Forum Discussion
Adding a column in a Log Analytic Workspace dashboard for writing notes
- Got it (I hope 😉 ).
The challenge is that Azure Dashboards / Workbooks are read only (they read the Log Analytics data). So whilst you could type in a number for example to a field, it isn't written back to Log Analytics (so you lose it when you refresh).
So for Option 2, what you can do is run a process, like a Logic App (there maybe other options, but I don't know Jira/confluence well enough). This would read the Jira record when one is created manually or automatically, or on a update action and create in a custom Log Analytics table the updated row, (with new Incident Number etc...). So when Jira is updated the dashboard would see the change from the custom table + plus any other Log Analytics table you wish to correlate with.
Data written to Log Analytics (1.) --> Monitor Alert fires (2.) --> data sent to Jira api where a ticket number is applied (3.)
Logic App triggers (4.)when a new Jira record (or update is made) --> data written to a custom Table in Log Analytics
Step 2/3 can be manual for now
LuukBartels Here are two ways to add new columns.
Usage
| limit 5
| project DataType, newColumn = 'my notes'
| extend newNewColumn = 'More notes'
You can also test your issue (use iif or case() ) example using iif(), case maybe more helpful if you have many types of issue case() - Azure Data Explorer | Microsoft Docs
Usage
| where DataType in ('Perf','Heartbeat')
| extend newColumnName = iif(DataType == 'Heartbeat','Yes its Heartbeat','No its not')
| summarize by DataType, newColumnName
Thank you for your reply Clive_Watson!
Do you also know how I can change the text for each specific row in the dashboard?
I want to add notes for each individual issue.
If its 10's of 'issues' then Case statement may work, a bit like this example or a datatable might be an idea
Usage | where DataType in ('Perf','Heartbeat', 'AzureActivity') | extend newColumnName = case( DataType == 'Heartbeat','Yes its Heartbeat', DataType == 'Perf' ,'Its the message for Perf', // else, default to strcat('unknown: ', DataType) ) | summarize by DataType, newColumnName- Clive_Watson
I actually want to add a unique ticketnummer for each issue so I cannot use a Case statement.
Do you have an idea on how to add unique text each for each issue?
Can I maybe make another custom (so not via Log Analytics) table in which I can add a text column?I'd probably look to hold a file in Azure Blob storage with the data in it that has the unique text. This can be updated independently of the KQL/dashboard/workbook. If you were using Microsoft Sentinel I'd recommend a WatchList, but if this is Azure Monitor only, then the file & externaldata is a good approach. There are examples in this link:
externaldata operator - Azure Data Explorer | Microsoft Docs
Usage | summarize by DataType | order by DataType | extend IncidentNum = row_number() | project-reorder IncidentNum
Row_number() would add a unique number to each row of data, you would then make a call to externaldata to get the text you need, in the extra column