Forum Discussion

Kalaimani

Brass Contributor

Jul 09, 2020

Solved

Azure Backup Report

Hi Team, Can anyone help me to generate the report using Log Analytics workspace in azure backup

Jul 10, 2020

I think you need to add the filter later:

let Events = AzureDiagnostics | where Category == "AzureBackupReport"; 
Events
| where OperationName == "Job"
| where TimeGenerated > ago(30d)
| project BackupItemUniqueId_s , JobStatus_s , JobStartDateTime_s
| join kind=inner 
(
    Events
    | where OperationName == "BackupItem"
    | distinct BackupItemUniqueId_s, BackupItemFriendlyName_s
    | project BackupItemUniqueId_s, BackupItemFriendlyName_s 
) on BackupItemUniqueId_s
| where BackupItemFriendlyName_s in ("CH-DCVM10","FAKEVM0001","FAKE1111")
| summarize count() by  BackupItemFriendlyName_s, JobStatus_s, JobStartDateTime_s

Go to Log Analytics and run query

CliveWatson

Former Employee

Jul 13, 2020

Kalaimani - adding my reply back to the thread (from a private) so its useful to others. This change displays a column "NewDateTime" which is in the UTC format

let Events = AzureDiagnostics 
| where Category == "AzureBackupReport"; Events 
| extend JobOperationSubType_s = columnifexists("JobOperationSubType_s", "") 
| where OperationName == "Job" and JobOperation_s == "Backup" and JobOperationSubType_s != "Log" and JobOperationSubType_s != "Recovery point_Log"
| distinct JobUniqueId_g, BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s
| project BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s
| join kind=leftouter ( Events 
| where OperationName == "BackupItem"
| distinct BackupItemUniqueId_s, BackupItemFriendlyName_s 
| project BackupItemUniqueId_s , BackupItemFriendlyName_s ) on BackupItemUniqueId_s 
| project BackupItemFriendlyName_s, BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s
| extend Vault= Resource 
| extend dt = todatetime(JobStartDateTime_s)
| summarize count() by BackupItemFriendlyName_s, JobStatus_s, Vault, BackupItemUniqueId_s, JobFailureCode_s, NewDateTime=dt, JobStartDateTime_s

Kalaimani

Brass Contributor

Jul 15, 2020

CliveWatson thank you So much Sir, you certainly deserve a Great Thanks for your excellent support.

I have 4 Log Analytics Servers, is there any option can get the report in a single shot (like one scrip adding all 4 servers )

Kalaimani
Brass Contributor
Jul 20, 2020
CliveWatson thank you Sir, but really I'm not sure how to do that
CliveWatson
Former Employee
Jul 15, 2020
Kalaimani

The "run query and visualise results" control in the Logic App (playbook) has the workspace as an entry, so you can run 4 parallel jobs to get the data from each workspace?