Home

Need sample to make Donut Multiquery sample in Azure Workbooks

%3CLINGO-SUB%20id%3D%22lingo-sub-657852%22%20slang%3D%22en-US%22%3ENeed%20sample%20to%20make%20Donut%20Multiquery%20sample%20in%20Azure%20Workbooks%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-657852%22%20slang%3D%22en-US%22%3E%3CP%3EI%20hope%20someone%20can%20help%20me%20with%20a%20sample%20query%20that%20makes%20this%20type%20of%20Donut%20with%20Multiquery%20in%20Azure%20Workbooks.%20I%20have%20provided%20the%203%20queries%20below.%20I%20realize%2C%20that%20Donut%20Multiquery%20is%20possible%20in%20View%20Designer%2C%20but%20my%20problem%20with%20that%20tool%20is%2C%20that%20is%20does%20NOT%20respect%20the%20time%20range%20in%20my%20query%20(last%2030%20days).%20It%20defaults%20to%2024h%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20style%3D%22width%3A%20524px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F116565i6B770EDDFF9DC548%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%221.png%22%20title%3D%221.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EServers%20-%20Need%20Feature%20Updates%20(Azure%20Workbooks)%20-%20count%3CBR%20%2F%3EUpdate%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20now(-30d)%3CBR%20%2F%3E%7C%20where%20OSType!%3D%22Linux%22%20and%20Optional%3D%3Dfalse%3CBR%20%2F%3E%7C%20where%20(UpdateState%20%3D~%20%22Needed%22)%20and%20((Classification%20%3D%3D%20%22Feature%20Packs%22)%20or%20(Classification%20%3D%3D%20%22Updates%22)%20or%20(Classification%20%3D%3D%20%22Upgrades%22)%20or%20(Classification%20%3D%3D%20%22Service%20Packs%22))%20and%20(Approved!%3Dfalse)%20and%20(PublishedDate%20%26lt%3B%20ago(31d))%3CBR%20%2F%3E%7C%20where%20(Product%20contains%20%22server%22)%20and%20(Product%20!contains%20%22drivers%22)%3CBR%20%2F%3E%7C%20summarize%20arg_max(TimeGenerated%2C%20*)%20by%20Computer%2CUpdateID%3CBR%20%2F%3E%7C%20distinct%20Computer%3CBR%20%2F%3E%7C%20count%3CBR%20%2F%3E------------------------------------------------------------%3CBR%20%2F%3EServers%20-%20Need%20Important%20Security%20updates%20(Azure%20Workbooks)%20-%20count%3CBR%20%2F%3EUpdate%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20now(-30d)%3CBR%20%2F%3E%7C%20where%20OSType!%3D%22Linux%22%20and%20Optional%3D%3Dfalse%3CBR%20%2F%3E%7C%20where%20(UpdateState%20%3D~%20%22Needed%22)%20and%20((Classification%20%3D%3D%20%22Security%20Updates%22)%20or%20(Classification%20%3D%3D%20%22Update%20Rollups%22)%20or%20(Classification%20%3D%3D%20%22Monthly%20Rollups%22))%20and%20(Approved!%3Dfalse)%20and%20(PublishedDate%20%26lt%3B%20ago(31d))%20and%20(KBID%20!%3D%20%22890830%22)%3CBR%20%2F%3E%7C%20where%20(Product%20contains%20%22server%22)%20and%20(Product%20!contains%20%22drivers%22)%3CBR%20%2F%3E%7C%20summarize%20arg_max(TimeGenerated%2C%20*)%20by%20Computer%2CUpdateID%3CBR%20%2F%3E%7C%20distinct%20Computer%3CBR%20%2F%3E%7C%20count%3CBR%20%2F%3E------------------------------------------------------------%3CBR%20%2F%3EServers%20-%20Need%20Critical%20Non-Security%20Updates%20(Azure%20Workbooks)%20-%20count%3CBR%20%2F%3EUpdate%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20now(-30d)%3CBR%20%2F%3E%7C%20where%20OSType!%3D%22Linux%22%20and%20Optional%3D%3Dfalse%3CBR%20%2F%3E%7C%20where%20(UpdateState%20%3D~%20%22Needed%22)%20and%20((Classification%20%3D%3D%20%22Critical%20Updates%22))%20and%20(Approved!%3Dfalse)%20and%20(PublishedDate%20%26lt%3B%20ago(31d))%3CBR%20%2F%3E%7C%20where%20(Product%20contains%20%22server%22)%20and%20(Product%20!contains%20%22drivers%22)%3CBR%20%2F%3E%7C%20summarize%20arg_max(TimeGenerated%2C%20*)%20by%20Computer%2CUpdateID%3CBR%20%2F%3E%7C%20distinct%20Computer%3CBR%20%2F%3E%7C%20count%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-657852%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Morten Knudsen
Occasional Contributor

I hope someone can help me with a sample query that makes this type of Donut with Multiquery in Azure Workbooks. I have provided the 3 queries below. I realize, that Donut Multiquery is possible in View Designer, but my problem with that tool is, that is does NOT respect the time range in my query (last 30 days). It defaults to 24h

1.png

 

Servers - Need Feature Updates (Azure Workbooks) - count
Update
| where TimeGenerated > now(-30d)
| where OSType!="Linux" and Optional==false
| where (UpdateState =~ "Needed") and ((Classification == "Feature Packs") or (Classification == "Updates") or (Classification == "Upgrades") or (Classification == "Service Packs")) and (Approved!=false) and (PublishedDate < ago(31d))
| where (Product contains "server") and (Product !contains "drivers")
| summarize arg_max(TimeGenerated, *) by Computer,UpdateID
| distinct Computer
| count
------------------------------------------------------------
Servers - Need Important Security updates (Azure Workbooks) - count
Update
| where TimeGenerated > now(-30d)
| where OSType!="Linux" and Optional==false
| where (UpdateState =~ "Needed") and ((Classification == "Security Updates") or (Classification == "Update Rollups") or (Classification == "Monthly Rollups")) and (Approved!=false) and (PublishedDate < ago(31d)) and (KBID != "890830")
| where (Product contains "server") and (Product !contains "drivers")
| summarize arg_max(TimeGenerated, *) by Computer,UpdateID
| distinct Computer
| count
------------------------------------------------------------
Servers - Need Critical Non-Security Updates (Azure Workbooks) - count
Update
| where TimeGenerated > now(-30d)
| where OSType!="Linux" and Optional==false
| where (UpdateState =~ "Needed") and ((Classification == "Critical Updates")) and (Approved!=false) and (PublishedDate < ago(31d))
| where (Product contains "server") and (Product !contains "drivers")
| summarize arg_max(TimeGenerated, *) by Computer,UpdateID
| distinct Computer
| count