Update Basic-Archive-Logs-Tool.json
Updating terminology and adding caution notes.
This commit is contained in:
Matt Lowe
GitHub
Родитель
e519d727bf
Коммит
93ef0692fa
|
|
@ -1,502 +1,503 @@
|
|||
{
|
||||
"version": "Notebook/1.0",
|
||||
"items": [
|
||||
{
|
||||
"type": 9,
|
||||
"content": {
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"parameters": [
|
||||
{
|
||||
"id": "ccd5adcd-8d59-4cfe-99ec-98075de2e253",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "DefaultSubscription_Internal",
|
||||
"type": 1,
|
||||
"isRequired": true,
|
||||
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId",
|
||||
"crossComponentResources": [
|
||||
"value::selected"
|
||||
],
|
||||
"isHiddenWhenLocked": true,
|
||||
"queryType": 1,
|
||||
"resourceType": "microsoft.resourcegraph/resources"
|
||||
"version": "Notebook/1.0",
|
||||
"items": [
|
||||
{
|
||||
"type": 9,
|
||||
"content": {
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"parameters": [
|
||||
{
|
||||
"id": "ccd5adcd-8d59-4cfe-99ec-98075de2e253",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "DefaultSubscription_Internal",
|
||||
"type": 1,
|
||||
"isRequired": true,
|
||||
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId",
|
||||
"crossComponentResources": [
|
||||
"value::selected"
|
||||
],
|
||||
"isHiddenWhenLocked": true,
|
||||
"queryType": 1,
|
||||
"resourceType": "microsoft.resourcegraph/resources"
|
||||
},
|
||||
{
|
||||
"id": "1ca69445-60fc-4806-b43d-ac7e6aad630a",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "Subscription",
|
||||
"type": 6,
|
||||
"query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n",
|
||||
"crossComponentResources": [
|
||||
"value::selected"
|
||||
],
|
||||
"typeSettings": {
|
||||
"additionalResourceOptions": [],
|
||||
"showDefault": false
|
||||
},
|
||||
{
|
||||
"id": "1ca69445-60fc-4806-b43d-ac7e6aad630a",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "Subscription",
|
||||
"type": 6,
|
||||
"query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n",
|
||||
"crossComponentResources": [
|
||||
"value::selected"
|
||||
],
|
||||
"typeSettings": {
|
||||
"additionalResourceOptions": [],
|
||||
"showDefault": false
|
||||
"queryType": 1,
|
||||
"resourceType": "microsoft.resourcegraph/resources"
|
||||
},
|
||||
{
|
||||
"id": "e94aafa3-c5d9-4523-89f0-4e87aa754511",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "Workspace",
|
||||
"type": 5,
|
||||
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\n| project id",
|
||||
"crossComponentResources": [
|
||||
"{Subscription}"
|
||||
],
|
||||
"value": "",
|
||||
"typeSettings": {
|
||||
"resourceTypeFilter": {
|
||||
"microsoft.operationalinsights/workspaces": true
|
||||
},
|
||||
"queryType": 1,
|
||||
"resourceType": "microsoft.resourcegraph/resources"
|
||||
"additionalResourceOptions": []
|
||||
},
|
||||
{
|
||||
"id": "e94aafa3-c5d9-4523-89f0-4e87aa754511",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "Workspace",
|
||||
"type": 5,
|
||||
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\n| project id",
|
||||
"crossComponentResources": [
|
||||
"{Subscription}"
|
||||
],
|
||||
"value": "",
|
||||
"typeSettings": {
|
||||
"resourceTypeFilter": {
|
||||
"microsoft.operationalinsights/workspaces": true
|
||||
},
|
||||
"additionalResourceOptions": []
|
||||
},
|
||||
"queryType": 1,
|
||||
"resourceType": "microsoft.resourcegraph/resources"
|
||||
"queryType": 1,
|
||||
"resourceType": "microsoft.resourcegraph/resources"
|
||||
},
|
||||
{
|
||||
"id": "eafaa0ec-7c3a-4ee5-babe-9850080c909d",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "resourceGroup",
|
||||
"type": 1,
|
||||
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| where id == \"{Workspace}\"\r\n| project resourceGroup",
|
||||
"crossComponentResources": [
|
||||
"value::selected"
|
||||
],
|
||||
"isHiddenWhenLocked": true,
|
||||
"queryType": 1,
|
||||
"resourceType": "microsoft.resourcegraph/resources"
|
||||
},
|
||||
{
|
||||
"id": "ba423df4-f83c-495f-8d57-b3b828f8f11c",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "WorkspaceName",
|
||||
"type": 1,
|
||||
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| where id == \"{Workspace}\"\r\n| project name",
