{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "0b767a3f-72a6-495b-a08e-198348d4efb9", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "value": { "durationMs": 2592000000 } }, { "id": "3ec1d354-0588-43dd-b3e5-7ebab2195c40", "version": "KqlParameterItem/1.0", "name": "host_token", "label": "Veeam Backup & Replication Data Sources", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "Veeam_GetJobFinished\r\n| summarize by original_host", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# All Jobs" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| where not (instanceId in (\"40290\", \"40800\", \"150\", \"450\", \"151\", \"451\"))\r\n| where Allowance\r\n| summarize count() by JobResultMessage = JobResultMessage\r\n", "size": 3, "timeContext": { "durationMs": 86400000 }, "exportFieldName": "JobResultMessage", "exportParameterName": "ResultMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "JobResultMessage", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "purple" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "sortCriteriaField": "count_" } }, "customWidth": "50", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| where instanceId in (150, 151)\r\n| where Allowance == true\r\n| extend TransferredGb = todouble(\r\n extract(@\"TransferredGb=\"\"([^\"\"]*)\"\"\", 1, SyslogMessage)\r\n )\r\n| summarize TotalTransferredGb = sum(TransferredGb)\r\n| extend Name = \"Transferred Data (Gb)\"\r\n| project Name, TotalTransferredGb", "size": 3, "timeContext": { "durationMs": 604800000 }, "exportedParameters": [ { "fieldName": "TotalTransferredGb", "parameterName": "TotalTransferredGb", "parameterType": 1 }, { "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Name", "formatter": 1 }, "leftContent": { "columnMatch": "TotalTransferredGb", "formatter": 12 }, "showBorder": false } }, "customWidth": "50", "name": "query - 5 - Copy - Copy - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| where instanceId==151 or instanceId==150\r\n| where Allowance\r\n| extend TransferredGb = todouble(extract(\"TransferredGb=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage))\r\n", "size": 0, "timeContext": { "durationMs": 604800000 }, "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogTransefered", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 4" }, { "type": 1, "content": { "json": "Syslog message: \r\n```\r\n{SyslogTransefered}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "TotalTransferredGb", "comparison": "isNotEqualTo" }, { "parameterName": "ResultMessage", "comparison": "isEqualTo" } ], "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| where not (instanceId in (\"40290\", \"40800\", \"150\", \"450\", \"151\", \"451\"))\r\n| where JobResultMessage == \"{ResultMessage}\"\r\n| where Allowance\r\n\r\n", "size": 0, "title": "Events with `{ResultMessage}` status:", "timeContext": { "durationMs": 86400000 }, "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 2" } ] }, "conditionalVisibilities": [ { "parameterName": "ResultMessage", "comparison": "isNotEqualTo" }, { "parameterName": "TotalTransferredGb", "comparison": "isEqualTo" } ], "name": "group - 5" } ] }, "name": "All Jobs", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Weekly Reports" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| where instanceId in (\"190\",\"790\",\"194\",\"490\",\"36022\",\"36026\")\r\n| where Allowance\r\n| summarize Count = count() by bin(TimeGenerated, 1d), JobResultMessage\r\n| order by TimeGenerated asc\r\n| render timechart \r\n", "size": 0, "aggregation": 5, "title": " Backup and Backup Copy Jobs", "timeContext": { "durationMs": 604800000 }, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "x", "parameterName": "BackupAndBackupCopyJobsTime" }, { "fieldName": "label", "parameterName": "BackupAndBackupCopyJobsStatus", "parameterType": 1 }, { "fieldName": "", "parameterName": "BackupAndBackupCopyJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ], "xSettings": { "dateFormatSettings": { "formatName": "shortDatePattern", "showUtcTime": true }, "scale": "time", "label": "Label" }, "ySettings": { "label": "" } } }, "customWidth": "50", "name": " Backup and Backup Copy Jobs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| where instanceId == \"390\"\r\n| where Allowance\r\n| summarize Count = count() by bin(TimeGenerated, 1d), JobResultMessage\r\n| order by TimeGenerated asc\r\n| render timechart \r\n", "size": 0, "aggregation": 5, "title": "SureBackup Jobs", "timeContext": { "durationMs": 604800000 }, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "x", "parameterName": "SureBackupJobsTime", "parameterType": 1 }, { "fieldName": "label", "parameterName": "SureBackupJobsStatus", "parameterType": 1 }, { "parameterName": "SureBackupJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "50", "name": "SureBackup Jobs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{BackupAndBackupCopyJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| where instanceId in (\"190\",\"790\",\"194\",\"490\",\"36022\",\"36026\")\r\n| where Allowance\r\n| extend DateOnly = startofday(TimeGenerated)\r\n| join kind=inner (filters) on DateOnly, $left.JobResultMessage == $right.Series\r\n| project-away