Home

Need sample to make Donut Multiquery sample in Azure Workbooks

%3CLINGO-SUB%20id%3D%22lingo-sub-657852%22%20slang%3D%22en-US%22%3ENeed%20sample%20to%20make%20Donut%20Multiquery%20sample%20in%20Azure%20Workbooks%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-657852%22%20slang%3D%22en-US%22%3E%3CP%3EI%20hope%20someone%20can%20help%20me%20with%20a%20sample%20query%20that%20makes%20this%20type%20of%20Donut%20with%20Multiquery%20in%20Azure%20Workbooks.%20I%20have%20provided%20the%203%20queries%20below.%20I%20realize%2C%20that%20Donut%20Multiquery%20is%20possible%20in%20View%20Designer%2C%20but%20my%20problem%20with%20that%20tool%20is%2C%20that%20is%20does%20NOT%20respect%20the%20time%20range%20in%20my%20query%20(last%2030%20days).%20It%20defaults%20to%2024h%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20style%3D%22width%3A%20524px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F116565i6B770EDDFF9DC548%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%221.png%22%20title%3D%221.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EServers%20-%20Need%20Feature%20Updates%20(Azure%20Workbooks)%20-%20count%3CBR%20%2F%3EUpdate%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20now(-30d)%3CBR%20%2F%3E%7C%20where%20OSType!%3D%22Linux%22%20and%20Optional%3D%3Dfalse%3CBR%20%2F%3E%7C%20where%20(UpdateState%20%3D~%20%22Needed%22)%20and%20((Classification%20%3D%3D%20%22Feature%20Packs%22)%20or%20(Classification%20%3D%3D%20%22Updates%22)%20or%20(Classification%20%3D%3D%20%22Upgrades%22)%20or%20(Classification%20%3D%3D%20%22Service%20Packs%22))%20and%20(Approved!%3Dfalse)%20and%20(PublishedDate%20%26lt%3B%20ago(31d))%3CBR%20%2F%3E%7C%20where%20(Product%20contains%20%22server%22)%20and%20(Product%20!contains%20%22drivers%22)%3CBR%20%2F%3E%7C%20summarize%20arg_max(TimeGenerated%2C%20*)%20by%20Computer%2CUpdateID%3CBR%20%2F%3E%7C%20distinct%20Computer%3CBR%20%2F%3E%7C%20count%3CBR%20%2F%3E------------------------------------------------------------%3CBR%20%2F%3EServers%20-%20Need%20Important%20Security%20updates%20(Azure%20Workbooks)%20-%20count%3CBR%20%2F%3EUpdate%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20now(-30d)%3CBR%20%2F%3E%7C%20where%20OSType!%3D%22Linux%22%20and%20Optional%3D%3Dfalse%3CBR%20%2F%3E%7C%20where%20(UpdateState%20%3D~%20%22Needed%22)%20and%20((Classification%20%3D%3D%20%22Security%20Updates%22)%20or%20(Classification%20%3D%3D%20%22Update%20Rollups%22)%20or%20(Classification%20%3D%3D%20%22Monthly%20Rollups%22))%20and%20(Approved!%3Dfalse)%20and%20(PublishedDate%20%26lt%3B%20ago(31d))%20and%20(KBID%20!%3D%20%22890830%22)%3CBR%20%2F%3E%7C%20where%20(Product%20contains%20%22server%22)%20and%20(Product%20!contains%20%22drivers%22)%3CBR%20%2F%3E%7C%20summarize%20arg_max(TimeGenerated%2C%20*)%20by%20Computer%2CUpdateID%3CBR%20%2F%3E%7C%20distinct%20Computer%3CBR%20%2F%3E%7C%20count%3CBR%20%2F%3E------------------------------------------------------------%3CBR%20%2F%3EServers%20-%20Need%20Critical%20Non-Security%20Updates%20(Azure%20Workbooks)%20-%20count%3CBR%20%2F%3EUpdate%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20now(-30d)%3CBR%20%2F%3E%7C%20where%20OSType!%3D%22Linux%22%20and%20Optional%3D%3Dfalse%3CBR%20%2F%3E%7C%20where%20(UpdateState%20%3D~%20%22Needed%22)%20and%20((Classification%20%3D%3D%20%22Critical%20Updates%22))%20and%20(Approved!%3Dfalse)%20and%20(PublishedDate%20%26lt%3B%20ago(31d))%3CBR%20%2F%3E%7C%20where%20(Product%20contains%20%22server%22)%20and%20(Product%20!contains%20%22drivers%22)%3CBR%20%2F%3E%7C%20summarize%20arg_max(TimeGenerated%2C%20*)%20by%20Computer%2CUpdateID%3CBR%20%2F%3E%7C%20distinct%20Computer%3CBR%20%2F%3E%7C%20count%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-657852%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Morten Knudsen
Occasional Contributor

I hope someone can help me with a sample query that makes this type of Donut with Multiquery in Azure Workbooks. I have provided the 3 queries below. I realize, that Donut Multiquery is possible in View Designer, but my problem with that tool is, that is does NOT respect the time range in my query (last 30 days). It defaults to 24h

1.png

 

Servers - Need Feature Updates (Azure Workbooks) - count
Update
| where TimeGenerated > now(-30d)
| where OSType!="Linux" and Optional==false
| where (UpdateState =~ "Needed") and ((Classification == "Feature Packs") or (Classification == "Updates") or (Classification == "Upgrades") or (Classification == "Service Packs")) and (Approved!=false) and (PublishedDate < ago(31d))
| where (Product contains "server") and (Product !contains "drivers")
| summarize arg_max(TimeGenerated, *) by Computer,UpdateID
| distinct Computer
| count
------------------------------------------------------------
Servers - Need Important Security updates (Azure Workbooks) - count
Update
| where TimeGenerated > now(-30d)
| where OSType!="Linux" and Optional==false
| where (UpdateState =~ "Needed") and ((Classification == "Security Updates") or (Classification == "Update Rollups") or (Classification == "Monthly Rollups")) and (Approved!=false) and (PublishedDate < ago(31d)) and (KBID != "890830")
| where (Product contains "server") and (Product !contains "drivers")
| summarize arg_max(TimeGenerated, *) by Computer,UpdateID
| distinct Computer
| count
------------------------------------------------------------
Servers - Need Critical Non-Security Updates (Azure Workbooks) - count
Update
| where TimeGenerated > now(-30d)
| where OSType!="Linux" and Optional==false
| where (UpdateState =~ "Needed") and ((Classification == "Critical Updates")) and (Approved!=false) and (PublishedDate < ago(31d))
| where (Product contains "server") and (Product !contains "drivers")
| summarize arg_max(TimeGenerated, *) by Computer,UpdateID
| distinct Computer
| count

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
38 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies