Heartbeat Azure Monitoring the VM - piechart

%3CLINGO-SUB%20id%3D%22lingo-sub-205851%22%20slang%3D%22en-US%22%3EHeartbeat%20Azure%20Monitoring%20the%20VM%20-%20piechart%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-205851%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20trying%20to%20create%20a%20visualization%20on%20VMs%20to%20monitor%20whether%20they%20are%20up%20and%20running%20or%20not%20on%20a%20pie%20chart.%20I%20came%20upto%20below%20extent%2C%20but%20how%20to%20visualize%20the%20numbers%20-%26nbsp%3Bif%20I%20have%20a%20total%20of%26nbsp%3B10%20VMs%20and%20if%208%20are%20up%20and%202%20are%20down%20on%26nbsp%3B%20pie%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%2C%20how%20to%20handle%20%220%20records%20matched%22%20case%26nbsp%3B%20instead%26nbsp%3Bof%20showing%20%22%3CSPAN%3ENo%20data%20for%20the%20given%20query%22%20%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHeartbeat%3CBR%20%2F%3E%7C%20summarize%20max(TimeGenerated)%20by%20Computer%3CBR%20%2F%3E%7C%20where%20max_TimeGenerated%20%26lt%3B%20ago(15m)%3CBR%20%2F%3E%7C%20render%20piechart%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-205851%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-206386%22%20slang%3D%22en-US%22%3ERe%3A%20Heartbeat%20Azure%20Monitoring%20the%20VM%20-%20piechart%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-206386%22%20slang%3D%22en-US%22%3E%3CP%3EYou'll%20need%20to%20specify%20how%20you%20want%20your%20data%20aggregated%20before%20you%20plot%20it.%20In%20this%20case%2C%20try%20the%20following%20(rather%20verbose%2C%20to%20show%20the%20thinking%20process)%20query%3A%3C%2FP%3E%0A%3CPRE%3Elet%20healthyVMCountWindow%20%3D%2030m%3B%20%2F%2Ftime%20window%20we%20want%20to%20look%20at%20to%20identify%20how%20many%20healthy%20VMs%20we%20have%0Alet%20healthyVMs%20%3D%20()%7B%20%2F%2Flist%20healthy%20VMs%20over%20time%20window%20above%0A%20%20%20%20Heartbeat%0A%20%20%20%20%7C%20where%20TimeGenerated%20%26gt%3B%20ago(healthyVMCountWindow)%0A%20%20%20%20%7C%20distinct%20Computer%20%20%20%0A%7D%3B%0Alet%20totalVMCountWindow%20%3D%201d%3B%20%2F%2Ftime%20window%20we%20want%20to%20look%20at%20to%20identify%20how%20many%20VMs%20we%20have%20in%20total%0AHeartbeat%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(totalVMCountWindow)%0A%7C%20distinct%20Computer%0A%7C%20extend%20isHealthy%20%3D%20iff(Computer%20in%20(healthyVMs)%2C%20%22healthy%22%2C%20%22unhealthy%22)%20%2F%2Fcreate%20a%20new%20column%20called%20%22isHealthy%22%20where%20we%20will%20classify%20our%20machines%0A%7C%20summarize%20count()%20by%20isHealthy%0A%7C%20render%20piechart%20%3C%2FPRE%3E%0A%3CP%3ETry%20it%20out%20on%20our%20demo%20environment%2C%20%3CA%20href%3D%22https%3A%2F%2Fportal.loganalytics.io%2FDemo%3Fq%3DH4sIAAAAAAAAA51RO0%252FDMBDeK%252FU%252FfMrUSEgFMVZl6UCXbqjM1%252BRKLBy7si8N4fHfOZM%252BAkUMZLqz7nvGsqBislJ169XCN04ejSt9izlur%252BsZplMxNaPtH1udyAnEw3r%252FDPoaTclOzLZDpSc1ue7IiPUqJkxFex6P7FAqqsAkf1N%252Ba6J8A%252Fg9BwxVaeMTHvotmYJsmKRf39FWHBgPen3PjgMJl7gDPfnJb6nyI6xUUeMKwcLXu0ZUEBiPPma9S%252FFC9mcdN%252BV%252F2xi0AON69vFoEOWvGJde8gS4CJAe%252BUXYlTBxeahzDrPdTk4ZVfxcS8yvkB22TMfGHZdccxZBnTEIjlsU3ja1Q0HWqq%252FsxJ8dfKcijLUoLMWYovsmaPSiMo5jMhabuqZgXlmpNMckx6Y720wXQY2rw53hotJe9Gd8AqoLEuyaAgAA%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E!%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

I am trying to create a visualization on VMs to monitor whether they are up and running or not on a pie chart. I came upto below extent, but how to visualize the numbers - if I have a total of 10 VMs and if 8 are up and 2 are down on  pie?

 

Also, how to handle "0 records matched" case  instead of showing "No data for the given query" ?

 

Heartbeat
| summarize max(TimeGenerated) by Computer
| where max_TimeGenerated < ago(15m)
| render piechart

1 Reply

You'll need to specify how you want your data aggregated before you plot it. In this case, try the following (rather verbose, to show the thinking process) query:

let healthyVMCountWindow = 30m; //time window we want to look at to identify how many healthy VMs we have
let healthyVMs = (){ //list healthy VMs over time window above
    Heartbeat
    | where TimeGenerated > ago(healthyVMCountWindow)
    | distinct Computer   
};
let totalVMCountWindow = 1d; //time window we want to look at to identify how many VMs we have in total
Heartbeat
| where TimeGenerated > ago(totalVMCountWindow)
| distinct Computer
| extend isHealthy = iff(Computer in (healthyVMs), "healthy", "unhealthy") //create a new column called "isHealthy" where we will classify our machines
| summarize count() by isHealthy
| render piechart 

Try it out on our demo environment, here!