute", "value": "PT1M" }, { "text": "5 minutes", "value": "PT5M" }, { "text": "15 minutes", "value": "PT15M" }, { "text": "30 minutes", "value": "PT30M" }, { "text": "1 hour", "value": "PT1H" }, { "text": "6 hours", "value": "PT6H" }, { "text": "12 hours", "value": "PT12H" }, { "text": "1 day", "value": "P1D" } ], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Monitor", "refId": "A", "subscription": "$sub" }, { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "//change this example to create your own time series query\n
//the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated) //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by , bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": ["None", "Average", "Minimum", "Maximum", "Total", "Count"], "aggregation": "Count", "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000], "dimensionFilter": "*", "dimensionFilters": [ { "dimension": "StatusCode", "filter": "403", "operator": "eq" } ], "dimensions": [ { "text": "Activity Type", "value": "ActivityType" }, { "text": "Activity Name", "value": "ActivityName" }, { "text": "Status Code", "value": "StatusCode" }, { "text": "Status Code Class", "value": "StatusCodeClass" } ], "metricDefinition": "Microsoft.KeyVault/vaults", "metricName": "ServiceApiResult", "metricNamespace": "Microsoft.KeyVault/vaults", "resourceGroup": "$rg", "resourceName": "$resource", "timeGrain": "auto", "timeGrains": [ { "text": "auto", "value": "auto" }, { "text": "1 minute", "value": "PT1M" }, { "text": "5 minutes", "value": "PT5M" }, { "text": "15 minutes", "value": "PT15M" }, { "text": "30 minutes", "value": "PT30M" }, { "text": "1 hour", "value": "PT1H" }, { "text": "6 hours", "value": "PT6H" }, { "text": "12 hours", "value": "PT12H" }, { "text": "1 day", "value": "P1D" } ], "top": "10" }, "hide": false, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Monitor", "refId": "B", "subscription": "$sub" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Authentication Errors (401 & 403)", "tooltip": { "shared": true, "sort": 0, "value_type": "individual" }, "type": "graph", "xaxis": { "buckets": null, "mode": "time", "name": null, "show": true, "values": [] }, "yaxes": [ { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true }, { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true } ], "yaxis": { "align": false, "alignLevel": null } }, { "collapsed": false, "datasource": "$ds", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 25 }, "id": 21, "panels": [], "title": "Operations", "type": "row" }, { "datasource": "$ds", "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "custom": {}, "mappings": [], "thresholds": { "mode": "absolute", "steps": [] } }, "overrides": [] }, "gridPos": { "h": 5, "w": 3, "x": 0, "y": 26 }, "id": 19, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "text": {}, "textMode": "auto" }, "pluginVersion": "7.4.3", "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "let rawData = AzureDiagnostics \r\n // Ignore Authentication operations with a 401. This is normal when using Key Vault SDK, first an unauthenticated request is done then the response is used for authentication.\r\n | where Category == \"AuditEvent\" and not (OperationName == \"Authentication\" and httpStatusCode_d == 401)\r\n | where OperationName in ('SecretGet', 'VaultGet') or '*' in ('SecretGet', 'VaultGet')\r\n // Create ResultStatus with all the 'success' results bucked as 'Success'\r\n // Certain operations like StorageAccountAutoSyncKey have no ResultSignature, for now set to 'Success' as well\r\n | extend ResultStatus = case (ResultSignature == \"\", \"Success\",\r\n ResultSignature == \"OK\", \"Success\",\r\n ResultSignature == \"Accepted\", \"Success\",\r\n ResultSignature); \r\nrawData \r\n| make-series Trend = count() default = 0 on TimeGenerated from ago(1d) to now() step 30m by ResultStatus\r\n| join kind = inner (rawData\n | where $__timeFilter(TimeGenerated)\r\n | summarize Count = count() by ResultStatus\r\n )\r\n on ResultStatus\n \r\n\r\n| project ResultStatus, Count, Trend\r\n| order by Count desc;\r", "resultFormat": "table", "workspace": "$ws" }, "azureMonitor": { "aggOptions": [], "dimensionFilter": "*", "dimensionFilters": [], "metricDefinition": "select", "metricName": "select", "metricNamespace": "select", "resourceGroup": "select", "resourceName": "select", "timeGrain": "auto", "timeGrains": [], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Log Analytics", "refId": "A", "subscription": "$sub" } ], "timeFrom": null, "timeShift": null, "title": "Success Operations", "type": "stat" }, { "aliasColors": {}, "bars": false, "dashLength": 10, "dashes": false, "datasource": "$ds", "fieldConfig": { "defaults": { "color": {}, "custom": {}, "thresholds": { "mode": "absolute", "steps": [] }, "unit": "short" }, "overrides": [] }, "fill": 1, "fillGradient": 0, "gridPos": { "h": 5, "w": 7, "x": 3, "y": 26 }, "hiddenSeries": false, "id": 35, "legend": { "avg": false, "current": false, "max": false, "min": false, "show": true, "total": false, "values": false }, "lines": false, "linewidth": 1, "nullPointMode": "null", "options": { "alertThreshold": true }, "percentage": false, "pluginVersion": "7.4.3", "pointradius": 2, "points": true, "renderer": "flot", "seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "let rawData = AzureDiagnostics \r\n // Ignore Authentication operations with a 401. This is normal when using Key Vault SDK, first an unauthenticated request is done then the response is used for authentication.\r\n | where Category == \"AuditEvent\" and not (OperationName == \"Authentication\" and httpStatusCode_d == 401)\r\n | where OperationName in ('SecretGet', 'VaultGet') or '*' in ('SecretGet', 'VaultGet')\r\n // Create ResultStatus with all the 'success' results bucked as 'Success'\r\n // Certain operations like StorageAccountAutoSyncKey have no ResultSignature, for now set to 'Success' as well\r\n | extend ResultStatus = case (ResultSignature == \"\", \"Success\",\r\n ResultSignature == \"OK\", \"Success\",\r\n ResultSignature == \"Accepted\", \"Success\",\r\n ResultSignature); \r\nrawData\n| where $__timeFilter(TimeGenerated)\n| extend resultCount = iif(ResultStatus == \"Success\", 1, 0)\n| summarize count(resultCount) by bin(TimeGenerated, 30m)\n| sort by TimeGenerated;\n\r\r\n\r", "resultFormat": "table", "workspace": "$ws" }, "azureMonitor": { "aggOptions": [], "dimensionFilter": "*", "dimensionFilters": [], "metricDefinition": "select", "metricName": "select", "metricNamespace": "select", "resourceGroup": "select", "resourceName": "select", "timeGrain": "auto", "timeGrains": [], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Log Analytics", "refId": "A", "subscription": "$sub" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Success Operations Counts", "tooltip": { "shared": true, "sort": 0, "value_type": "individual" }, "type": "graph", "xaxis": { "buckets": null, "mode": "time", "name": null, "show": true, "values": [] }, "yaxes": [ { "format": "short", "label": null, "logBase": 1, "max": null, "min": "0", "show": true }, { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true } ], "yaxis": { "align": false, "alignLevel": null } }, { "datasource": "$ds", "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "custom": {}, "mappings": [], "thresholds": { "mode": "absolute", "steps": [] } }, "overrides": [] }, "gridPos": { "h": 5, "w": 3, "x": 10, "y": 26 }, "id": 26, "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "center", "orientation": "auto", "reduceOptions": { "calcs": ["changeCount"], "fields": "", "values": true }, "text": {}, "textMode": "value" }, "pluginVersion": "7.4.3", "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "let rawData = AzureDiagnostics \r\n // Ignore Authentication operations with a 401. This is normal when using Key Vault SDK, first an unauthenticated request is done then the response is used for authentication.\r\n | where Category == \"AuditEvent\" and not (OperationName == \"Authentication\" and httpStatusCode_d == 401)\r\n | where OperationName in ('SecretGet', 'VaultGet') or '*' in ('SecretGet', 'VaultGet')\r; \r\nrawData \r\n| make-series Trend = count() default = 0 on TimeGenerated from ago(1d) to now() step 30m by ResultSignature \n| join kind = inner (rawData\n | where $__timeFilter(TimeGenerated)\r\n | summarize Count = count() by ResultSignature \n )\r\n on ResultSignature \n\r\n\r\n| project ResultSignature , Count, Trend\r\n| order by Count desc;", "resultFormat": "table", "workspace": "$ws" }, "azureMonitor": { "aggOptions": [], "dimensionFilter": "*", "dimensionFilters": [], "metricDefinition": "select", "metricName": "select", "metricNamespace": "select", "resourceGroup": "select", "resourceName": "select", "timeGrain": "auto", "timeGrains": [], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Log Analytics", "refId": "A", "subscription": "$sub" } ], "timeFrom": null, "timeShift": null, "title": "All Operations", "type": "stat" }, { "aliasColors": {}, "bars": false, "dashLength": 10, "dashes": false, "datasource": "$ds", "fieldConfig": { "defaults": { "color": {}, "custom": {}, "thresholds": { "mode": "absolute", "steps": [] }, "unit": "short" }, "overrides": [] }, "fill": 1, "fillGradient": 0, "gridPos": { "h": 5, "w": 7, "x": 13, "y": 26 }, "hiddenSeries": false, "id": 36, "legend": { "avg": false, "current": false, "max": false, "min": false, "show": true, "total": false, "values": false }, "lines": false, "linewidth": 1, "nullPointMode": "null", "options": { "alertThreshold": true }, "percentage": false, "pluginVersion": "7.4.3", "pointradius": 2, "points": true, "renderer": "flot", "seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "let rawData = AzureDiagnostics \r\n // Ignore Authentication operations with a 401. This is normal when using Key Vault SDK, first an unauthenticated request is done then the response is used for authentication.\r\n | where Category == \"AuditEvent\" and not (OperationName == \"Authentication\" and httpStatusCode_d == 401)\r\n | where OperationName in ('SecretGet', 'VaultGet') or '*' in ('SecretGet', 'VaultGet')\r; \r\nrawData\n| where $__timeFilter(TimeGenerated)\n| summarize count(ResultSignature ) by bin(TimeGenerated, 30m)\n| sort by TimeGenerated;\n\r\r\n\r", "resultFormat": "table", "workspace": "$ws" }, "azureMonitor": { "aggOptions": [], "dimensionFilter": "*", "dimensionFilters": [], "metricDefinition": "select", "metricName": "select", "metricNamespace": "select", "resourceGroup": "select", "resourceName": "select", "timeGrain": "auto", "timeGrains": [], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Log Analytics", "refId": "A", "subscription": "$sub" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "All Operations Counts", "tooltip": { "shared": true, "sort": 0, "value_type": "individual" }, "type": "graph", "xaxis": { "buckets": null, "mode": "time", "name": null, "show": true, "values": [] }, "yaxes": [ { "format": "short", "label": null, "logBase": 1, "max": null, "min": "0", "show": true }, { "format": "short", "label": null, "logBase": 1, "max": null, "min": null, "show": true } ], "yaxis": { "align": false, "alignLevel": null } }, { "datasource": "$ds", "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "custom": { "align": null, "filterable": false }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null }, { "color": "red", "value": 80 } ] } }, "overrides": [] }, "gridPos": { "h": 4, "w": 24, "x": 0, "y": 31 }, "id": 28, "options": { "showHeader": true }, "pluginVersion": "7.4.3", "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "let data = AzureDiagnostics \r\n | where TimeGenerated > ago(1d)\r\n // Ignore Authentication operations with a 401. This is normal when using Key Vault SDK, first an unauthenticated request is done then the response is used for authentication.\r\n | where Category == \"AuditEvent\" and not (OperationName == \"Authentication\" and httpStatusCode_d == 401)\r\n | where OperationName in ('SecretGet', 'VaultGet') or '*' in ('SecretGet', 'VaultGet')\r\n // Create ResultStatus with all the 'success' results bucked as 'Success'\r\n // Certain operations like StorageAccountAutoSyncKey have no ResultSignature, for now set to 'Success' as well\r\n | extend ResultStatus = case (ResultSignature == \"\", \"Success\",\r\n ResultSignature == \"OK\", \"Success\",\r\n ResultSignature == \"Accepted\", \"Success\",\r\n ResultSignature)\r\n | where ResultStatus == 'All' or 'All' == 'All';\r\ndata\r\n// Data aggregated to the OperationName\r\n| summarize OperationCount = count(), SuccessCount = countif(ResultStatus == \"Success\"), FailureCount = countif(ResultStatus != \"Success\"), PDurationMs = percentile(DurationMs, 99) by Resource, OperationName\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from ago(1d) to now() step 30m by OperationName\r\n | project-away TimeGenerated)\r\n on OperationName\r\n| order by OperationCount desc\r\n| project Name = strcat('⚡ ', OperationName), Id = strcat(Resource, '/', OperationName), ['Operation count'] = OperationCount, ['Operation count trend'] = Trend, ['Success count'] = SuccessCount, ['Failure count'] = FailureCount, ['p99 Duration'] = PDurationMs", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": [], "dimensionFilter": "*", "dimensionFilters": [], "metricDefinition": "select", "metricName": "select", "metricNamespace": "select", "resourceGroup": "select", "resourceName": "select", "timeGrain": "auto", "timeGrains": [], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Log Analytics", "refId": "A", "subscription": "$sub" } ], "title": "Operations by Name", "type": "table" }, { "datasource": "$ds", "fieldConfig": { "defaults": { "color": { "mode": "thresholds" }, "custom": { "align": null, "filterable": false }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null }, { "color": "red", "value": 80 } ] } }, "overrides": [ { "matcher": { "id": "byName", "options": "Duration" }, "properties": [ { "id": "custom.width", "value": 86 } ] }, { "matcher": { "id": "byName", "options": "Result" }, "properties": [ { "id": "custom.width", "value": 94 } ] }, { "matcher": { "id": "byName", "options": "Operation" }, "properties": [ { "id": "custom.width", "value": 136 } ] }, { "matcher": { "id": "byName", "options": "Time" }, "properties": [ { "id": "custom.width", "value": 219 } ] } ] }, "gridPos": { "h": 8, "w": 24, "x": 0, "y": 35 }, "id": 30, "options": { "showHeader": true, "sortBy": [] }, "pluginVersion": "7.4.3", "targets": [ { "appInsights": { "dimension": [], "metricName": "select", "timeGrain": "auto" }, "azureLogAnalytics": { "query": "let gridRowSelected = dynamic({\"Id\": \"*\"});\r\nlet resourceName = split(gridRowSelected.Id, \"/\")[0];\r\nlet operationName = split(gridRowSelected.Id, \"/\")[1];\r\nAzureDiagnostics \r\n| where TimeGenerated > ago(1d)\r\n// Ignore Authentication operations with a 401. This is normal when using Key Vault SDK, first an unauthenticated request is done then the response is used for authentication.