DateOnly, DateOnly1, Series\r\n", "size": 0, "title": "Backup and Backup Copy Jobs Drilldown", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ], "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "name": "query - 5" }, { "type": 1, "content": { "json": "Syslog message\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "SureBackupJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "BackupAndBackupCopyJobsStatus", "comparison": "isNotEqualTo" } ], "name": "Backup and Backup Copy Jobs Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{SureBackupJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"390\"\r\n| where Allowance\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| extend DateOnly = startofday(TimeGenerated)\r\n| join kind=inner (filters) on DateOnly, $left.JobResultMessage == $right.Series\r\n| project-away DateOnly, DateOnly1, Series", "size": 0, "title": "SureBackup Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 5" }, { "type": 1, "content": { "json": "Syslog message\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "SureBackupJobsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "BackupAndBackupCopyJobsStatus", "comparison": "isEqualTo" } ], "name": "Backup and Backup Copy Jobs Drilldown - Copy" } ] }, "name": "Weekly Reports", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Virtual Machines & Agents" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\n| where instanceId == \"190\" and JobType == \"0\"\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\n| summarize Count = count() by JobResultMessage = JobResultMessage \n| project JobResultMessage, Count\n| render piechart", "size": 3, "title": "VM Backup Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "VMBackupJobsStatus", "parameterType": 1 }, { "parameterName": "VMBackupJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "VM Backup Jobs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\n| where instanceId == \"590\" \n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\n| summarize Count = count() by JobResultMessage = JobResultMessage \n| project JobResultMessage, Count", "size": 3, "title": "VM File Copy Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "VMFileCopyJobsStatus", "parameterType": 1 }, { "parameterName": "VMFileCopyJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "showPin": false, "name": "VM File Copy Jobs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\n| where instanceId == 592\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\n| summarize Count = count() by JobResultMessage = JobResultMessage \n| project JobResultMessage, Count", "size": 3, "title": "VM Copy Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "VMCopyJobsStatus", "parameterType": 1 }, { "parameterName": "VMCopyJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "sortBy": [ { "itemKey": "JobResult", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "JobResult", "sortOrder": 2 } ], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "VM Copy Jobs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{VMBackupJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"190\" and JobType == \"0\"\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "VM Backup Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "VMBackupJobsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{VMBackupJobsMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VMBackupJobsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "VMCopyJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "VMFileCopyJobsStatus", "comparison": "isEqualTo" } ], "name": "VM Backup Jobs Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{VMFileCopyJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"590\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "VM File Copy Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "VMFileCopyJobsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{VMFileCopyJobsMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VMFileCopyJobsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "VMCopyJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "VMBackupJobsStatus", "comparison": "isEqualTo" } ], "name": "VM File Copy Jobs Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{VMCopyJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"592\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "VM Copy Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "VMCopyJobsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{VMCopyJobsMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VMCopyJobsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "VMFileCopyJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "VMBackupJobsStatus", "comparison": "isEqualTo" } ], "name": "VM Copy Jobs Drilldown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\n| where instanceId == 610\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\n| summarize Count = count() by JobResultMessage = JobResultMessage \n| project JobResultMessage, Count\n| render piechart", "size": 3, "title": "VM Quick Migration Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "VMQuickMigrationJobsStatus", "parameterType": 1 }, { "parameterName": "VMQuickMigrationJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "50", "name": "VM Quick Migration Jobs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\n| where instanceId == 790\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\n| summarize Count = count() by JobResultMessage = JobResultMessage \n| project JobResultMessage, Count\n| render piechart", "size": 3, "title": "Veeam Agent Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "VeeamAgentJobsStatus", "parameterType": 1 }, { "parameterName": "VeeamAgentJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "50", "name": "Veeam Agent Jobs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{VMQuickMigrationJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == 610\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "VM Quick Migration Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "VeeamAgentJobsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{VeeamAgentJobsMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VMQuickMigrationJobsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "VeeamAgentJobsStatus", "comparison": "isEqualTo" } ], "name": " VM Quick Migration Jobs Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{VeeamAgentJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"790\"\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "Veeam Agent Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "VeeamAgentJobsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{VeeamAgentJobsMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "VMQuickMigrationJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "VeeamAgentJobsStatus", "comparison": "isNotEqualTo" } ], "name": "Veeam Agent Jobs Drilldown" } ] }, "name": "Virtual Machines & Agents", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Unstructured Data" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\n| where instanceId == 190\n| where JobType == 13000\n| extend SourceType = extract(\"SourceType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| where SourceType == 3\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\n| summarize Count = count() by JobResultMessage = JobResultMessage \n| project JobResultMessage, Count\n| render piechart", "size": 3, "title": " File Backup Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "FileBackupJobsStatus", "parameterType": 1 }, { "parameterName": "FileBackupJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": " File Backup Jobs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\n| where instanceId == 190\n| where JobType == 13000\n| extend SourceType = extract(\"SourceType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| where SourceType == 7\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\n| summarize Count = count() by JobResultMessage = JobResultMessage \n| project JobResultMessage, Count\n| render piechart", "size": 3, "title": "Object Storage Backup Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "ObjectStorageBackupJobsStatus", "parameterType": 1 }, { "parameterName": "ObjectStorageBackupJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "Object Storage Backup Jobs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\n| where instanceId == 490\n| where JobType == 13003\n| extend SourceType = extract(\"SourceType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| where SourceType == 5\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\n| summarize Count = count() by JobResultMessage = JobResultMessage \n| project JobResultMessage, Count\n| render piechart", "size": 3, "title": "Backup Copy Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "BackupCopyJobsStatus", "parameterType": 1 }, { "parameterName": "BackupCopyJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "Backup Copy Jobs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{FileBackupJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == 190\r\n| where JobType == 13000\r\n| extend SourceType = extract(\"SourceType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| where SourceType == 3\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "File Backup Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "FileBackupJobsSyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Message Details", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "172ch" } }, { "columnMatch": "SyslogMessage", "formatter": 5 } ], "sortBy": [ { "itemKey": "Job Type", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Job Type", "sortOrder": 2 } ] }, "name": "query - 1" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{FileBackupJobsSyslogMessage}\r\n```" }, "name": "text - 2" } ] }, "conditionalVisibilities": [ { "parameterName": "FileBackupJobsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "ObjectStorageBackupJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "BackupCopyJobsStatus", "comparison": "isEqualTo" } ], "name": "File Backup Jobs Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{ObjectStorageBackupJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == 190\r\n| where JobType == 13000\r\n| extend SourceType = extract(\"SourceType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| where SourceType == 7\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "Object Storage Backup Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "ObjectStorageBackupJobsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Message Details", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "172ch" } }, { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 1" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{ObjectStorageBackupJobsMessage}\r\n```" }, "name": "text - 2" } ] }, "conditionalVisibilities": [ { "parameterName": "ObjectStorageBackupJobsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "BackupCopyJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "FileBackupJobsStatus", "comparison": "isEqualTo" } ], "name": "Object Storage Backup Jobs Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{BackupCopyJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == 490\r\n| where JobType == 13003\r\n| extend SourceType = extract(\"SourceType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| where SourceType == 5\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "Backup Copy Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "BackupCopyJobsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Message Details", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "172ch" } }, { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 1" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{BackupCopyJobsMessage}\r\n```" }, "name": "text - 2" } ] }, "conditionalVisibilities": [ { "parameterName": "BackupCopyJobsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "FileBackupJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "ObjectStorageBackupJobsStatus", "comparison": "isEqualTo" } ], "name": "Backup Copy Jobs Drilldown" } ] }, "name": "Unstructured Data", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Applications and Services" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId == \"36022\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by JobResultMessage = JobResultMessage \r\n| project JobResultMessage, Count\r\n| render piechart", "size": 3, "title": "Backup Jobs for Enterprise Plug-ins", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "BackupJobsForEnterprisePlugInsStatus", "parameterType": 1 }, { "parameterName": "BackupJobsForEnterprisePlugInsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "Backup Jobs for Enterprise Plug-ins" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId == \"36026\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by JobResultMessage = JobResultMessage \r\n| project JobResultMessage, Count\r\n| render piechart", "size": 3, "title": "Log Backup Jobs for Enterprise Plug-ins", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "LogBackupJobsForEnterprisePlugInsStatus", "parameterType": 1 }, { "parameterName": "LogBackupJobsForEnterprisePlugInsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "Log Backup Jobs for Enterprise Plug-ins" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId == \"190\" \r\n| where JobType == \"78\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by JobResultMessage = JobResultMessage \r\n| project JobResultMessage, Count\r\n| render piechart", "size": 3, "title": "Backup Jobs for Entra ID", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "BackupJobsForEntraIDStatus", "parameterType": 1 }, { "parameterName": "BackupJobsForEntraIDAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "Backup Jobs for Entra ID" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{BackupJobsForEnterprisePlugInsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"36022\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "Backup Jobs for Enterprise Plug-ins Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "BackupJobsForEnterprisePlugInsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{BackupJobsForEnterprisePlugInsMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "BackupJobsForEnterprisePlugInsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "LogBackupJobsForEnterprisePlugInsStatus", "comparison": "isEqualTo" }, { "parameterName": "BackupJobsForEntraIDStatus", "comparison": "isEqualTo" } ], "name": "Backup Jobs for Enterprise Plug-ins Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{LogBackupJobsForEnterprisePlugInsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"36026\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "Log Backup Jobs for Enterprise Plug-ins Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "LogBackupJobsForEnterprisePlugInsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{LogBackupJobsForEnterprisePlugInsMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "BackupJobsForEnterprisePlugInsStatus", "comparison": "isEqualTo" }, { "parameterName": "BackupJobsForEntraIDStatus", "comparison": "isEqualTo" }, { "parameterName": "LogBackupJobsForEnterprisePlugInsStatus", "comparison": "isNotEqualTo" } ], "name": "Log Backup Jobs for Enterprise Plug-ins Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{BackupJobsForEntraIDAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"190\" \r\n| where JobType == \"78\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "Backup Jobs for Entra ID Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "BackupJobsForEntraIDMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{BackupJobsForEntraIDMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "BackupJobsForEnterprisePlugInsStatus", "comparison": "isEqualTo" }, { "parameterName": "BackupJobsForEntraIDStatus", "comparison": "isNotEqualTo" }, { "parameterName": "LogBackupJobsForEnterprisePlugInsStatus", "comparison": "isEqualTo" } ], "name": "Backup Jobs for Entra ID Drilldown" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId == \"190\" \r\n| where JobType == 13000\r\n| extend SourceType = extract(\"SourceType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| where SourceType == 8\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by JobResultMessage = JobResultMessage \r\n| project JobResultMessage, Count\r\n| render piechart", "size": 3, "title": "Log Backup Jobs for Entra ID", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "LogBackupJobsForEntraIDStatus", "parameterType": 1 }, { "parameterName": "LogBackupJobsForEntraIDAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "Log Backup Jobs for Entra ID" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{LogBackupJobsForEntraIDAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"190\" \r\n| where JobType == 13000\r\n| extend SourceType = extract(\"SourceType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| where SourceType == 8\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "Backup Jobs for Entra ID Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "LogBackupJobsForEntraIDMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{LogBackupJobsForEntraIDMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibility": { "parameterName": "LogBackupJobsForEntraIDStatus", "comparison": "isNotEqualTo" }, "name": "Log Backup Jobs for Entra ID" } ] }, "name": "Applications and Services", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Backup Copy & Replicas" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId == \"190\" \r\n| where JobType == 1\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by JobResultMessage = JobResultMessage \r\n| project JobResultMessage, Count\r\n| render piechart", "size": 3, "title": "Replication Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "ReplicationJobsStatus", "parameterType": 1 }, { "parameterName": "ReplicationJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "Replication Jobs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId == \"490\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by JobResultMessage = JobResultMessage \r\n| project JobResultMessage, Count\r\n| render piechart", "size": 3, "title": "Backup Copy Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "BackupCopyJobsStatus", "parameterType": 1 }, { "parameterName": "BackupCopyJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "Backup Copy Jobs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{ReplicationJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"190\" \r\n| where JobType == 1\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "Replication Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "ReplicationJobsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ], "sortBy": [ { "itemKey": "State", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "State", "sortOrder": 2 } ] }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{ReplicationJobsMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "ReplicationJobsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "BackupCopyJobsStatus", "comparison": "isEqualTo" } ], "name": "Replication Jobs Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{BackupCopyJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"490\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "Replication Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "BackupCopyJobsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ], "sortBy": [ { "itemKey": "State", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "State", "sortOrder": 2 } ] }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{BackupCopyJobsMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "ReplicationJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "BackupCopyJobsStatus", "comparison": "isNotEqualTo" } ], "name": "Replication Jobs Drilldown - Copy" } ] }, "name": "Backup Copy & Replicas", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Tapes" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId == \"194\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by JobResultMessage = JobResultMessage \r\n| project JobResultMessage, Count\r\n| render piechart", "size": 3, "title": "Tape Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "TapeJobsStatus", "parameterType": 1 }, { "parameterName": "TapeJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "Tape Jobs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId == \"200\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by JobResultMessage = JobResultMessage \r\n| project JobResultMessage, Count\r\n| render piechart", "size": 3, "title": "Tape Copy Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "TapeCopyJobsStatus", "parameterType": 1 }, { "parameterName": "TapeCopyJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "Tape Copy Jobs" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId == \"198\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by JobResultMessage = JobResultMessage \r\n| project JobResultMessage, Count\r\n| render piechart", "size": 3, "title": "Tape Verification Jobs", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "TapeVerificationJobsStatus", "parameterType": 1 }, { "parameterName": "TapeVerificationJobsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "33", "name": "Tape Verification Jobs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{TapeJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"194\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "Tape Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "TapeJobsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{TapeJobsMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "TapeJobsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "TapeVerificationJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "TapeCopyJobsStatus", "comparison": "isEqualTo" } ], "name": "Tape Jobs Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{TapeCopyJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"200\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "Tape Copy Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "TapeCopyJobsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{TapeCopyJobsMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "TapeJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "TapeVerificationJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "TapeCopyJobsStatus", "comparison": "isNotEqualTo" } ], "name": "Tape Copy Jobs Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{TapeVerificationJobsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId == \"198\" \r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\r\n| project Date = TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\r\n", "size": 0, "title": "Tape Verification Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "TapeVerificationJobsMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{TapeVerificationJobsMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "TapeJobsStatus", "comparison": "isEqualTo" }, { "parameterName": "TapeVerificationJobsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "TapeCopyJobsStatus", "comparison": "isEqualTo" } ], "name": "Tape Verification Jobs Drilldown" } ] }, "name": "Tapes - Copy", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Finished Jobs" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetFinishedConfigurationBackupSessions\r\n| where \"{host_token}\" == \"'All'\" or Computer in ({host_token})\r\n| project TimeGenerated, [\"Data Source\"] = Computer, User = user, State = Result, SyslogMessage, StringTime = tostring(TimeGenerated), Description\r\n", "size": 0, "title": "Latest Configuration Backups", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "StringTime", "parameterName": "Veeam_GetFinishedConfigurationBackupSessionsTime" }, { "fieldName": "SyslogMessage", "parameterName": "SyslogMessage", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "State", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "12ch" } }, { "columnMatch": "SyslogMessage", "formatter": 5 }, { "columnMatch": "StringTime", "formatter": 5 }, { "columnMatch": "Description", "formatter": 5 } ] }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "50", "name": "Latest Configuration Backups", "styleSettings": { "margin": "3px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId in (\"190\",\"40290\",\"790\",\"194\",\"490\",\"390\",\"36022\",\"36026\")\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| project TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, StringTime = tostring(TimeGenerated), SyslogMessage", "size": 0, "title": "Latest Finished Jobs", "timeContextFromParameter": "TimeRange", "exportedParameters": [ { "fieldName": "StringTime", "parameterName": "LatestFinishedJobsTime", "parameterType": 1 }, { "fieldName": "SyslogMessage", "parameterName": "LatestFinishedJobsSyslogMessage", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "StringTime", "formatter": 5 }, { "columnMatch": "SyslogMessage", "formatter": 5 } ], "sortBy": [ { "itemKey": "Message Details", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Message Details", "sortOrder": 1 } ], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "50", "name": "Latest Finished Jobs", "styleSettings": { "margin": "3px", "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId in (\"190\",\"40290\",\"790\",\"194\",\"490\",\"390\",\"36022\",\"36026\")\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| project TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, StringTime = tostring(TimeGenerated)\r\n| where StringTime == \"{LatestFinishedJobsTime}\"", "size": 3, "title": "Latest Finished Jobs Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "showPin": false, "name": "Latest Finished Jobs Drilldown", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{LatestFinishedJobsSyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "Veeam_GetFinishedConfigurationBackupSessionsTime", "comparison": "isEqualTo" }, { "parameterName": "LatestFinishedJobsTime", "comparison": "isNotEqualTo" } ], "name": "Latest Finished Jobs Drilldown", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetFinishedConfigurationBackupSessions\r\n| where \"{host_token}\" == \"'All'\" or Computer in ({host_token})\r\n| where tostring(TimeGenerated) == \"{Veeam_GetFinishedConfigurationBackupSessionsTime}\"\r\n| project TimeGenerated, [\"Data Source\"] = Computer, User = user, [\"Message Details\"] = Description, State = Result, SyslogMessage", "size": 3, "title": "Latest Configuration Backups Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "showPin": false, "name": "Latest Configuration Backups Drilldown", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "Veeam_GetFinishedConfigurationBackupSessionsTime", "comparison": "isNotEqualTo" }, { "parameterName": "LatestFinishedJobsTime", "comparison": "isEqualTo" } ], "name": "Latest Configuration Backups Drilldown", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId in (\"190\",\"40290\",\"790\",\"194\",\"490\",\"390\",\"36022\",\"36026\")\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by bin(TimeGenerated, 1d), JobTypeDescription\r\n| order by TimeGenerated asc\r\n| render timechart ", "size": 2, "aggregation": 5, "title": "Finished Jobs by Type", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "x", "parameterName": "FinishedJobsByTypeTime", "parameterType": 1 }, { "fieldName": "label", "parameterName": "FinishedJobsByTypeStatus", "parameterType": 1 }, { "parameterName": "FinishedJobsByTypeAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "group": "*", "createOtherGroup": 0, "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "50", "name": "Finished Jobs by Type", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Veeam_GetJobFinished\r\n| where instanceId in (\"40290\", \"40800\")\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| summarize Count = count() by bin(TimeGenerated, 1d), JobTypeDescription\r\n| order by TimeGenerated asc\r\n| render timechart ", "size": 2, "aggregation": 5, "title": "Finished Restore Sessions by Type", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "x", "parameterName": "FinishedRestoreSessionsByTypeTime", "parameterType": 1 }, { "fieldName": "label", "parameterName": "FinishedRestoreSessionsByTypeStatus", "parameterType": 1 }, { "parameterName": "FinishedRestoreSessionsByTypeAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Success", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "50", "name": "Finished Restore Sessions by Type", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{FinishedJobsByTypeAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId in (\"190\",\"40290\",\"790\",\"194\",\"490\",\"390\",\"36022\",\"36026\")\r\n| where Allowance\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| extend DateOnly = startofday(TimeGenerated)\r\n| join kind=inner (filters) on DateOnly, $left.JobTypeDescription == $right.Series\r\n| project TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage", "size": 0, "title": "Finished Jobs by Type Drilldown", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "FinishedJobsByTypeStatus", "comparison": "isNotEqualTo" }, { "parameterName": "FinishedRestoreSessionsByTypeStatus", "comparison": "isEqualTo" } ], "name": "Finished Jobs by Type Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{FinishedRestoreSessionsByTypeAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\r\n\r\nVeeam_GetJobFinished\r\n| where instanceId in (\"40290\", \"40800\")\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| extend DateOnly = startofday(TimeGenerated)\r\n| join kind=inner (filters) on DateOnly, $left.JobTypeDescription == $right.Series\r\n| project-away DateOnly, DateOnly1, Series", "size": 0, "title": "Finished Restore Sessions by Type Drilldown", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "FinishedJobsByTypeStatus", "comparison": "isEqualTo" }, { "parameterName": "FinishedRestoreSessionsByTypeStatus", "comparison": "isNotEqualTo" } ], "name": "Finished Restore Sessions by Type Drilldown" } ] }, "name": "Finished Jobs", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Failed Backups" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let session_states_lookup = _GetWatchlist(\"session_states_lookup\"); \r\nVeeam_GetJobFinished\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\r\n| where instanceId in (\"150\", \"450\")\r\n| where JobResult in (\"2\", \"3\")\r\n| lookup kind=inner (session_states_lookup)\r\n on $left.JobResult == $right.JobResult\r\n| extend VmName = extract(\"VmName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| summarize Total = count() by VmName, JobResultMessage\r\n| evaluate pivot(JobResultMessage, sum(Total))\r\n| extend Failed = iff(column_ifexists(\"Failed\", 0) == 0, 0, column_ifexists(\"Failed\", 0)),\r\n Warning = iff(column_ifexists(\"Warning\", 0) == 0, 0, column_ifexists(\"Warning\", 0))\r\n| project VmName, Failed, Warning\r\n| order by Failed desc\r\n| take 15\r\n| render barchart", "size": 2, "title": " Unsuccessful VM Backups", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "x", "parameterName": "UnsuccessfulVMBackupsName", "parameterType": 1 }, { "fieldName": "label", "parameterName": "UnsuccessfulVMBackupsStatus", "parameterType": 1 }, { "parameterName": "UnsuccessfulVMBackupsAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "unstackedbar", "graphSettings": { "type": 0, "topContent": { "columnMatch": "VmName", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "VmName", "yAxis": [ "Warning", "Failed" ], "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Successful", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "50", "name": " Unsuccessful VM Backups", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let session_states_lookup = _GetWatchlist(\"session_states_lookup\"); \r\nVeeam_GetJobFinished\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\r\n| where instanceId in (\"151\", \"451\")\r\n| where JobResult in (\"2\", \"3\")\r\n| lookup kind=inner (session_states_lookup)\r\n on $left.JobResult == $right.JobResult\r\n| extend SourceName = extract(\"SourceName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| summarize Total = count() by SourceName, JobResultMessage\r\n| evaluate pivot(JobResultMessage, sum(Total))\r\n| extend Failed = iff(column_ifexists(\"Failed\", 0) == 0, 0, column_ifexists(\"Failed\", 0)),\r\n Warning = iff(column_ifexists(\"Warning\", 0) == 0, 0, column_ifexists(\"Warning\", 0))\r\n| project SourceName, Failed, Warning\r\n| order by Failed desc\r\n| take 15\r\n| render barchart", "size": 2, "title": "Unsuccessful Unstructured Data Backups", "timeContextFromParameter": "TimeRange", "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "label", "parameterName": "UnsuccessfulUnstructuredDataBackupsName" }, { "parameterName": "UnsuccessfulUnstructuredDataBackupAllFields", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "unstackedbar", "chartSettings": { "xAxis": "SourceName", "yAxis": [ "Failed", "Warning" ], "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Successful", "color": "green" }, { "seriesName": "Warning", "color": "orange" } ] } }, "customWidth": "50", "name": "Unsuccessful Unstructured Data Backups", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{UnsuccessfulUnstructuredDataBackupAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series), X = tostring(parsed.x);\r\nlet session_states_lookup = _GetWatchlist(\"session_states_lookup\"); \r\n\r\nVeeam_GetJobFinished\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\r\n| where instanceId in (\"151\", \"451\")\r\n| where JobResult in (\"2\", \"3\")\r\n| lookup kind=inner (session_states_lookup)\r\n on $left.JobResult == $right.JobResult\r\n| extend SourceName = extract(\"SourceName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series, $left.SourceName == $right.X\r\n| project TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, SourceName, SyslogMessage\r\n\r\n", "size": 0, "title": "Unsuccessful Unstructured Data Backups Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ], "sortBy": [ { "itemKey": "SourceName", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "SourceName", "sortOrder": 1 } ] }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "UnsuccessfulVMBackupsStatus", "comparison": "isEqualTo" }, { "parameterName": "UnsuccessfulUnstructuredDataBackupsName", "comparison": "isNotEqualTo" } ], "name": "Unsuccessful Unstructured Data Backups Drilldown" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let filters =\r\n print arr = parse_json(replace(@\"\\\"\"(\\{.*?\\})\\\"\"\", @\"\\1\", strcat('[', '{UnsuccessfulVMBackupsAllFields}', ']')))\r\n | mv-expand elem = arr\r\n | extend parsed = parse_json(tostring(elem))\r\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series), X = tostring(parsed.x);\r\nlet session_states_lookup = _GetWatchlist(\"session_states_lookup\"); \r\n\r\nVeeam_GetJobFinished\r\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\r\n| where instanceId in (\"150\", \"450\")\r\n| where JobResult in (\"2\", \"3\")\r\n| lookup kind=inner (session_states_lookup)\r\n on $left.JobResult == $right.JobResult\r\n| extend VmName = extract(\"VmName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\r\n| where \"{host_token}\" == \"'All'\" or original_host in ({host_token})\r\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series, $left.VmName == $right.X\r\n| project TimeGenerated, [\"Data Source\"] = original_host, [\"Message Details\"] = Description, [\"Job Type\"] = JobTypeDescription, State = JobResultMessage, VmName, SyslogMessage\r\n\r\n", "size": 0, "title": "Unsuccessful VM Backups Drilldown", "timeContextFromParameter": "TimeRange", "exportFieldName": "SyslogMessage", "exportParameterName": "SyslogMessage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "SyslogMessage", "formatter": 5 } ] } }, "name": "query - 0" }, { "type": 1, "content": { "json": "Syslog message:\r\n```\r\n{SyslogMessage}\r\n```" }, "name": "text - 1" } ] }, "conditionalVisibilities": [ { "parameterName": "UnsuccessfulVMBackupsStatus", "comparison": "isNotEqualTo" }, { "parameterName": "UnsuccessfulUnstructuredDataBackupsName", "comparison": "isEqualTo" } ], "name": "Unsuccessful VM Backups Drilldown - Copy" } ] }, "name": "Failed Backups", "styleSettings": { "showBorder": true } } ], "fromTemplateId": "sentinel-VeeamDataPlatformMonitoring", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }