{
    "version": "Notebook/1.0",
    "items": [
      {
        "type": 1,
        "content": {
          "json": "## Data Ingestion Comparison Hourly\n---\n"
        },
        "name": "text - 2"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where TimeGenerated > ago(1d)\r\n| summarize Size = sum(_BilledSize)\r\n| extend GB = Size/1073741824",
          "size": 4,
          "title": "Syslog - 24Hr",
          "noDataMessage": "No Datra found",
          "noDataMessageStyle": 3,
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "rowLimit": 10000
          },
          "sortBy": []
        },
        "customWidth": "28",
        "name": "query - 11",
        "styleSettings": {
          "maxWidth": "28"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where TimeGenerated >= ago(30d)\r\n| project TimeGenerated,Computer\r\n| sort by TimeGenerated desc\r\n| take 1",
          "size": 4,
          "title": "Syslog Last log Received",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "rowLimit": 1
          }
        },
        "customWidth": "34",
        "name": "query - 15",
        "styleSettings": {
          "maxWidth": "34"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where TimeGenerated >= ago(30d)\r\n| extend Day = bin(TimeGenerated,1d)\r\n| extend Quantity = _BilledSize\r\n| project Day,Quantity,TimeGenerated,Computer\r\n| sort by TimeGenerated desc\r\n| summarize EventCount = sum(Quantity) by Day\r\n| extend GB = EventCount/1073741824\r\n",
          "size": 0,
          "title": "Daily Ingestion - Syslog",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "GB",
                "formatter": 8,
                "formatOptions": {
                  "palette": "greenRed"
                }
              }
            ],
            "sortBy": [
              {
                "itemKey": "Day",
                "sortOrder": 2
              }
            ]
          },
          "sortBy": [
            {
              "itemKey": "Day",
              "sortOrder": 2
            }
          ]
        },
        "customWidth": "38",
        "name": "query - 23",
        "styleSettings": {
          "maxWidth": "38"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where TimeGenerated > ago(30d)\r\n| extend Day = bin(TimeGenerated,1d)\r\n| extend Quantity = _BilledSize\r\n| project Day,Quantity,TimeGenerated,Computer\r\n| sort by TimeGenerated desc\r\n| summarize IngestionVolume_bytes= sum(Quantity) by Day, Computer\r\n| extend GB = IngestionVolume_bytes/1073741824\r\n| sort by Day desc",
          "size": 2,
          "title": "Daily Ingestion - Syslog on the basis of Computer",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "GB",
                "formatter": 8,
                "formatOptions": {
                  "palette": "greenRed"
                }
              }
            ],
            "rowLimit": 10000
          }
        },
        "customWidth": "60",
        "name": "query - 23",
        "styleSettings": {
          "maxWidth": "60"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "let AZ1 = Syslog | where Computer in (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"PA-VM-AZ1\" | sort by TimeGenerated desc | take 1;\r\nlet AZ2 = Syslog | where Computer in (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"PA-VM-AZ2\" | sort by TimeGenerated desc | take 1;\r\nlet AZ3 = Syslog | where Computer in (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"PA-VM-AZ3\" | sort by TimeGenerated desc | take 1;\r\nlet DHCP = Syslog | where Computer in (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"DHCP_CL\" | sort by TimeGenerated desc | take 1;\r\nlet DHCP1 = Syslog | where Computer in (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"DHCP_CL\" | sort by TimeGenerated desc | take 1;\r\nlet AD = Syslog | where Computer in  (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"Active Directory\" | sort by TimeGenerated desc | take 1;\r\nlet AD1 = Syslog | where Computer in  (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"Active Directory\" | sort by TimeGenerated desc | take 1;\r\nlet AD2 = Syslog | where Computer in  (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"Active Directory\" | sort by TimeGenerated desc | take 1;\r\nlet AD3 = Syslog | where Computer in  (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"Active Directory\" | sort by TimeGenerated desc | take 1;\r\nlet AD4 = Syslog | where Computer in  (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"Active Directory\" | sort by TimeGenerated desc | take 1;\r\nlet AD5 = Syslog | where Computer in  (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"Active Directory\" | sort by TimeGenerated desc | take 1;\r\nlet AD6 = Syslog | where Computer in  (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"Active Directory\" | sort by TimeGenerated desc | take 1;\r\nlet AD7 = Syslog | where Computer in  (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"Active Directory\" | sort by TimeGenerated desc | take 1;\r\nlet AD8 = Syslog | where Computer in  (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"Active Directory\" | sort by TimeGenerated desc | take 1;\r\nlet AD9 = Syslog | where Computer in  (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"Active Directory\" | sort by TimeGenerated desc | take 1;\r\nlet AD10 = Syslog | where Computer in  (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"Active Directory\" | sort by TimeGenerated desc | take 1;\r\nlet AD11 = Syslog | where Computer in  (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"Active Directory\" | sort by TimeGenerated desc | take 1;\r\nlet CisASA = Syslog | where Computer == \"{Computername}\" | project TimeGenerated,Computer,SourceName = \"Cisco ASA\" | sort by TimeGenerated desc | take 1;\r\nunion AZ1,AZ2,AZ3,DHCP,DHCP1,AD,AD1,AD2,AD3,AD4,AD5,AD5,AD6,AD7,AD7,AD8,AD9,AD10,AD11,CisASA\r\n| where TimeGenerated >= ago(30d)\r\n| sort by SourceName asc\r\n\r\n",
          "size": 2,
          "title": "Last Log Received",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "customWidth": "40",
        "name": "query - 22",
        "styleSettings": {
          "maxWidth": "40"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where Computer in (\"{Computername}\")\r\n//| where Computer !=  \"{Computername}\"\r\n| where TimeGenerated > ago(1d)\r\n| summarize Size = sum(_BilledSize)\r\n| extend GB = Size/1073741824",
          "size": 1,
          "title": "Palo Alto for 24 Hours",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "table",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "GB",
                "formatter": 18,
                "formatOptions": {
                  "thresholdsOptions": "colors",
                  "thresholdsGrid": [
                    {
                      "operator": "Default",
                      "thresholdValue": null,
                      "representation": "blueLight",
                      "text": "{0}{1}"
                    }
                  ]
                }
              },
              {
                "columnMatch": "EventCount",
                "formatter": 8,
                "formatOptions": {
                  "palette": "blue"
                }
              }
            ]
          },
          "sortBy": []
        },
        "customWidth": "29",
        "name": "query - 4",
        "styleSettings": {
          "maxWidth": "29"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where TimeGenerated >= ago(30d)\r\n| where Computer in  (\"{Computername}\",\"{Computername}\")\r\n| extend Day = bin(TimeGenerated,1d)\r\n| extend Quantity = _BilledSize\r\n| project Day,Quantity,TimeGenerated,Computer\r\n| summarize EventCount= sum(Quantity) by Day\r\n| extend GB = EventCount/1073741824\r\n| sort by Day",
          "size": 1,
          "title": "Daily Ingestion - Palo Alto",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "GB",
                "formatter": 8,
                "formatOptions": {
                  "palette": "greenRed"
                }
              }
            ],
            "sortBy": [
              {
                "itemKey": "Day",
                "sortOrder": 2
              }
            ]
          },
          "sortBy": [
            {
              "itemKey": "Day",
              "sortOrder": 2
            }
          ]
        },
        "customWidth": "36",
        "name": "query - 13",
        "styleSettings": {
          "maxWidth": "36"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "let AZ1 = Syslog | where Computer in (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"PA-VM-AZ1\" | sort by TimeGenerated desc | take 1;\r\nlet AZ2 = Syslog | where Computer in (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"PA-VM-AZ2\" | sort by TimeGenerated desc | take 1;\r\nlet AZ3 = Syslog | where Computer in (\"{Computername}\") | project TimeGenerated,Computer,SourceName = \"PA-VM-AZ3\" | sort by TimeGenerated desc | take 1;\r\nunion AZ1,AZ2,AZ3\r\n| where TimeGenerated >= ago(30d)",
          "size": 1,
          "title": "Palo Alto",
          "noDataMessage": "No datra found for 2 days",
          "noDataMessageStyle": 3,
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "sortBy": [
              {
                "itemKey": "Computer",
                "sortOrder": 1
              }
            ]
          },
          "sortBy": [
            {
              "itemKey": "Computer",
              "sortOrder": 1
            }
          ]
        },
        "customWidth": "34",
        "name": "query - 14",
        "styleSettings": {
          "maxWidth": "34"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "let AZ1 = Syslog | where Computer == \"{Computername}\" | where TimeGenerated >= ago(30d) | extend Day = bin(TimeGenerated,1d) | extend Quantity = _BilledSize |project Day,Quantity,TimeGenerated,Computer | summarize IngestionVolume_bytes= sum(Quantity) by Day | extend GB = IngestionVolume_bytes/1073741824 | extend SourceName = \"PA-VM-AZ1\"  | sort by Day desc;\r\nlet AZ2 = Syslog | where Computer == \"{Computername}\" | where TimeGenerated >= ago(30d) | extend Day = bin(TimeGenerated,1d) | extend Quantity = _BilledSize |project Day,Quantity,TimeGenerated,Computer | summarize IngestionVolume_bytes= sum(Quantity) by Day | extend GB = IngestionVolume_bytes/1073741824 | extend SourceName = \"PA-VM-AZ2\"  | sort by Day desc;\r\nlet AZ3 = Syslog | where Computer == \"{Computername}\" | where TimeGenerated >= ago(30d) | extend Day = bin(TimeGenerated,1d) | extend Quantity = _BilledSize |project Day,Quantity,TimeGenerated,Computer | summarize IngestionVolume_bytes= sum(Quantity) by Day | extend GB = IngestionVolume_bytes/1073741824 | extend SourceName = \"PA-VM-AZ3\" | sort by Day desc;\r\nunion AZ1,AZ2,AZ3\r\n| sort by Day desc ",
          "size": 0,
          "title": "Daily Ingestion Volume of Palo Alto - Segregated on the basis of machine",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "GB",
                "formatter": 8,
                "formatOptions": {
                  "palette": "greenRed"
                }
              },
              {
                "columnMatch": "SourceName",
                "formatter": 18,
                "formatOptions": {
                  "thresholdsOptions": "colors",
                  "thresholdsGrid": [
                    {
                      "operator": "==",
                      "thresholdValue": "PA-VM-AZ1",
                      "representation": "gray",
                      "text": "{0}{1}"
                    },
                    {
                      "operator": "==",
                      "thresholdValue": "PA-VM-AZ2",
                      "representation": "grayBlue",
                      "text": "{0}{1}"
                    },
                    {
                      "operator": "==",
                      "thresholdValue": "PA-VM-AZ3",
                      "representation": "turquoise",
                      "text": "{0}{1}"
                    },
                    {
                      "operator": "Default",
                      "thresholdValue": null,
                      "representation": "blueLight",
                      "text": "{0}{1}"
                    }
                  ]
                }
              }
            ],
            "sortBy": [
              {
                "itemKey": "$gen_heatmap_GB_2",
                "sortOrder": 2
              }
            ]
          },
          "sortBy": [
            {
              "itemKey": "$gen_heatmap_GB_2",
              "sortOrder": 2
            }
          ]
        },
        "customWidth": "50",
        "name": "query - 24",
        "styleSettings": {
          "maxWidth": "50"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where Computer == \"{Computername}\"\r\n| where TimeGenerated > ago(30d)\r\n| summarize Size = sum(_BilledSize),EventCount = count() by bin(TimeGenerated, 1d)\r\n| extend GB = Size/1073741824\r\n| project TimeGenerated,GB,EventCount",
          "size": 1,
          "title": "PA-VM-AZ1",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "GB",
                "formatter": 8,
                "formatOptions": {
                  "palette": "brown"
                }
              },
              {
                "columnMatch": "Size_GB",
                "formatter": 8,
                "formatOptions": {
                  "palette": "blue"
                }
              }
            ],
            "sortBy": [
              {
                "itemKey": "TimeGenerated",
                "sortOrder": 2
              }
            ]
          },
          "sortBy": [
            {
              "itemKey": "TimeGenerated",
              "sortOrder": 2
            }
          ]
        },
        "customWidth": "50",
        "name": "query - 8",
        "styleSettings": {
          "maxWidth": "50"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where Computer == \"{Computername}\"\r\n| where TimeGenerated > ago(30d)\r\n| project TimeGenerated,Computer\r\n| sort by TimeGenerated desc\r\n| take 1",
          "size": 4,
          "title": "PA-VM-AZ1 - Last Log Received",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "sortBy": []
        },
        "customWidth": "35",
        "name": "query - 16",
        "styleSettings": {
          "maxWidth": "35"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n|where Computer == \"{Computername}\"\r\n| where TimeGenerated > ago(30d)\r\n| summarize Size = sum(_BilledSize),EventCount = count() by bin(TimeGenerated, 1d)\r\n| extend GB = Size/1073741824\r\n| project TimeGenerated,GB,EventCount",
          "size": 1,
          "title": "PA-VM-AZ2",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "GB",
                "formatter": 8,
                "formatOptions": {
                  "palette": "yellow"
                }
              },
              {
                "columnMatch": "Size_GB",
                "formatter": 8,
                "formatOptions": {
                  "palette": "blue"
                }
              }
            ],
            "sortBy": [
              {
                "itemKey": "TimeGenerated",
                "sortOrder": 2
              }
            ]
          },
          "sortBy": [
            {
              "itemKey": "TimeGenerated",
              "sortOrder": 2
            }
          ]
        },
        "customWidth": "50",
        "name": "query - 10",
        "styleSettings": {
          "maxWidth": "50"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n|where Computer == \"{Computername}\"\r\n| where TimeGenerated > ago(30d)\r\n| project TimeGenerated,Computer\r\n| sort by TimeGenerated desc\r\n| take 1",
          "size": 4,
          "title": "PA-VM-AZ2 - Last Log Received",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "customWidth": "35",
        "name": "query - 17",
        "styleSettings": {
          "maxWidth": "35"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where Computer == \"{Computername}\"\r\n| where TimeGenerated > ago(30d)\r\n| summarize Size = sum(_BilledSize),EventCount = count() by bin(TimeGenerated, 1d)\r\n| extend GB = Size/1073741824\r\n| project TimeGenerated,GB,EventCount",
          "size": 1,
          "title": "\t PA-VM-AZ3",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "GB",
                "formatter": 8,
                "formatOptions": {
                  "palette": "magenta"
                }
              },
              {
                "columnMatch": "Size_GB",
                "formatter": 8,
                "formatOptions": {
                  "palette": "blue"
                }
              }
            ]
          }
        },
        "customWidth": "50",
        "name": "query - 9",
        "styleSettings": {
          "maxWidth": "50"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where Computer == \"{Computername}\"\r\n| where TimeGenerated > ago(30d)\r\n| project TimeGenerated,Computer\r\n| sort by TimeGenerated desc\r\n| take 1",
          "size": 4,
          "title": "PA-VM-AZ3 - Last Log Received",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "customWidth": "35",
        "name": "query - 18",
        "styleSettings": {
          "maxWidth": "35"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where HostName in (\"{Computername}\" , \"{Computername}\")\r\n| where TimeGenerated > ago(30d)\r\n| summarize Size = sum(_BilledSize),EventCount = count() by bin(TimeGenerated, 1d)\r\n| extend GB = Size/1073741824\r\n| project TimeGenerated,GB,EventCount",
          "size": 1,
          "title": "DHCP",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "table",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "GB",
                "formatter": 8,
                "formatOptions": {
                  "palette": "greenRed"
                }
              }
            ],
            "sortBy": [
              {
                "itemKey": "TimeGenerated",
                "sortOrder": 2
              }
            ]
          },
          "sortBy": [
            {
              "itemKey": "TimeGenerated",
              "sortOrder": 2
            }
          ]
        },
        "customWidth": "50",
        "name": "query - 5",
        "styleSettings": {
          "maxWidth": "50"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where HostName in (\"{Computername}\" , \"{Computername}\")\r\n| where TimeGenerated > ago(30d)\r\n| project TimeGenerated,Computer\r\n| sort by TimeGenerated desc\r\n| take 1",
          "size": 4,
          "title": "DHCP - Last Log Received",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "customWidth": "35",
        "name": "query - 19",
        "styleSettings": {
          "maxWidth": "35"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where Computer in  (\"{Computername}\",\"{Computername}\",\"{Computername}\",\"{Computername}\",\"{Computername}\",\"{Computername}\")\r\n| where TimeGenerated > ago(30d)\r\n| summarize Size = sum(_BilledSize),EventCount = count() by bin(TimeGenerated, 1d)\r\n| extend GB = Size/1073741824\r\n| project TimeGenerated,GB,EventCount",
          "size": 1,
          "title": "Active Directory",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "table",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "EventCount",
                "formatter": 8,
                "formatOptions": {
                  "palette": "orange"
                }
              }
            ],
            "sortBy": [
              {
                "itemKey": "TimeGenerated",
                "sortOrder": 2
              }
            ]
          },
          "sortBy": [
            {
              "itemKey": "TimeGenerated",
              "sortOrder": 2
            }
          ]
        },
        "customWidth": "50",
        "name": "query - 6",
        "styleSettings": {
          "maxWidth": "50"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where Computer in  (\"{Computername}\",\"{Computername}\",\"{Computername}\",\"{Computername}\",\"{Computername}\",\"{Computername}\")\r\n| where TimeGenerated >= ago(30d)\r\n| project TimeGenerated,Computer\r\n| sort by TimeGenerated desc\r\n| take 1",
          "size": 4,
          "title": "Active Directory - Last Log Received",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "customWidth": "38",
        "name": "query - 20",
        "styleSettings": {
          "maxWidth": "38"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where Computer == \"{Computername}\"\r\n| where EventTime > ago(30d)\r\n| summarize Size = sum(_BilledSize),EventCount = count() by bin(TimeGenerated, 1d)\r\n| extend GB = Size/1073741824\r\n| project TimeGenerated,GB,EventCount\r\n",
          "size": 0,
          "title": "CiscoASA",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "table",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "EventCount",
                "formatter": 8,
                "formatOptions": {
                  "palette": "red"
                }
              }
            ],
            "sortBy": [
              {
                "itemKey": "TimeGenerated",
                "sortOrder": 2
              }
            ]
          },
          "sortBy": [
            {
              "itemKey": "TimeGenerated",
              "sortOrder": 2
            }
          ]
        },
        "customWidth": "50",
        "name": "query - 7",
        "styleSettings": {
          "maxWidth": "50"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Syslog\r\n| where Computer == \"{Computername}\"\r\n| where TimeGenerated >= ago(30d)\r\n| project TimeGenerated, Computer\r\n| sort by TimeGenerated desc\r\n| take 1",
          "size": 4,
          "title": "CiscoASA - Last Log Received",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "customWidth": "35",
        "name": "query - 21",
        "styleSettings": {
          "maxWidth": "35"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "union *\r\n| project TimeGenerated, TableName = Type\r\n| summarize by TableName\r\n| sort by TableName asc\r\n//| where TableName contains \"AuditLogs\"\r\n//| sort by TimeGenerated desc\r\n//| take 1",
          "size": 0,
          "showRefreshButton": true,
          "exportMultipleValues": true,
          "exportedParameters": [
            {
              "fieldName": "TableName",
              "parameterName": "TableName",
              "parameterType": 1
            }
          ],
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "name": "query - 25"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "let TableName_ = dynamic({TableName});\r\nunion *\r\n| project TimeGenerated, TableName = Type\r\n| where TableName in (TableName_)\r\n| sort by TimeGenerated desc\r\n| take 1",
          "size": 0,
          "timeContext": {
            "durationMs": 86400000
          },
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "name": "query - 26"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "//let TableName = \"OfficeActivity,Heartbeat,SentinelHealth,AADServicePrincipalSignLogs,SecurityAlert,SecurityIncident,Usage\"\r\nlet TableName_ = dynamic({TableName});\r\nunion withsource=_TableName *\r\n| where TimeGenerated > ago(24h)  // Change the time range to 6 hours\r\n//| extend Hour = bin(TimeGenerated, 1h)  // Bin the time into hours\r\n| summarize\r\n    Entries = count(),\r\n    Size = sum(_BilledSize),\r\n    last_log = datetime_diff(\"second\", now(), max(TimeGenerated)),\r\n    estimate  = sumif(_BilledSize, _IsBillable == true)\r\n    by _TableName, _IsBillable,TimeGenerated\r\n| project\r\n    TimeGenerated,\r\n    //['Hour'] = Hour,\r\n    ['TableName'] = _TableName,\r\n    ['Table Size'] = Size,\r\n    ['Table Entries'] = Entries,\r\n    ['Size per Entry'] = 1.0 * Size / Entries,\r\n    ['IsBillable'] = _IsBillable\r\n| order by TimeGenerated, ['Table Size'] desc,['TableName']\r\n| sort by TimeGenerated desc \r\n| project TimeGenerated,['TableName'] \r\n| where ['TableName'] contains TableName_\r\n| summarize by ['TableName'], TimeGenerated\r\n\r\n",
          "size": 0,
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "rowLimit": 10000,
            "sortBy": [
              {
                "itemKey": "TimeGenerated",
                "sortOrder": 2
              }
            ]
          },
          "sortBy": [
            {
              "itemKey": "TimeGenerated",
              "sortOrder": 2
            }
          ]
        },
        "customWidth": "30",
        "name": "query - 3",
        "styleSettings": {
          "maxWidth": "30"
        }
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "let TableName_ = dynamic({TableName});\r\nunion withsource=_TableName *\r\n| where TimeGenerated > ago(30d)  // Change the time range to 6 hours\r\n| extend DateTime = bin(TimeGenerated, 1h)  // Bin the time into hours\r\n| summarize\r\n    Entries = count(),\r\n    Size = sum(_BilledSize),\r\n    last_log = datetime_diff(\"second\", now(), max(TimeGenerated)),\r\n    estimate  = sumif(_BilledSize, _IsBillable == true)\r\n    by DateTime, _TableName, _IsBillable\r\n| project\r\n    ['DateTime'] = DateTime,\r\n    ['Table Name'] = _TableName,\r\n    ['Table Size'] = Size,\r\n    ['Table Entries'] = Entries,\r\n    ['Size per Entry'] = 1.0 * Size / Entries,\r\n    ['IsBillable'] = _IsBillable\r\n| order by DateTime , ['Table Size'] desc\r\n| where ['Table Name'] contains tostring(TableName_)\r\n| extend PreviousSize = prev(['Table Size'],1)\r\n| extend SizeChange = ['Table Size'] - PreviousSize\r\n| project PreviousSize, ['Table Name'], DateTime, TableSize = SizeChange\r\n| project-away PreviousSize\r\n",
          "size": 0,
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "sortBy": []
        },
        "customWidth": "30",
        "name": "query - 2",
        "styleSettings": {
          "maxWidth": "30"
        }
      }
    ],
  "fallbackResourceIds": [
    ""
  ],
  "fromTemplateId": "sentinel-syslog-bifurcation",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}