|
||||
"isHiddenWhenLocked": true,
|
||||
"queryType": 1,
|
||||
"resourceType": "microsoft.resourcegraph/resources"
|
||||
},
|
||||
{
|
||||
"id": "13a91d3f-a588-4db8-88ab-4395610784b0",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "EnableSteps",
|
||||
"label": "Enable Steps",
|
||||
"type": 10,
|
||||
"typeSettings": {
|
||||
"additionalResourceOptions": []
|
||||
},
|
||||
{
|
||||
"id": "eafaa0ec-7c3a-4ee5-babe-9850080c909d",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "resourceGroup",
|
||||
"type": 1,
|
||||
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| where id == \"{Workspace}\"\r\n| project resourceGroup",
|
||||
"crossComponentResources": [
|
||||
"value::selected"
|
||||
],
|
||||
"isHiddenWhenLocked": true,
|
||||
"queryType": 1,
|
||||
"resourceType": "microsoft.resourcegraph/resources"
|
||||
},
|
||||
{
|
||||
"id": "ba423df4-f83c-495f-8d57-b3b828f8f11c",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "WorkspaceName",
|
||||
"type": 1,
|
||||
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| where id == \"{Workspace}\"\r\n| project name",
|
||||
"isHiddenWhenLocked": true,
|
||||
"queryType": 1,
|
||||
"resourceType": "microsoft.resourcegraph/resources"
|
||||
},
|
||||
{
|
||||
"id": "13a91d3f-a588-4db8-88ab-4395610784b0",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "EnableSteps",
|
||||
"label": "Enable Steps",
|
||||
"type": 10,
|
||||
"typeSettings": {
|
||||
"additionalResourceOptions": []
|
||||
},
|
||||
"jsonData": "[\r\n {\"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\"}\r\n]"
|
||||
}
|
||||
],
|
||||
"style": "above",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.resourcegraph/resources"
|
||||
},
|
||||
"name": "parameters - 1"
|
||||
"jsonData": "[\r\n {\"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\"}\r\n]"
|
||||
}
|
||||
],
|
||||
"style": "above",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.resourcegraph/resources"
|
||||
},
|
||||
{
|
||||
"type": 11,
|
||||
"content": {
|
||||
"version": "LinkItem/1.0",
|
||||
"style": "tabs",
|
||||
"links": [
|
||||
{
|
||||
"id": "dff67182-9d46-405c-bfbd-f4e92a8cabc8",
|
||||
"cellValue": "Tab",
|
||||
"linkTarget": "parameter",
|
||||
"linkLabel": "Archive",
|
||||
"subTarget": "Archive",
|
||||
"preText": "Archive",
|
||||
"style": "link"
|
||||
},
|
||||
{
|
||||
"id": "027c315f-cf87-4cc8-b12f-01048df837db",
|
||||
"cellValue": "Tab",
|
||||
"linkTarget": "parameter",
|
||||
"linkLabel": "Basic",
|
||||
"subTarget": "Basic",
|
||||
"style": "link"
|
||||
}
|
||||
]
|
||||
},
|
||||
"name": "links - 13"
|
||||
"name": "parameters - 1"
|
||||
},
|
||||
{
|
||||
"type": 11,
|
||||
"content": {
|
||||
"version": "LinkItem/1.0",
|
||||
"style": "tabs",
|
||||
"links": [
|
||||
{
|
||||
"id": "dff67182-9d46-405c-bfbd-f4e92a8cabc8",
|
||||
"cellValue": "Tab",
|
||||
"linkTarget": "parameter",
|
||||
"linkLabel": "Archive",
|
||||
"subTarget": "Archive",
|
||||
"preText": "Archive",
|
||||
"style": "link"
|
||||
},
|
||||
{
|
||||
"id": "027c315f-cf87-4cc8-b12f-01048df837db",
|
||||
"cellValue": "Tab",
|
||||
"linkTarget": "parameter",
|
||||
"linkLabel": "Basic",
|
||||
"subTarget": "Basic",
|
||||
"style": "link"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": 12,
|
||||
"content": {
|
||||
"version": "NotebookGroup/1.0",
|
||||
"groupType": "editable",
|
||||
"items": [
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "Select a subscription and workspace above.\r\nClick on one of the rows below to view the retention of the table and also modify it if needed.",
|
||||
"style": "info"
|
||||
},
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "EnableSteps",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Yes"
|
||||
},
|
||||
"name": "text - 6"
|
||||
"name": "links - 13"
|
||||
},
|
||||
{
|
||||
"type": 12,
|
||||
"content": {
|
||||
"version": "NotebookGroup/1.0",
|
||||
"groupType": "editable",
|
||||
"items": [
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "Select a subscription and workspace above.\r\nClick on one of the rows below to view the retention of the table and also modify it if needed.",