\r\n| where Category == \"AuditEvent\" and not (OperationName == \"Authentication\" and httpStatusCode_d == 401)\r\n| where OperationName in ('SecretGet', 'VaultGet') or '*' in ('SecretGet', 'VaultGet')\r\n| where resourceName == \"*\" or Resource == resourceName\r\n| where operationName == \"\" or OperationName == operationName\r\n// Create ResultStatus with all the 'success' results bucked as 'Success'\r\n// Certain operations like StorageAccountAutoSyncKey have no ResultSignature, for now set to 'Success' as well\r\n| extend ResultStatus = case (ResultSignature == \"\", \"Success\",\r\n ResultSignature == \"OK\", \"Success\",\r\n ResultSignature == \"Accepted\", \"Success\",\r\n ResultSignature)\r\n| where ResultStatus == 'All' or 'All' == 'All'\r\n| extend p = pack_all()\r\n| mv-apply p on \r\n ( \r\n extend key = tostring(bag_keys(p)[0])\r\n | where isnotempty(p[key]) and isnotnull(p[key])\r\n | where key !in (\"SourceSystem\", \"Type\")\r\n | summarize make_bag(p)\r\n )\r\n| project Time=TimeGenerated, Operation=OperationName, Result=ResultSignature, Duration = DurationMs, [\"Details\"]=bag_p\r\n| sort by Time desc", "resultFormat": "time_series", "workspace": "$ws" }, "azureMonitor": { "aggOptions": [], "dimensionFilter": "*", "dimensionFilters": [], "metricDefinition": "select", "metricName": "select", "metricNamespace": "select", "resourceGroup": "select", "resourceName": "select", "timeGrain": "auto", "timeGrains": [], "top": "10" }, "insightsAnalytics": { "query": "", "resultFormat": "time_series" }, "queryType": "Azure Log Analytics", "refId": "A", "subscription": "$sub" } ], "title": "Operations by Time", "type": "table" } ], "refresh": false, "schemaVersion": 27, "style": "dark", "tags": [], "templating": { "list": [ { "current": {}, "description": null, "error": null, "hide": 0, "includeAll": false, "label": "Data Source", "multi": false, "name": "ds", "options": [], "query": "grafana-azure-monitor-datasource", "queryValue": "", "refresh": 1, "regex": "", "skipUrlSync": false, "type": "datasource" }, { "allValue": null, "current": {}, "datasource": "$ds", "definition": "subscriptions()", "description": null, "error": null, "hide": 0, "includeAll": false, "label": "subscription", "multi": false, "name": "sub", "options": [], "query": "subscriptions()", "refresh": 1, "regex": "", "skipUrlSync": false, "sort": 0, "tagValuesQuery": "", "tags": [], "tagsQuery": "", "type": "query", "useTags": false }, { "allValue": null, "current": {}, "datasource": "$ds", "definition": "ResourceGroups($sub)", "description": null, "error": null, "hide": 0, "includeAll": false, "label": "Resource Group", "multi": false, "name": "rg", "options": [], "query": "ResourceGroups($sub)", "refresh": 1, "regex": "", "skipUrlSync": false, "sort": 0, "tagValuesQuery": "", "tags": [], "tagsQuery": "", "type": "query", "useTags": false }, { "description": null, "error": null, "hide": 2, "label": "Namespace", "name": "ns", "query": "Microsoft.KeyVault/vaults", "skipUrlSync": false, "type": "constant" }, { "allValue": null, "current": {}, "datasource": "$ds", "definition": "ResourceNames($sub, $rg, $ns)", "description": null, "error": null, "hide": 0, "includeAll": false, "label": null, "multi": false, "name": "resource", "options": [], "query": "ResourceNames($sub, $rg, $ns)", "refresh": 1, "regex": "", "skipUrlSync": false, "sort": 0, "tagValuesQuery": "", "tags": [], "tagsQuery": "", "type": "query", "useTags": false }, { "allValue": null, "current": {}, "datasource": "$ds", "definition": "Workspaces($sub)", "description": null, "error": null, "hide": 0, "includeAll": false, "label": "Workspace", "multi": false, "name": "ws", "options": [], "query": "Workspaces($sub)", "refresh": 1, "regex": "", "skipUrlSync": false, "sort": 0, "tagValuesQuery": "", "tags": [], "tagsQuery": "", "type": "query", "useTags": false } ] }, "time": { "from": "now-24h", "to": "now" }, "timepicker": {}, "timezone": "", "title": "Azure / Insights / Key vaults", "uid": "tQZAMYrMk", "version": 42 }