Forum Discussion
Resource Groups in Workbook
Often in the default Workbooks (is this your own or a Azure Sentinel templated one, if so which one?) provide Resource Group info from a Azure Resource Group (ARG) query
resources
| where type =~ 'microsoft.operationalinsights/workspaces'
| project resourceGroupIf you are using KQL you may have some in lower or upper case combinations or maybe a renamed RG?
As per the screenshot, I think this should be custom workbook.
Your query is really helpful but don't you think it's more feasible to select the RG from the drop down which is automatically populated instead of providing RG info in each and every pod of the workbook?
I may have got your point incorrectly, if so, please correct me.
- I'd always select a ResourceGroup from a global parameter, at the top of a Workbook, using ARG. I suspect the query used is something like this KQL (you didn't provide what you are using):
AzureActivity
| summarize by ResourceGroup
This has two areas for optimisation: 1. It can return lower/upper case examples for the same RG, just like you have seen 2. ARG queries like in my 1st reply, can be used instead, and they will be case correct, and as it uses the api will list all ResourceGroups not just those that have written a log file (i.e if a RG was created 100days ago, and you retain data for 90days, the KQL wont know the RG exists on day 91, ARG will)- So actually the issue is not raised by me but by Dean, so he might be able to answer the query much properly.
But thanks for your elaborative reply.Thanks for you efforts to try to help me figure out what might be happening. To provide some more details, this occurred in an saved workbook that was created from the Azure Activity template. I see the same issue in the actual template, it is happening for every single RG. The same RG is shown twice using different case, some are all upper case and some are mixed case.
The parameter is a dropdown from Logs, so now my real question, is why would the ResoureGroup field in the AzureActivity log be getting stored differently.?
The query is
AzureActivity| summarize by ResourceGroup