|
||||
"style": "info"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "Usage\r\n| summarize arg_max(TimeGenerated, *) by DataType\r\n| project DataType, Quantity, QuantityUnit, TimeGenerated, ResourceUri\r\n| order by DataType asc",
|
||||
"size": 0,
|
||||
"title": "Tables Found in Workspace",
|
||||
"timeContext": {
|
||||
"durationMs": 604800000
|
||||
},
|
||||
"exportFieldName": "DataType",
|
||||
"exportParameterName": "DataType",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"crossComponentResources": [
|
||||
"{Workspace}"
|
||||
]
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "query - 1"
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "EnableSteps",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Yes"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "Usage\r\n| extend DataType2 = DataType \r\n| where DataType2 has 'srch'\r\n| project TimeGenerated, DataType2, ResourceUri",
|
||||
"size": 0,
|
||||
"title": "Generated Search Tables",
|
||||
"timeContext": {
|
||||
"durationMs": 2592000000
|
||||
},
|
||||
"exportFieldName": "DataType2",
|
||||
"exportParameterName": "DataType2",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"crossComponentResources": [
|
||||
"{Workspace}"
|
||||
]
|
||||
"name": "text - 6"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "Usage\r\n| summarize arg_max(TimeGenerated, *) by DataType\r\n| project DataType, Quantity, QuantityUnit, TimeGenerated, ResourceUri\r\n| order by DataType asc",
|
||||
"size": 0,
|
||||
"title": "Tables Found in Workspace",
|
||||
"timeContext": {
|
||||
"durationMs": 604800000
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "query - 9"
|
||||
"exportFieldName": "DataType",
|
||||
"exportParameterName": "DataType",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"crossComponentResources": [
|
||||
"{Workspace}"
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":\"{\\r\\n\\t\\\"properties\\\":{\\r\\n\\t\\t\\\"retentionInDays\\\": 180,\\r\\n\\t\\t\\\"totalRetentionInDays\\\": 200 \\r\\n\\t}\\r\\n}\",\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{DataType}\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-12-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties\",\"columns\":[{\"path\":\"$.retentionInDays\",\"columnid\":\"RetentionInWorkspace\"},{\"path\":\"$.archiveRetentionInDays\",\"columnid\":\"RetentionInArchive\"},{\"path\":\"$.totalRetentionInDays\",\"columnid\":\"TotalLogRetention\"},{\"path\":\"$.plan\",\"columnid\":\"IngestionPlan\"}]}}]}",
|
||||
"size": 1,
|
||||
"title": "Retention for {DataType}",
|
||||
"queryType": 12,
|
||||
"sortBy": []
|
||||
"customWidth": "50",
|
||||
"name": "query - 1"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "Usage\r\n| extend DataType2 = DataType \r\n| where DataType2 has 'srch'\r\n| project TimeGenerated, DataType2, ResourceUri",
|
||||
"size": 0,
|
||||
"title": "Generated Search Tables",
|
||||
"timeContext": {
|
||||
"durationMs": 2592000000
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "query - 1"
|
||||
"exportFieldName": "DataType2",
|
||||
"exportParameterName": "DataType2",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"crossComponentResources": [
|
||||
"{Workspace}"
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":\"{\\r\\n\\t\\\"properties\\\":{\\r\\n\\t\\t\\\"retentionInDays\\\": 180,\\r\\n\\t\\t\\\"totalRetentionInDays\\\": 200 \\r\\n\\t}\\r\\n}\",\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{DataType2}\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-12-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties\",\"columns\":[{\"path\":\"$.retentionInDays\",\"columnid\":\"RetentionInWorkspace\"},{\"path\":\"$.archiveRetentionInDays\",\"columnid\":\"RetentionInArchive\"},{\"path\":\"$.totalRetentionInDays\",\"columnid\":\"TotalLogRetention\"},{\"path\":\"$.plan\",\"columnid\":\"IngestionPlan\"}]}}]}",
|
||||
"size": 1,
|
||||
"title": "Retention for {DataType2}",
|
||||
"queryType": 12,
|
||||
"sortBy": []
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "query - 1"
|
||||
"customWidth": "50",
|
||||
"name": "query - 9"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":\"{\\r\\n\\t\\\"properties\\\":{\\r\\n\\t\\t\\\"retentionInDays\\\": 180,\\r\\n\\t\\t\\\"totalRetentionInDays\\\": 200 \\r\\n\\t}\\r\\n}\",\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{DataType}\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-12-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties\",\"columns\":[{\"path\":\"$.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.plan\",\"columnid\":\"TablePlan\"}]}}]}",
|
||||
"size": 1,
|
||||
"title": "Retention for {DataType}",
|
||||
"queryType": 12,
|
||||
"sortBy": []
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "The body below will be how the retention settings are changed when calling the API.\r\nretentionInDays is the total amount of days that the data in the workspace is in 'hot' tier.\r\ntotalRetentionInDays is the total amount of days that the data will be kept in the workspace.\r\n\r\nTo calculate the number of days that the data will be in archive, take the totalRetentionInDays and subtract retentionInDays from it. The remainder is the number of days in archive.\r\n\r\nNote: setting the retentionInDays to 'null' will set or keep the retention of the workspace as the retention value that is already set.\r\n\r\n",
|
||||
"style": "info"
|
||||
},
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "EnableSteps",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Yes"
|
||||
},
|
||||
"name": "text - 7"
|
||||
"customWidth": "50",
|
||||
"name": "query - 1"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":\"{\\r\\n\\t\\\"properties\\\":{\\r\\n\\t\\t\\\"retentionInDays\\\": 180,\\r\\n\\t\\t\\\"totalRetentionInDays\\\": 200 \\r\\n\\t}\\r\\n}\",\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{DataType2}\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-12-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties\",\"columns\":[{\"path\":\"$.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.plan\",\"columnid\":\"TablePlan\"}]}}]}",
|
||||
"size": 1,
|
||||
"title": "Retention for {DataType2}",
|
||||
"queryType": 12,
|
||||
"sortBy": []
|
||||
},
|
||||
{
|
||||
"type": 9,
|
||||
"content": {
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"parameters": [
|
||||
{
|
||||
"id": "9fc95cb8-a3e5-4ee5-bafc-270fbe86d712",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "APIBody",
|
||||
"type": 1,
|
||||
"value": "{\r\n\t\"properties\":{\r\n\t\t\"retentionInDays\": null,\r\n\t\t\"totalRetentionInDays\": 200\r\n\t}\r\n}",
|
||||
"typeSettings": {
|
||||
"multiLineText": true,
|
||||
"editorLanguage": "json",
|
||||
"multiLineHeight": 8
|
||||
},
|
||||
"timeContext": {
|
||||
"durationMs": 86400000
|
||||
}
|
||||
"customWidth": "50",
|
||||
"name": "query - 1"
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "The body below will be how the retention settings are changed when calling the API.\r\nretentionInDays is the total amount of days that the data in the workspace is in 'hot' tier.\r\ntotalRetentionInDays is the total amount of days that the data will be kept in the workspace.\r\n\r\nTo calculate the number of days that the data will be in archive, take the totalRetentionInDays and subtract retentionInDays from it. The remainder is the number of days in archive.\r\n\r\nNote: setting the retentionInDays to 'null' will set or keep the retention of the workspace as the retention value that is already set.\r\n\r\n",
|
||||
"style": "info"
|
||||
},
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "EnableSteps",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Yes"
|
||||
},
|
||||
"name": "text - 7"
|
||||
},
|
||||
{
|
||||
"type": 9,
|
||||
"content": {
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"parameters": [
|
||||
{
|
||||
"id": "9fc95cb8-a3e5-4ee5-bafc-270fbe86d712",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "APIBody",
|
||||
"type": 1,
|
||||
"value": "{\r\n\t\"properties\":{\r\n\t\t\"retentionInDays\": null,\r\n\t\t\"totalRetentionInDays\": 200\r\n\t}\r\n}",
|
||||
"typeSettings": {
|
||||
"multiLineText": true,
|
||||
"editorLanguage": "json",
|
||||
"multiLineHeight": 8
|
||||
},
|
||||
"timeContext": {
|
||||
"durationMs": 86400000
|
||||
}
|
||||
],
|
||||
"style": "pills",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces"
|
||||
},
|
||||
"name": "parameters - 4"
|
||||
}
|
||||
],
|
||||
"style": "pills",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces"
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "## You are about to modify the retention of the {DataType} table.\r\n\r\n## Changes to be made:\r\n{APIBody}",
|
||||
"style": "warning"
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "text - 5"
|
||||
"name": "parameters - 4"
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "## You are about to modify the retention of the {DataType} table. </br>\r\n\r\n### Note: Tables will inherit the retention of the workspace unless changed. It is possible to change the retention of the table to differ from the workspace retention. If a retention is set on a table and the workspace retention is changed, the table retention will not be affected. To reset the table retention to the workspace retention, set the retentionInDays to -1.\r\n\r\n## Changes to be made:\r\n{APIBody}",
|
||||
"style": "warning"
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "## You are about to modify the retention of the {DataType2} table.\r\n\r\n## Changes to be made:\r\n{APIBody}",
|
||||
"style": "warning"
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "text - 5"
|
||||
"customWidth": "50",
|
||||
"name": "text - 5"
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "## You are about to modify the retention of the {DataType2} table.\r\n\r\n### Note: Tables will inherit the retention of the workspace unless changed. It is possible to change the retention of the table to differ from the workspace retention. If a retention is set on a table and the workspace retention is changed, the table retention will not be affected. To reset the table retention to the workspace retention, set the retentionInDays to -1.\r\n\r\n## Changes to be made:\r\n{APIBody}",
|
||||
"style": "warning"
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "Clicking the Update Retenion button will run the API that will update the retention of the table, based on what has been set in the body. Please confirm which table you are about to modify above.",
|
||||
"style": "info"
|
||||
},
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "EnableSteps",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Yes"
|
||||
},
|
||||
"name": "text - 8"
|
||||
"customWidth": "50",
|
||||
"name": "text - 5"
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "Clicking the Update Retenion button will run the API that will update the retention of the table, based on what has been set in the body. Please confirm which table you are about to modify above.",
|
||||
"style": "info"
|
||||
},
|
||||
{
|
||||
"type": 11,
|
||||
"content": {
|
||||
"version": "LinkItem/1.0",
|
||||
"style": "list",
|
||||
"links": [
|
||||
{
|
||||
"id": "d0307859-0760-4b9a-972f-297a5be4efda",
|
||||
"linkTarget": "ArmAction",
|
||||
"linkLabel": "Update Retention",
|
||||
"style": "primary",
|
||||
"linkIsContextBlade": true,
|
||||
"armActionContext": {
|
||||
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{DataType}?api-version=2021-12-01-preview",
|
||||
"headers": [],
|
||||
"params": [],
|
||||
"body": "{APIBody}",
|
||||
"httpMethod": "PUT",
|
||||
"description": "# ARM actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command."
|
||||
}
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "EnableSteps",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Yes"
|
||||
},
|
||||
"name": "text - 8"
|
||||
},
|
||||
{
|
||||
"type": 11,
|
||||
"content": {
|
||||
"version": "LinkItem/1.0",
|
||||
"style": "list",
|
||||
"links": [
|
||||
{
|
||||
"id": "d0307859-0760-4b9a-972f-297a5be4efda",
|
||||
"linkTarget": "ArmAction",
|
||||
"linkLabel": "Update Retention",
|
||||
"style": "primary",
|
||||
"linkIsContextBlade": true,
|
||||
"armActionContext": {
|
||||
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{DataType}?api-version=2021-12-01-preview",
|
||||
"headers": [],
|
||||
"params": [],
|
||||
"body": "{APIBody}",
|
||||
"httpMethod": "PUT",
|
||||
"description": "# ARM actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command."
|
||||
}
|
||||
]
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "links - 4"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": 11,
|
||||
"content": {
|
||||
"version": "LinkItem/1.0",
|
||||
"style": "list",
|
||||
"links": [
|
||||
{
|
||||
"id": "634769e9-a4ab-41eb-a314-1ca30eecf454",
|
||||
"linkTarget": "ArmAction",
|
||||
"linkLabel": "Update Search Table Retention",
|
||||
"style": "primary",
|
||||
"linkIsContextBlade": true,
|
||||
"armActionContext": {
|
||||
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{DataType2}?api-version=2021-12-01-preview",
|
||||
"headers": [],
|
||||
"params": [],
|
||||
"body": "{APIBody}",
|
||||
"httpMethod": "PUT",
|
||||
"description": "# ARM actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command."
|
||||
}
|
||||
"customWidth": "50",
|
||||
"name": "links - 4"
|
||||
},
|
||||
{
|
||||
"type": 11,
|
||||
"content": {
|
||||
"version": "LinkItem/1.0",
|
||||
"style": "list",
|
||||
"links": [
|
||||
{
|
||||
"id": "634769e9-a4ab-41eb-a314-1ca30eecf454",
|
||||
"linkTarget": "ArmAction",
|
||||
"linkLabel": "Update Search Table Retention",
|
||||
"style": "primary",
|
||||
"linkIsContextBlade": true,
|
||||
"armActionContext": {
|
||||
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{DataType2}?api-version=2021-12-01-preview",
|
||||
"headers": [],
|
||||
"params": [],
|
||||
"body": "{APIBody}",
|
||||
"httpMethod": "PUT",
|
||||
"description": "# ARM actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command."
|
||||
}
|
||||
]
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "links - 11"
|
||||
}
|
||||
]
|
||||
},
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "Tab",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Archive"
|
||||
},
|
||||
"name": "Archive"
|
||||
}
|
||||
]
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "links - 11"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": 12,
|
||||
"content": {
|
||||
"version": "NotebookGroup/1.0",
|
||||
"groupType": "editable",
|
||||
"items": [
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "Select a subscription and workspace above.\r\nClick on one of the rows below to view the retention of the table and also modify it if needed.",
|
||||
"style": "info"
|
||||
},
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "EnableSteps",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Yes"
|
||||
},
|
||||
"name": "text - 6"
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "Tab",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Archive"
|
||||
},
|
||||
"name": "Archive"
|
||||
},
|
||||
{
|
||||
"type": 12,
|
||||
"content": {
|
||||
"version": "NotebookGroup/1.0",
|
||||
"groupType": "editable",
|
||||
"items": [
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "Select a subscription and workspace above.\r\nClick on one of the rows below to view the retention of the table and also modify it if needed.",
|
||||
"style": "info"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "Usage\r\n| summarize arg_max(TimeGenerated, *) by DataType\r\n| project DataType, Quantity, QuantityUnit, TimeGenerated, ResourceUri\r\n| order by DataType asc",
|
||||
"size": 0,
|
||||
"title": "Tables Found in Workspace",
|
||||
"timeContext": {
|
||||
"durationMs": 604800000
|
||||
},
|
||||
"exportFieldName": "DataType",
|
||||
"exportParameterName": "DataType",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"crossComponentResources": [
|
||||
"{Workspace}"
|
||||
]
|
||||
},
|
||||
"name": "query - 1"
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "EnableSteps",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Yes"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":\"{\\r\\n\\t\\\"properties\\\":{\\r\\n\\t\\t\\\"retentionInDays\\\": 180,\\r\\n\\t\\t\\\"totalRetentionInDays\\\": 200 \\r\\n\\t}\\r\\n}\",\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{DataType}?api-version=2021-12-01-preview\",\"urlParams\":[{\"key\":\"\",\"value\":\"\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties\",\"columns\":[{\"path\":\"$.retentionInDays\",\"columnid\":\"RetentionInWorkspace\"},{\"path\":\"$.archiveRetentionInDays\",\"columnid\":\"RetentionInArchive\"},{\"path\":\"$.totalRetentionInDays\",\"columnid\":\"TotalLogRetention\"},{\"path\":\"$.plan\",\"columnid\":\"IngestionPlan\"}]}}]}",
|
||||
"size": 1,
|
||||
"title": "Retention for {DataType}",
|
||||
"queryType": 12,
|
||||
"sortBy": []
|
||||
"name": "text - 6"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "Usage\r\n| summarize arg_max(TimeGenerated, *) by DataType\r\n| project DataType, Quantity, QuantityUnit, TimeGenerated, ResourceUri\r\n| order by DataType asc",
|
||||
"size": 0,
|
||||
"title": "Tables Found in Workspace",
|
||||
"timeContext": {
|
||||
"durationMs": 604800000
|
||||
},
|
||||
"name": "query - 1"
|
||||
"exportFieldName": "DataType",
|
||||
"exportParameterName": "DataType",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces",
|
||||
"crossComponentResources": [
|
||||
"{Workspace}"
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "The body below will be how the retention settings are changed when calling the API.\r\nretentionInDays is the total amount of days that the data in the workspace is in 'hot' tier.\r\ntotalRetentionInDays is the total amount of days that the data will be kept in the workspace.\r\n\r\nTo calculate the number of days that the data will be in archive, take the totalRetentionInDays and subtract retentionInDays from it. The remainder is the number of days in archive.\r\n\r\nNote: setting the retentionInDays to 'null' will set or keep the retention of the workspace as the retention value that is already set.\r\n\r\n",
|
||||
"style": "info"
|
||||
},
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "EnableSteps",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Yes"
|
||||
},
|
||||
"name": "text - 7"
|
||||
"name": "query - 1"
|
||||
},
|
||||
{
|
||||
"type": 3,
|
||||
"content": {
|
||||
"version": "KqlItem/1.0",
|
||||
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":\"{\\r\\n\\t\\\"properties\\\":{\\r\\n\\t\\t\\\"retentionInDays\\\": 180,\\r\\n\\t\\t\\\"totalRetentionInDays\\\": 200 \\r\\n\\t}\\r\\n}\",\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{DataType}?api-version=2021-12-01-preview\",\"urlParams\":[{\"key\":\"\",\"value\":\"\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties\",\"columns\":[{\"path\":\"$.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.plan\",\"columnid\":\"TablePlan\"}]}}]}",
|
||||
"size": 1,
|
||||
"title": "Retention for {DataType}",
|
||||
"queryType": 12,
|
||||
"sortBy": []
|
||||
},
|
||||
{
|
||||
"type": 9,
|
||||
"content": {
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"parameters": [
|
||||
{
|
||||
"id": "9fc95cb8-a3e5-4ee5-bafc-270fbe86d712",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "APIBody",
|
||||
"type": 1,
|
||||
"value": "{\r\n \"properties\": {\r\n \"plan\": \"Basic\"\r\n }\r\n}",
|
||||
"typeSettings": {
|
||||
"multiLineText": true,
|
||||
"editorLanguage": "json",
|
||||
"multiLineHeight": 8
|
||||
},
|
||||
"timeContext": {
|
||||
"durationMs": 86400000
|
||||
}
|
||||
"name": "query - 1"
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "The body below will be how the retention settings are changed when calling the API.\r\nretentionInDays is the total amount of days that the data in the workspace is in 'hot' tier.\r\ntotalRetentionInDays is the total amount of days that the data will be kept in the workspace.\r\n\r\nTo calculate the number of days that the data will be in archive, take the totalRetentionInDays and subtract retentionInDays from it. The remainder is the number of days in archive.\r\n\r\nNote: setting the retentionInDays to 'null' will set or keep the retention of the workspace as the retention value that is already set.\r\n\r\n",
|
||||
"style": "info"
|
||||
},
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "EnableSteps",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Yes"
|
||||
},
|
||||
"name": "text - 7"
|
||||
},
|
||||
{
|
||||
"type": 9,
|
||||
"content": {
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"parameters": [
|
||||
{
|
||||
"id": "9fc95cb8-a3e5-4ee5-bafc-270fbe86d712",
|
||||
"version": "KqlParameterItem/1.0",
|
||||
"name": "APIBody",
|
||||
"type": 1,
|
||||
"value": "{\r\n \"properties\": {\r\n \"plan\": \"Basic\"\r\n }\r\n}",
|
||||
"typeSettings": {
|
||||
"multiLineText": true,
|
||||
"editorLanguage": "json",
|
||||
"multiLineHeight": 8
|
||||
},
|
||||
"timeContext": {
|
||||
"durationMs": 86400000
|
||||
}
|
||||
],
|
||||
"style": "pills",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces"
|
||||
},
|
||||
"name": "parameters - 4"
|
||||
}
|
||||
],
|
||||
"style": "pills",
|
||||
"queryType": 0,
|
||||
"resourceType": "microsoft.operationalinsights/workspaces"
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "## You are about to modify the retention of the {DataType} table.\r\n\r\n## Changes to be made:\r\n{APIBody}",
|
||||
"style": "warning"
|
||||
},
|
||||
"name": "text - 5"
|
||||
"name": "parameters - 4"
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "## You are about to modify the retention of the {DataType} table.\r\n\r\n### Note: The Table Plan can only be changed once per week.\r\n\r\n## Changes to be made:\r\n{APIBody}",
|
||||
"style": "warning"
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "Clicking the Update Retenion button will run the API that will update the retention of the table, based on what has been set in the body. Please confirm which table you are about to modify above.",
|
||||
"style": "info"
|
||||
},
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "EnableSteps",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Yes"
|
||||
},
|
||||
"name": "text - 8"
|
||||
"name": "text - 5"
|
||||
},
|
||||
{
|
||||
"type": 1,
|
||||
"content": {
|
||||
"json": "Clicking the Update Retenion button will run the API that will update the retention of the table, based on what has been set in the body. Please confirm which table you are about to modify above.",
|
||||
"style": "info"
|
||||
},
|
||||
{
|
||||
"type": 11,
|
||||
"content": {
|
||||
"version": "LinkItem/1.0",
|
||||
"style": "list",
|
||||
"links": [
|
||||
{
|
||||
"id": "d0307859-0760-4b9a-972f-297a5be4efda",
|
||||
"linkTarget": "ArmAction",
|
||||
"linkLabel": "Update Plan",
|
||||
"style": "primary",
|
||||
"linkIsContextBlade": true,
|
||||
"armActionContext": {
|
||||
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{WorkspaceName}/tables/{DataType}",
|
||||
"headers": [],
|
||||
"params": [
|
||||
{
|
||||
"key": "api-version",
|
||||
"value": "2021-12-01-preview"
|
||||
}
|
||||
],
|
||||
"body": "{APIBody}",
|
||||
"httpMethod": "PATCH",
|
||||
"description": "# ARM actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command."
|
||||
}
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "EnableSteps",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Yes"
|
||||
},
|
||||
"name": "text - 8"
|
||||
},
|
||||
{
|
||||
"type": 11,
|
||||
"content": {
|
||||
"version": "LinkItem/1.0",
|
||||
"style": "list",
|
||||
"links": [
|
||||
{
|
||||
"id": "d0307859-0760-4b9a-972f-297a5be4efda",
|
||||
"linkTarget": "ArmAction",
|
||||
"linkLabel": "Update Plan",
|
||||
"style": "primary",
|
||||
"linkIsContextBlade": true,
|
||||
"armActionContext": {
|
||||
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{WorkspaceName}/tables/{DataType}",
|
||||
"headers": [],
|
||||
"params": [
|
||||
{
|
||||
"key": "api-version",
|
||||
"value": "2021-12-01-preview"
|
||||
}
|
||||
],
|
||||
"body": "{APIBody}",
|
||||
"httpMethod": "PATCH",
|
||||
"description": "# ARM actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command."
|
||||
}
|
||||
]
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "links - 4"
|
||||
}
|
||||
]
|
||||
},
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "Tab",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Basic"
|
||||
},
|
||||
"name": "Basic"
|
||||
}
|
||||
],
|
||||
"fallbackResourceIds": [
|
||||
],
|
||||
"fromTemplateId": "sentinel-UserWorkbook",
|
||||
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"customWidth": "50",
|
||||
"name": "links - 4"
|
||||
}
|
||||
]
|
||||
},
|
||||
"conditionalVisibility": {
|
||||
"parameterName": "Tab",
|
||||
"comparison": "isEqualTo",
|
||||
"value": "Basic"
|
||||
},
|
||||
"name": "Basic"
|
||||
}
|
||||
],
|
||||
"fallbackResourceIds": [
|
||||
""
|
||||
],
|
||||
"fromTemplateId": "sentinel-UserWorkbook",
|
||||
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
|
||||
}
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче