{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# Syslog Ingestion Overview\n---\n\nThis Workbook gives an overview of ingestion of logs in the Syslog table"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "crossComponentResources": [
          "{Workspace}"
        ],
        "parameters": [
          {
            "id": "37fd3af4-5d65-41e2-81ae-0720f281eb04",
            "version": "KqlParameterItem/1.0",
            "name": "Subscription",
            "type": 6,
            "isRequired": true,
            "isGlobal": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "includeAll": true,
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": []
          },
          {
            "id": "0407e413-4562-4a87-b660-72facb921954",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "isGlobal": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 7776000000
            }
          },
          {
            "id": "f0722820-a155-4a53-a8e3-1483213a5d67",
            "version": "KqlParameterItem/1.0",
            "name": "Workspace",
            "label": "Sentinel Workspace",
            "type": 5,
            "isRequired": true,
            "isGlobal": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id",
            "crossComponentResources": [
              "{Subscription}"
            ],
            "typeSettings": {
              "resourceTypeFilter": {
                "microsoft.operationalinsights/workspaces": true
              },
              "additionalResourceOptions": [],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 2592000000
            },
            "queryType": 1,
            "resourceType": "microsoft.resourcegraph/resources"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 0"
    },
    {
      "type": 1,
      "content": {
        "json": "## Log Ingestion Overview\r\n##### Select the Device Product to render the time chart\r\n---"
      },
      "name": "text - 3"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "SyslogConnectorsOverallStatus({TimeRange:start}, {TimeRange:end})",
              "size": 0,
              "timeContextFromParameter": "TimeRange",
              "exportFieldName": "DeviceProduct",
              "exportParameterName": "DeviceProduct",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{Workspace}"
              ],
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "ConnectionStatus",
                    "formatter": 18,
                    "formatOptions": {
                      "thresholdsOptions": "icons",
                      "thresholdsGrid": [
                        {
                          "operator": "==",
                          "thresholdValue": "Connected",
                          "representation": "success",
                          "text": "{0}{1}"
                        },
                        {
                          "operator": "!=",
                          "thresholdValue": "Connected",
                          "representation": "error",
                          "text": "{0}{1}"
                        },
                        {
                          "operator": "Default",
                          "thresholdValue": null,
                          "representation": "success",
                          "text": "{0}{1}"
                        }
                      ]
                    },
                    "numberFormat": {
                      "unit": 0,
                      "options": {
                        "style": "decimal"
                      }
                    }
                  },
                  {
                    "columnMatch": "OutofBox",
                    "formatter": 18,
                    "formatOptions": {
                      "thresholdsOptions": "icons",
                      "thresholdsGrid": [
                        {
                          "operator": "==",
                          "thresholdValue": "Available",
                          "representation": "Available",
                          "text": "{0}{1}"
                        },
                        {
                          "operator": "!=",
                          "thresholdValue": "Yes",
                          "representation": "Unavailable",
                          "text": "{0}{1}"
                        },
                        {
                          "operator": "Default",
                          "thresholdValue": null,
                          "representation": "success",
                          "text": "{0}{1}"
                        }
                      ]
                    }
                  }
                ],
                "labelSettings": [
                  {
                    "columnId": "DeviceProduct",
                    "label": "Device Product"
                  }
                ]
              },
              "sortBy": []
            },
            "customWidth": "50",
            "name": "query - 1 - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "SyslogConnectorsEventVolumebyDeviceProduct({TimeRange:start},{TimeRange:end},\"{DeviceProduct}\")\r\n| render timechart ",
              "size": 0,
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{Workspace}"
              ],
              "visualization": "timechart",
              "chartSettings": {
                "showMetrics": false
              }
            },
            "customWidth": "50",
            "name": "query - 2"
          }
        ]
      },
      "name": "IngestedLogs"
    }
  ],
  "fromTemplateId": "sentinel-SyslogOverview",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}