SLA Query

It's not clear what specific SLA you're referring to, but here's an example:

If logs contain Heartbeat data (like in Azure Monitor for VMs):

Heartbeat
| where TimeGenerated between (startofday(ago(30d)) .. now()) 
| summarize Total_Heartbeats = count() 
| extend Expected_Heartbeats = 30 * 24 * 60  
| extend SLA_Percentage = Total_Heartbeats  / Expected_Heartbeats *100

Where Total_Heartbeats represents the total number of heartbeat entries received in Log Analytics (if the VM is down or unreachable, no heartbeat entries will be logged).

Expected_Heartbeat is the expected number of heartbeats over the last 30 days, assuming logs are generated every minute.

Total_Heartbeats = 43,000 (actual received heartbeats)
Expected_Heartbeat = 43,200 (30 days × 24 hours × 60 minutes)
SLA = (Total_Heartbeats / Expected_Heartbeat) × 100
Uptime SLA = 99.54%