@Kalaimani
So for #1 we could add a test for Backups that start with A-M or N thru Z). I'm assuming there will be a range of names, you may need to spilt further A-E, F-M etc...? You can then run these as parallel queries in your Logic App.
let Events = AzureDiagnostics
| where Category == "AzureBackupReport";
Events
| extend JobOperationSubType_s = columnifexists("JobOperationSubType_s", "")
| where OperationName == "Job" and JobOperation_s == "Backup" and JobOperationSubType_s != "Log" and JobOperationSubType_s != "Recovery point_Log"
| distinct JobUniqueId_g, BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s
| project BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s
| join kind=leftouter (
Events
| where OperationName == "BackupItem"
| distinct BackupItemUniqueId_s, BackupItemFriendlyName_s
| project BackupItemUniqueId_s , BackupItemFriendlyName_s ) on BackupItemUniqueId_s
// add name filter (starts with A thru M)
| where BackupItemFriendlyName_s matches regex @"\A([A-Ma-m])"
//| where BackupItemFriendlyName_s matches regex @"\A([N-Zn-z])"
| project BackupItemFriendlyName_s, BackupItemUniqueId_s, JobStatus_s, Resource, JobFailureCode_s, JobStartDateTime_s
| extend Vault= Resource
| extend dt = todatetime(JobStartDateTime_s)
| summarize count() by BackupItemFriendlyName_s, JobStatus_s, Vault, BackupItemUniqueId_s, JobFailureCode_s, NewDateTime=dt, JobStartDateTime_s //, HostName =Resource1, FQDN
For #2, is that because you don't have a Heartbeat table? In a previous reply I asked you which Tables you do have, Heartbeat and VMconnection contain the data you are after, but you don't seem to have them, AzureDiagnostics doesn't have this detail so we do need to correlate with another source, there are 100s of tables, so you need to tell me which ones you have that have OS info. If you do have Heartbeat maybe I've joined on the wrong value?
I do think we are replicating much of what is available in the UI https://docs.microsoft.com/en-gb/azure/backup/configure-reports or could be done as a Workbook, if the primary goal to have a schedule report still? If not users can go to the UI or Workbooks anytime to see the status?
