{
"version": "Notebook/1.0",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "ccd5adcd-8d59-4cfe-99ec-98075de2e253",
"version": "KqlParameterItem/1.0",
"name": "DefaultSubscription_Internal",
"type": 1,
"isRequired": true,
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId",
"crossComponentResources": [
"value::selected"
],
"isHiddenWhenLocked": true,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "1ca69445-60fc-4806-b43d-ac7e6aad630a",
"version": "KqlParameterItem/1.0",
"name": "Subscription",
"type": 6,
"query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n",
"crossComponentResources": [
"value::selected"
],
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "e94aafa3-c5d9-4523-89f0-4e87aa754511",
"version": "KqlParameterItem/1.0",
"name": "Workspace",
"type": 5,
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\n| project id",
"crossComponentResources": [
"{Subscription}"
],
"value": "",
"typeSettings": {
"resourceTypeFilter": {
"microsoft.operationalinsights/workspaces": true
},
"additionalResourceOptions": []
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "eafaa0ec-7c3a-4ee5-babe-9850080c909d",
"version": "KqlParameterItem/1.0",
"name": "resourceGroup",
"type": 1,
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| where id == \"{Workspace}\"\r\n| project resourceGroup",
"crossComponentResources": [
"value::selected"
],
"isHiddenWhenLocked": true,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "ba423df4-f83c-495f-8d57-b3b828f8f11c",
"version": "KqlParameterItem/1.0",
"name": "WorkspaceName",
"type": 1,
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| where id == \"{Workspace}\"\r\n| project name",
"crossComponentResources": [
"{Subscription}"
],
"isHiddenWhenLocked": true,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "220c32e3-0fd9-4047-81ec-6e8c17b27458",
"version": "KqlParameterItem/1.0",
"name": "timeRange",
"label": "Time Range",
"type": 4,
"value": {
"durationMs": 2592000000
},
"typeSettings": {
"selectableValues": [
{
"durationMs": 86400000
},
{
"durationMs": 172800000
},
{
"durationMs": 259200000
},
{
"durationMs": 604800000
},
{
"durationMs": 1209600000
},
{
"durationMs": 2419200000
},
{
"durationMs": 2592000000
},
{
"durationMs": 5184000000
},
{
"durationMs": 7776000000
}
],
"allowCustom": true
}
},
{
"id": "13a91d3f-a588-4db8-88ab-4395610784b0",
"version": "KqlParameterItem/1.0",
"name": "ShowHelp",
"label": "Show Help",
"type": 10,
"description": "This will show some help information to help you understand the steps required",
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\r\n {\"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\", \"selected\":true}\r\n]"
},
{
"id": "093aa952-9149-4588-bfee-e41755eb0ca0",
"version": "KqlParameterItem/1.0",
"name": "ShowHiddenObjects",
"type": 10,
"isRequired": true,
"isGlobal": true,
"isHiddenWhenLocked": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\r\n { \"value\":\"Yes\", \"label\":\"Yes\"},\r\n { \"value\":\"No\", \"label\":\"No\",\"selected\":true }\r\n]"
},
{
"id": "d28c525b-aa29-48c3-957d-28b785971837",
"version": "KqlParameterItem/1.0",
"name": "workspaceRetention",
"type": 1,
"isRequired": true,
"isGlobal": true,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{WorkspaceName}?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties.retentionInDays\",\"columns\":[]}}]}",
"isHiddenWhenLocked": true,
"queryType": 12
},
{
"id": "532f15f4-2a9f-4986-b6e1-1d10d5d56a82",
"version": "KqlParameterItem/1.0",
"name": "isRetentionLessthan90",
"type": 1,
"isRequired": true,
"isGlobal": true,
"isHiddenWhenLocked": true,
"criteriaData": [
{
"criteriaContext": {
"leftOperand": "workspaceRetention",
"operator": "<",
"rightValType": "static",
"rightVal": "90",
"resultValType": "static",
"resultVal": "Yes"
}
},
{
"criteriaContext": {
"operator": "Default",
"resultValType": "static",
"resultVal": "No"
}
}
]
},
{
"id": "41425abc-45e0-4d2c-a9da-d1bedf517025",
"version": "KqlParameterItem/1.0",
"name": "showChangeLog",
"label": "Show Change Log",
"type": 10,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": []
},
"jsonData": "[\r\n {\"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\", \"selected\":true}\r\n]"
}
],
"style": "above",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 1"
},
{
"type": 1,
"content": {
"json": "### Workbook Change Log\r\n|Version|Description|\r\n|---|---|\r\n|v1.2| - Updated Usage Query calculaton from GiB to GB\r\n|v1.1| - Added Cost Estimation Tab to predict costs for enabling Basic Logs and data Archiving.
- Added Cost Estimation when updating table plans and Data Archive tiers.
- Added Time Range Selection.
- Added Change Log Notes.
- Fixed Basic Log Table Result Queries.
- Fixed Table Size Queries.| ",
"style": "warning"
},
"conditionalVisibility": {
"parameterName": "showChangeLog",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "text - 12"
},
{
"type": 1,
"content": {
"json": "\r\n#### 1. Select a subscription and workspace above.\r\n#### 2. Use the Data Archive, Basic Logs, and Search and Restore Tabs to Navigate\r\n#### 3. Select a table from grid to view and update table retention and plan settings\r\n\r\n**Note:** This workbook leverages the Usage table, there may be a delay of **one hour** for newly created tables to appear.",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "ShowHelp",
"comparison": "isEqualTo",
"value": "Yes"
},
"customWidth": "50",
"name": "text - 6"
},
{
"type": 1,
"content": {
"json": "\r\n#### Update the relevant base pricing from the [Azure Pricing Calculator](https://azure.microsoft.com/pricing/calculator/) based on your region.\r\n- Factor in any commitment tiers you may have\r\n- Ensure you have leading zero when using decimals. (0.00)\r\n- Workbook is in USD\r\n\r\n**Ingestion Price:** Sentinel + Log Analytics Ingestion Price\r\n- Example: Sentinel Ingestion Price is $2.00, Log Analytics Ingestion Price is $2.30, Total is $4.30. Use 4.30 as the value. \r\n\r\n**Workspace Retention Price:** The Log Analytics Workspace Retention Price\r\n\r\n**Workspace Retention Period:** By Default this automatically populate the number of months your workspace retention period is currently set to. You can update this number to see estimated costs for longer retention periods\r\n\r\n**Data Archive Price:** The Data Archive Price Per GB based on your region\r\n\r\n**Basic Logs Price:** The ingestion price for Basic Logs based on your region",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "ShowHelp",
"comparison": "isEqualTo",
"value": "Yes"
},
"customWidth": "50",
"name": "text - 6 - Copy"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Update Pricing Based on your Region",
"expandable": true,
"expanded": true,
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "96accba3-2cd7-4172-aa55-de4e9722f3d2",
"version": "KqlParameterItem/1.0",
"name": "IngestionPrice",
"label": "Ingestion Price",
"type": 1,
"description": "Enter your ingestion price per GB (PAYG or Commitment Tier). (Azure Monitor Ingestion + Sentinel)",
"isRequired": true,
"value": "4.0"
}
],
"style": "formVertical",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "16.6",
"name": "Cost Estimates",
"styleSettings": {
"margin": "5px",
"padding": "0px"
}
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "34d44a0e-a9d2-4ad7-81fb-21b232320cbb",
"version": "KqlParameterItem/1.0",
"name": "basiclogPrice",
"label": "Basic Logs Price",
"type": 1,
"description": "Enter the Basic Logs Price Per GB based on your region.",
"isRequired": true,
"value": "0.50"
}
],
"style": "formVertical",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "16.6",
"name": "Cost Estimates - Copy",
"styleSettings": {
"margin": "5px"
}
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "f69784cb-ed7d-41b2-a86b-02bd3ef56dd9",
"version": "KqlParameterItem/1.0",
"name": "ArchivePrice",
"label": "Data Archive Price",
"type": 1,
"description": "Enter the Data Archive Price Per GB based on your region.",
"isRequired": true,
"value": "0.02"
}
],
"style": "formVertical",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "16.6",
"name": "Cost Estimates - Copy",
"styleSettings": {
"margin": "5px"
}
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "34c07ca6-2aa1-4a75-815d-c0e709936dcd",
"version": "KqlParameterItem/1.0",
"name": "RetentionPrice",
"label": "Workspace Retention Price",
"type": 1,
"description": "Enter the workspace retention price per GB/month.",
"isRequired": true,
"value": "0.10"
}
],
"style": "formVertical",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "16.6",
"name": "Cost Estimates - Copy",
"styleSettings": {
"margin": "5px"
}
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "0f574f27-60ca-4bc3-8c13-3ffa9b415a3b",
"version": "KqlParameterItem/1.0",
"name": "workspaceRetentionPeriod_estimate",
"label": "Workspace Retention Period (Months)",
"type": 1,
"description": "The Workspace Retention Period in Months. (Update for an estimate)",
"isRequired": true,
"criteriaData": [
{
"criteriaContext": {
"leftOperand": "workspaceRetention",
"operator": "<=",
"rightValType": "static",
"rightVal": "90",
"resultValType": "static",
"resultVal": "3"
}
},
{
"criteriaContext": {
"operator": "Default",
"resultValType": "param",
"resultVal": "workspaceRetention"
}
}
]
}
],
"style": "formVertical",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "25",
"conditionalVisibility": {
"parameterName": "workspaceRetention",
"comparison": "isNotEqualTo"
},
"name": "Cost Estimates - Copy",
"styleSettings": {
"margin": "5px"
}
}
],
"exportParameters": true
},
"name": "Price Parameters"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{WorkspaceName}\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-12-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties\",\"columns\":[{\"path\":\"$.retentionInDays\",\"columnid\":\"Workspace Retention (days)\"},{\"path\":\"$.sku.name\",\"columnid\":\"Workspace Plan\"},{\"path\":\"$.workspaceCapping.dailyQuotaGb\",\"columnid\":\"Workspace Daily Quota (GB)\",\"substringRegexMatch\":\"^-?[1]\\\\d*(\\\\.\\\\d+)?$\",\"substringReplace\":\"None\"}]}}]}",
"size": 4,
"title": "Current Workspace Settings",
"showRefreshButton": true,
"queryType": 12,
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Workspace Retention (days)",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "<",
"thresholdValue": "90",
"representation": "2",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
},
"tooltipFormat": {
"tooltip": "Microsoft Sentinel provides 90 days of data retention for free"
}
},
{
"columnMatch": "Workspace Daily Quota",
"formatter": 0,
"tooltipFormat": {
"tooltip": "You can control your costs by applying a cap to the amount of data that you collect per day"
}
},
{
"columnMatch": "RetentionSetting",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "<=",
"thresholdValue": "90",
"representation": "2",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
}
]
},
"tileSettings": {
"titleContent": {
"columnMatch": "WorkspaceRetention",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "<=",
"thresholdValue": "90",
"representation": "3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": null,
"text": "{0}{1}"
}
]
}
},
"showBorder": true
}
},
"conditionalVisibility": {
"parameterName": "WorkspaceName",
"comparison": "isNotEqualTo"
},
"customWidth": "50",
"name": "query - 4"
},
{
"type": 1,
"content": {
"json": "Microsoft Sentinel Provides **90 days free** of Data Retention. Update your workspace retention settings. \r\n\r\n[Change the data retention period](https://docs.microsoft.com/azure/azure-monitor/logs/manage-cost-storage#change-the-data-retention-period)\r\n",
"style": "warning"
},
"conditionalVisibility": {
"parameterName": "isRetentionLessthan90",
"comparison": "isEqualTo",
"value": "Yes"
},
"customWidth": "50",
"name": "text - 12"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"loadType": "always",
"items": [
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "tabs",
"links": [
{
"id": "dff67182-9d46-405c-bfbd-f4e92a8cabc8",
"cellValue": "Tab",
"linkTarget": "parameter",
"linkLabel": "Data Archive",
"subTarget": "Archive",
"preText": "Archive",
"style": "link"
},
{
"id": "027c315f-cf87-4cc8-b12f-01048df837db",
"cellValue": "Tab",
"linkTarget": "parameter",
"linkLabel": "Basic Logs",
"subTarget": "Basic",
"style": "link"
},
{
"id": "8412cbde-4169-49b2-8a9e-e6196f3e97b7",
"cellValue": "Tab",
"linkTarget": "parameter",
"linkLabel": "Search and Restore",
"subTarget": "Search",
"style": "link"
},
{
"id": "071fcf7f-1795-409f-9bcf-9f7145ca8bea",
"cellValue": "Tab",
"linkTarget": "parameter",
"linkLabel": "Cost Estimation",
"subTarget": "Cost",
"style": "link"
}
]
},
"name": "links - 13"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "**Basic Logs**\r\n\r\nThere are two supported plan types, Analytics and Basic. All tables in your Log Analytics are Analytics tables, by default. \r\n\r\nYou can configure particular tables to use **Basic Logs** at reduced priced that have the following limitations:\r\n- Table retention fixed at 8 days\r\n- Alerts are not supported\r\n- Limited KQL language support\r\n\r\nYou can currently configure the following tables for Basic Logs:\r\n\r\n- All tables created with the Data Collection Rule (DCR)-based custom logs API.\r\n- ContainerLog and ContainerLogV2, which Container Insights uses and which include verbose text-based log records.\r\n- AppTraces, which contains freeform log records for application traces in Application Insights.\r\n\r\n[More Information on Basic Logs](https://docs.microsoft.com/azure/azure-monitor/logs/log-analytics-workspace-overview?WT.mc_id=modinfra-0000-rotrent#log-data-plans-preview)\r\n\r\n[Which tables support Basic Logs?](https://docs.microsoft.com/azure/azure-monitor/logs/basic-logs-configure?tabs=api-1%2Cportal-1#which-tables-support-basic-logs)\r\n\r\n[Sending Custom Logs](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview)\r\n",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "Basic"
},
"name": "text - 6 - Copy"
},
{
"type": 1,
"content": {
"json": "**Data Retention and Archive**\r\n\r\nData in each table in a Log Analytics workspace is retained for a specified period of time after which it's either removed or archived with a reduced retention fee. \r\n\r\n- Set the retention time to balance your requirement for having data available with reducing your cost for data retention.\r\n\r\n[More Information on Data retention and archive](https://docs.microsoft.com/azure/azure-monitor/logs/data-retention-archive)\r\n",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "Archive"
},
"name": "text - 10 - Copy"
},
{
"type": 1,
"content": {
"json": "**Search and Restore**\r\n\r\nThis tab shows current Search and Restore Tables. For more information on Search and Restore please refer to:\r\n\r\n[Search across long time spans in large datasets](https://docs.microsoft.com/azure/sentinel/search-jobs)\r\n\r\n[Restore archived logs from search](https://docs.microsoft.com/azure/sentinel/restore)\r\n",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "Search"
},
"name": "text - 6"
},
{
"type": 1,
"content": {
"json": "You may receive a \"Could not find column 'TableName' in table 'TableRetentionQuery'\" error below, indicating your workspace doesn't currently have any tables that support Basic Plans. \r\n\r\nFor more information on what tables support Basic Logs please refer to:\r\n\r\n[Which tables support Basic Logs?](https://docs.microsoft.com/azure/azure-monitor/logs/basic-logs-configure?tabs=api-1%2Cportal-1#which-tables-support-basic-logs)",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "Archive"
},
"name": "text - 3"
}
]
},
"conditionalVisibility": {
"parameterName": "ShowHelp",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "Help"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"loadType": "always",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "ff66d7b3-6ecd-4d76-9677-7c9496681c58",
"version": "KqlParameterItem/1.0",
"name": "tablePlanFilter",
"label": "Filter by Table Plan and Archive Tier",
"type": 10,
"isRequired": true,
"isGlobal": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\r\n { \"value\":\"(@.properties.plan=='Basic') || (@.properties.plan=='Analytics')\", \"label\":\"All\", \"selected\":true},\r\n { \"value\":\"(@.properties.plan=='Basic')\", \"label\":\"Basic Logs\"},\r\n { \"value\":\"(@.properties.plan=='Analytics')\", \"label\":\"Analytic Logs\"},\r\n { \"value\":\"(@.properties.archiveRetentionInDays > 0)\", \"label\":\"Archived Tables\"},\r\n { \"value\":\"(@.properties.archiveRetentionInDays == 0)\", \"label\":\"Default Retention Tables\"}\r\n]",
"timeContext": {
"durationMs": 86400000
},
"value": "(@.properties.archiveRetentionInDays == 0)"
}
],
"style": "formVertical",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 3"
}
],
"exportParameters": true
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "Archive"
},
"name": "Archive Log Filters"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"loadType": "always",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "eceba9b6-6afa-456c-acf1-fa1e02c3d182",
"version": "KqlParameterItem/1.0",
"name": "basicTablePlanFilter",
"type": 10,
"isRequired": true,
"isGlobal": true,
"isHiddenWhenLocked": true,
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"jsonData": "[\r\n { \"value\":\"((@.properties.schema.tableSubType=='DataCollectionRuleBased' || @.properties.schema.name=='AppTraces' || @.properties.schema.name=='ContainerLog' || @.properties.schema.name=='ContainerLogV2') && @.properties.schema.tableType!='RestoredLogs' && @.properties.schema.tableType!='SearchResults')\", \"label\":\"Supported Basic Logs\", \"selected\":true }\r\n]",
"timeContext": {
"durationMs": 86400000
}
}
],
"style": "pills",
"doNotRunWhenHidden": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 4"
}
],
"exportParameters": true
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "Basic"
},
"name": "Basic Log Filters"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "6431576b-55b8-4ab1-8c44-59f052268f36",
"version": "KqlParameterItem/1.0",
"name": "tableFilter",
"type": 1,
"isRequired": true,
"isGlobal": true,
"isHiddenWhenLocked": true,
"criteriaData": [
{
"criteriaContext": {
"leftOperand": "Tab",
"operator": "==",
"rightValType": "static",
"rightVal": "Archive",
"resultValType": "param",
"resultVal": "tablePlanFilter"
}
},
{
"criteriaContext": {
"leftOperand": "Tab",
"operator": "==",
"rightValType": "static",
"rightVal": "Basic",
"resultValType": "param",
"resultVal": "basicTablePlanFilter"
}
},
{
"criteriaContext": {
"operator": "Default",
"resultValType": "param",
"resultVal": "tablePlanFilter"
}
}
],
"timeContext": {
"durationMs": 86400000
}
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isNotEqualTo",
"value": "Cost"
},
"name": "parameters - 10"
}
],
"exportParameters": true
},
"conditionalVisibility": {
"parameterName": "WorkspaceName",
"comparison": "isNotEqualTo"
},
"name": "Tabs"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Select a table below to update settings. (Data is based on the {timeRange:label})",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?({tableFilter})]\",\"columns\":[{\"path\":\"$.name\",\"columnid\":\"TableName\"},{\"path\":\"$.properties.schema.tableType\",\"columnid\":\"TableType\"},{\"path\":\"$.properties.plan\",\"columnid\":\"TablePlan\"},{\"path\":\"$.properties.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.properties.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.properties.lastPlanModifiedDate\",\"columnid\":\"lastPlanModifiedDate\",\"columnType\":\"datetime\"}]}}]}",
"size": 4,
"title": "Retention settings for All Tables",
"showRefreshButton": true,
"queryType": 12,
"visualization": "table",
"gridSettings": {
"sortBy": [
{
"itemKey": "TableInteractivePeriod",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "TableInteractivePeriod",
"sortOrder": 1
}
],
"tileSettings": {
"showBorder": false,
"titleContent": {
"columnMatch": "TablePlan",
"formatter": 1
},
"leftContent": {
"columnMatch": "TableInteractivePeriod",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
}
},
"conditionalVisibility": {
"parameterName": "ShowHiddenObjects",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "TableRetentionQuery"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| summarize arg_max(TimeGenerated, *), size = sum(Quantity) / 1000 by DataType\r\n| project\r\n ['Table'] = DataType,\r\n ['Table Size'] = size,\r\n ['Estimated Ingestion Cost'] = size * iif(IsBillable == false, 0.0, {IngestionPrice}),\r\n ['Esitmated Workspace Retention Cost'] = size * iif({workspaceRetentionPeriod_estimate} <= 3, 0, ({workspaceRetentionPeriod_estimate} - 3)) * {RetentionPrice},\r\n IsBillable\r\n| order by Table asc",
"size": 0,
"title": "Tables Found in the {WorkspaceName} workspace",
"timeContextFromParameter": "timeRange",
"exportFieldName": "DataType",
"exportParameterName": "DataType",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Table Size",
"formatter": 0,
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Estimated Ingestion Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Esitmated Workspace Retention Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Estimated Data Archive Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
}
],
"sortBy": [
{
"itemKey": "IsBillable",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "IsBillable",
"sortOrder": 2
}
]
},
"conditionalVisibility": {
"parameterName": "ShowHiddenObjects",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "LAWTableQuery"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\",\"mergeType\":\"inner\",\"leftTable\":\"TableRetentionQuery\",\"rightTable\":\"LAWTableQuery\",\"leftColumn\":\"TableName\",\"rightColumn\":\"Table\"}],\"projectRename\":[{\"originalName\":\"[TableRetentionQuery].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableType\",\"mergedName\":\"TableType\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableInteractivePeriod\",\"mergedName\":\"InteractiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableArchivePeriod\",\"mergedName\":\"ArchiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TotalRetentionPeriod\",\"mergedName\":\"TotalRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].Table Size\",\"mergedName\":\"LAW Table Size\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].lastPlanModifiedDate\",\"mergedName\":\"lastPlanModifiedDate\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Is Archived\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"ArchiveRetention\",\"operator\":\">\",\"rightValType\":\"static\",\"rightVal\":\"0\",\"resultValType\":\"static\",\"resultVal\":\"Yes\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"No\"}}]},{\"originalName\":\"[LAWTableQuery].IsBillable\",\"mergedName\":\"IsBillable\",\"fromId\":\"unknown\"},{\"originalName\":\"[LAWTableQuery].DataType\"},{\"originalName\":\"[LAWTableQuery].Table\"},{\"originalName\":\"[LAWTableQuery].size\"},{\"originalName\":\"[LAWTableQuery].Estimated Data Archive Cost\"},{\"originalName\":\"[LAWTableQuery].Estimated Ingestion Cost\"},{\"originalName\":\"[LAWTableQuery].Esitmated Workspace Retention Cost\"}]}",
"size": 1,
"noDataMessage": "It appears your workspace doesn't currently have any tables that support Basic Plans or there are not any archived tables.",
"showRefreshButton": true,
"exportedParameters": [
{
"fieldName": "TableName",
"parameterName": "TableName",
"parameterType": 1
},
{
"fieldName": "TablePlan",
"parameterName": "TablePlan",
"parameterType": 1
},
{
"fieldName": "InteractiveRetention",
"parameterName": "InteractiveRetention",
"parameterType": 1
},
{
"fieldName": "ArchiveRetention",
"parameterName": "ArchiveRetention",
"parameterType": 1
},
{
"fieldName": "TotalRetention",
"parameterName": "TotalRetention",
"parameterType": 1
},
{
"parameterType": 1
}
],
"showExportToExcel": true,
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "35.2857ch"
}
},
{
"columnMatch": "TableType",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "15.8571ch"
}
},
{
"columnMatch": "TablePlan",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "15ch"
}
},
{
"columnMatch": "InteractiveRetention",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22.8571ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "ArchiveRetention",
"formatter": 4,
"formatOptions": {
"min": 0,
"max": 2556,
"palette": "blue",
"customColumnWidthSetting": "20.8571ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TotalRetention",
"formatter": 4,
"formatOptions": {
"min": 90,
"max": 2556,
"palette": "turquoise",
"compositeBarSettings": {
"labelText": "",
"columnSettings": [
{
"columnName": "Is Archived",
"color": "blue"
}
]
},
"customColumnWidthSetting": "18.2857ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "LAW Table Size",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "lastPlanModifiedDate",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "33.1429ch"
}
},
{
"columnMatch": "IsBillable",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "16ch"
}
},
{
"columnMatch": "TableInteractivePeriod",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "26.5714ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TableArchivePeriod",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "24ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TotalRetentionPeriod",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": ">",
"thresholdValue": "{workspaceRetention}",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": null,
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "23.4286ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Table Size",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Estimated Ingestion Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Esitmated Workspace Retention Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Estimated Data Archive Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "TableSize",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "SizeUnit",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "Last Updated Time",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
}
],
"rowLimit": 10000,
"filter": true,
"sortBy": [
{
"itemKey": "Is Archived",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "Is Archived",
"sortOrder": 2
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isNotEqualTo",
"value": "Basic"
},
"name": "query - 9 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\",\"mergeType\":\"leftouter\",\"leftTable\":\"TableRetentionQuery\",\"rightTable\":\"LAWTableQuery\",\"leftColumn\":\"TableName\",\"rightColumn\":\"Table\"}],\"projectRename\":[{\"originalName\":\"[TableRetentionQuery].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableType\",\"mergedName\":\"TableType\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableInteractivePeriod\",\"mergedName\":\"InteractiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableArchivePeriod\",\"mergedName\":\"ArchiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TotalRetentionPeriod\",\"mergedName\":\"TotalRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].Table Size\",\"mergedName\":\"LAW Table Size\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].lastPlanModifiedDate\",\"mergedName\":\"lastPlanModifiedDate\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Is Archived\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"ArchiveRetention\",\"operator\":\">\",\"rightValType\":\"static\",\"rightVal\":\"0\",\"resultValType\":\"static\",\"resultVal\":\"Yes\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"static\",\"resultVal\":\"No\"}}]},{\"originalName\":\"[LAWTableQuery].IsBillable\",\"mergedName\":\"IsBillable\",\"fromId\":\"unknown\"},{\"originalName\":\"[LAWTableQuery].DataType\"},{\"originalName\":\"[LAWTableQuery].Table\"},{\"originalName\":\"[LAWTableQuery].size\"},{\"originalName\":\"[LAWTableQuery].Estimated Data Archive Cost\"},{\"originalName\":\"[LAWTableQuery].Estimated Ingestion Cost\"},{\"originalName\":\"[LAWTableQuery].Esitmated Workspace Retention Cost\"}]}",
"size": 1,
"noDataMessage": "It appears your workspace doesn't currently have any tables that support Basic Plans or there are not any archived tables.",
"showRefreshButton": true,
"exportedParameters": [
{
"fieldName": "TableName",
"parameterName": "TableName",
"parameterType": 1
},
{
"fieldName": "TablePlan",
"parameterName": "TablePlan",
"parameterType": 1
},
{
"fieldName": "InteractiveRetention",
"parameterName": "InteractiveRetention",
"parameterType": 1
},
{
"fieldName": "ArchiveRetention",
"parameterName": "ArchiveRetention",
"parameterType": 1
},
{
"fieldName": "TotalRetention",
"parameterName": "TotalRetention",
"parameterType": 1
},
{
"parameterType": 1
}
],
"showExportToExcel": true,
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "35.2857ch"
}
},
{
"columnMatch": "TableType",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "15.8571ch"
}
},
{
"columnMatch": "TablePlan",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "15ch"
}
},
{
"columnMatch": "InteractiveRetention",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22.8571ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "ArchiveRetention",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20.8571ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TotalRetention",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": ">",
"thresholdValue": "{workspaceRetention}",
"representation": "yellow",
"text": "{0} {1}"
},
{
"operator": "Default",
"thresholdValue": null,
"text": "{0} {1}"
}
],
"customColumnWidthSetting": "18.2857ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "LAW Table Size",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "lastPlanModifiedDate",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "33.1429ch"
}
},
{
"columnMatch": "IsBillable",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "16ch"
}
},
{
"columnMatch": "TableInteractivePeriod",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "26.5714ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TableArchivePeriod",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "24ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TotalRetentionPeriod",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": ">",
"thresholdValue": "{workspaceRetention}",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": null,
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "23.4286ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Table Size",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Estimated Ingestion Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Esitmated Workspace Retention Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Estimated Data Archive Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "TableSize",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "SizeUnit",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "Last Updated Time",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
}
],
"rowLimit": 10000,
"filter": true
},
"sortBy": []
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "Basic"
},
"name": "AvailableBasicLogsTables"
}
],
"exportParameters": true
},
"conditionalVisibilities": [
{
"parameterName": "Tab",
"comparison": "isNotEqualTo",
"value": "Search"
},
{
"parameterName": "WorkspaceName",
"comparison": "isNotEqualTo"
},
{
"parameterName": "workspaceRetention",
"comparison": "isNotEqualTo"
},
{
"parameterName": "Tab",
"comparison": "isNotEqualTo",
"value": "Cost"
}
],
"name": "TableReport"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Data is based on the {timeRange:label}",
"loadType": "always",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"$.name\",\"columnid\":\"TableName\"},{\"path\":\"$.properties.schema.tableType\",\"columnid\":\"TableType\"},{\"path\":\"$.properties.plan\",\"columnid\":\"TablePlan\"},{\"path\":\"$.properties.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.properties.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.properties.lastPlanModifiedDate\",\"columnid\":\"lastPlanModifiedDate\",\"columnType\":\"datetime\"}]}}]}",
"size": 4,
"title": "Retention settings for All Tables",
"showRefreshButton": true,
"queryType": 12,
"visualization": "table",
"gridSettings": {
"sortBy": [
{
"itemKey": "TableInteractivePeriod",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "TableInteractivePeriod",
"sortOrder": 1
}
],
"tileSettings": {
"showBorder": false,
"titleContent": {
"columnMatch": "TablePlan",
"formatter": 1
},
"leftContent": {
"columnMatch": "TableInteractivePeriod",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
}
},
"conditionalVisibility": {
"parameterName": "ShowHiddenObjects",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "TableRetentionQuery"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(((@.properties.schema.tableSubType=='DataCollectionRuleBased' || @.properties.schema.name=='AppTraces' || @.properties.schema.name=='ContainerLog' || @.properties.schema.name=='ContainerLogV2') && @.properties.schema.tableType!='RestoredLogs' && @.properties.schema.tableType!='SearchResults'))]\",\"columns\":[{\"path\":\"$.name\",\"columnid\":\"TableName\"},{\"path\":\"$.properties.schema.tableType\",\"columnid\":\"TableType\"},{\"path\":\"$.properties.plan\",\"columnid\":\"TablePlan\"},{\"path\":\"$.properties.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.properties.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"},{\"path\":\"$.properties.lastPlanModifiedDate\",\"columnid\":\"lastPlanModifiedDate\",\"columnType\":\"datetime\"}]}}]}",
"size": 4,
"title": "Basic Log Tables",
"showRefreshButton": true,
"queryType": 12,
"visualization": "table",
"gridSettings": {
"sortBy": [
{
"itemKey": "TableInteractivePeriod",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "TableInteractivePeriod",
"sortOrder": 1
}
],
"tileSettings": {
"showBorder": false,
"titleContent": {
"columnMatch": "TablePlan",
"formatter": 1
},
"leftContent": {
"columnMatch": "TableInteractivePeriod",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
}
},
"conditionalVisibility": {
"parameterName": "ShowHiddenObjects",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "basicLogTables"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| summarize arg_max(TimeGenerated, *), size = sum(Quantity) / 1000 by DataType\r\n| project\r\n ['Table'] = DataType,\r\n ['Table Size'] = size,\r\n ['Estimated Workspace Retention Cost'] = size * iif({workspaceRetentionPeriod_estimate} <= 3, 0, ({workspaceRetentionPeriod_estimate} - 3)) * {RetentionPrice},\r\n IsBillable\r\n\t",
"size": 0,
"title": "Tables Found in the {WorkspaceName} workspace",
"timeContextFromParameter": "timeRange",
"exportFieldName": "DataType",
"exportParameterName": "DataType",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Table Size",
"formatter": 0,
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Estimated Ingestion Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Esitmated Workspace Retention Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Estimated Data Archive Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
}
]
},
"sortBy": []
},
"conditionalVisibility": {
"parameterName": "ShowHiddenObjects",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "LAWTableQuery"
},
{
"type": 1,
"content": {
"json": "The below table shows current Workspace Retention and Data Archive Cost Estimates. \r\n\r\nThese are only estimates and do not reflect current billed costs. You can use these for planning before enabling Data Archive\r\n\r\nUpdate the **Total Retention in Days** for estimate on Data Archiving. The TotalRetention column reflects the current settings. ",
"style": "upsell"
},
"name": "text - 4 - Copy"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "5f468f5e-5cce-42e1-b856-341bf97c0386",
"version": "KqlParameterItem/1.0",
"name": "totalRetentionInDays",
"label": "Total Retention in Days",
"type": 1,
"description": "Update for cost estimation",
"value": "100",
"timeContext": {
"durationMs": 86400000
}
}
],
"style": "above",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 6"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\",\"mergeType\":\"inner\",\"leftTable\":\"TableRetentionQuery\",\"rightTable\":\"LAWTableQuery\",\"leftColumn\":\"TableName\",\"rightColumn\":\"Table\"}],\"projectRename\":[{\"originalName\":\"[TableRetentionQuery].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableType\",\"mergedName\":\"TableType\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableInteractivePeriod\",\"mergedName\":\"InteractiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TableArchivePeriod\",\"mergedName\":\"ArchiveRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuery].TotalRetentionPeriod\",\"mergedName\":\"TotalRetention\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].Table Size\",\"mergedName\":\"LAW Table Size\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Estimated Data Archive Cost\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"expression\",\"resultVal\":\"[\\\"LAW Table Size\\\"] * ({totalRetentionInDays} / 30 )* {ArchivePrice}\"}}]},{\"originalName\":\"[Added column]\",\"mergedName\":\"Esitmated Workspace Retention Cost\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"InteractiveRetention\",\"operator\":\"<=\",\"rightValType\":\"static\",\"rightVal\":\"90\",\"resultValType\":\"static\",\"resultVal\":\"0.0\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"expression\",\"resultVal\":\"[\\\"LAW Table Size\\\"] * {RetentionPrice}\"}}]},{\"originalName\":\"[TableRetentionQuery].lastPlanModifiedDate\"},{\"originalName\":\"[LAWTableQuery].Table\"},{\"originalName\":\"[LAWTableQuery].Esitmated Workspace Retention Cost\"},{\"originalName\":\"[LAWTableQuery].Estimated Workspace Retention Cost\"},{\"originalName\":\"[LAWTableQuery].IsBillable\"}]}",
"size": 1,
"title": "Estimated Data Retention Costs - Planning for Data Archiving",
"noDataMessage": "It appears your workspace doesn't currently have any tables that support Basic Plans or there are not any archived tables.",
"showRefreshButton": true,
"exportedParameters": [
{
"fieldName": "TableName",
"parameterName": "TableName",
"parameterType": 1
},
{
"fieldName": "TablePlan",
"parameterName": "TablePlan",
"parameterType": 1
},
{
"fieldName": "InteractiveRetention",
"parameterName": "InteractiveRetention",
"parameterType": 1
},
{
"fieldName": "ArchiveRetention",
"parameterName": "ArchiveRetention",
"parameterType": 1
},
{
"fieldName": "TotalRetention",
"parameterName": "TotalRetention",
"parameterType": 1
},
{
"parameterType": 1
}
],
"showExportToExcel": true,
"queryType": 7,
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "35.2857ch"
}
},
{
"columnMatch": "TableType",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "15.8571ch"
}
},
{
"columnMatch": "TablePlan",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "15ch"
}
},
{
"columnMatch": "InteractiveRetention",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22.8571ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "ArchiveRetention",
"formatter": 4,
"formatOptions": {
"min": 0,
"max": 2556,
"palette": "blue",
"customColumnWidthSetting": "20.8571ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TotalRetention",
"formatter": 4,
"formatOptions": {
"min": 90,
"max": 2556,
"palette": "turquoise",
"customColumnWidthSetting": "18.2857ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal",
"useGrouping": true
}
}
},
{
"columnMatch": "LAW Table Size",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Estimated Data Archive Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Esitmated Workspace Retention Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "IsBillable",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "16ch"
}
},
{
"columnMatch": "Estimated Ingestion Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Estimated Basic Log Costs",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "lastPlanModifiedDate",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "33.1429ch"
}
},
{
"columnMatch": "TableInteractivePeriod",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "26.5714ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TableArchivePeriod",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "24ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TotalRetentionPeriod",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": ">",
"thresholdValue": "{workspaceRetention}",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": null,
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "23.4286ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Table Size",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TableSize",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "SizeUnit",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "Last Updated Time",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
}
],
"rowLimit": 10000,
"filter": true,
"sortBy": [
{
"itemKey": "$gen_number_LAW Table Size_6",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "$gen_number_LAW Table Size_6",
"sortOrder": 2
}
],
"tileSettings": {
"showBorder": false,
"titleContent": {
"columnMatch": "TableName",
"formatter": 1
},
"leftContent": {
"columnMatch": "LAW Table Size",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
},
"graphSettings": {
"type": 0,
"topContent": {
"columnMatch": "TableName",
"formatter": 1
},
"centerContent": {
"columnMatch": "LAW Table Size",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
},
"chartSettings": {
"yAxis": [
"Estimated Ingestion Cost"
],
"group": "TableType",
"createOtherGroup": null,
"showLegend": true,
"ySettings": {
"numberFormatSettings": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency",
"useGrouping": true
}
}
}
},
"mapSettings": {
"locInfo": "LatLong",
"sizeSettings": "LAW Table Size",
"sizeAggregation": "Sum",
"legendMetric": "LAW Table Size",
"legendAggregation": "Sum",
"itemColorSettings": {
"type": "heatmap",
"colorAggregation": "Sum",
"nodeColorField": "LAW Table Size",
"heatmapPalette": "greenRed"
}
}
},
"name": "query - 9 - Copy - Copy"
},
{
"type": 1,
"content": {
"json": "The below table shows current Analytics Plan Ingestion Cost Estimates. Use this table to estimate costs associated with enabling basic logs\r\n\r\nThese are only estimates and do not reflect current billed costs. ",
"style": "upsell"
},
"name": "text - 4"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\",\"mergeType\":\"leftouter\",\"leftTable\":\"basicLogTables\",\"rightTable\":\"LAWTableQuery\",\"leftColumn\":\"TableName\",\"rightColumn\":\"Table\"}],\"projectRename\":[{\"originalName\":\"[basicLogTables].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[basicLogTables].TableType\",\"mergedName\":\"TableType\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[basicLogTables].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[basicLogTables].TableInteractivePeriod\",\"mergedName\":\"TableInteractivePeriod\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[LAWTableQuery].Table Size\",\"mergedName\":\"LAW Table Size\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[Added column]\",\"mergedName\":\"Estimated Ingestion Cost\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"leftOperand\":\"IsBillable\",\"operator\":\"==\",\"rightValType\":\"static\",\"rightVal\":\"false\",\"resultValType\":\"expression\",\"resultVal\":\"0.0\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"expression\",\"resultVal\":\"[\\\"LAW Table Size\\\"] * {IngestionPrice}\"}}]},{\"originalName\":\"[Added column]\",\"mergedName\":\"Estimated Basic Logs Cost\",\"fromId\":null,\"isNewItem\":true,\"newItemData\":[{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"column\",\"resultValType\":\"expression\",\"resultVal\":\"[\\\"LAW Table Size\\\"] * {basiclogPrice}\"}}]},{\"originalName\":\"[LAWTableQuery].IsBillable\",\"mergedName\":\"IsBillable\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[basicLogTables].TableArchivePeriod\"},{\"originalName\":\"[basicLogTables].TotalRetentionPeriod\"},{\"originalName\":\"[basicLogTables].lastPlanModifiedDate\"},{\"originalName\":\"[LAWTableQuery].Table\"},{\"originalName\":\"[LAWTableQuery].Estimated Workspace Retention Cost\"}]}",
"size": 1,
"title": "Estimated Data Ingestion Costs - Planning for Basic Logs",
"noDataMessage": "It appears your workspace doesn't currently have any tables that support Basic Plans or there are not any archived tables.",
"showRefreshButton": true,
"exportedParameters": [
{
"fieldName": "TableName",
"parameterName": "TableName",
"parameterType": 1
},
{
"fieldName": "TablePlan",
"parameterName": "TablePlan",
"parameterType": 1
},
{
"fieldName": "InteractiveRetention",
"parameterName": "InteractiveRetention",
"parameterType": 1
},
{
"fieldName": "ArchiveRetention",
"parameterName": "ArchiveRetention",
"parameterType": 1
},
{
"fieldName": "TotalRetention",
"parameterName": "TotalRetention",
"parameterType": 1
},
{
"parameterType": 1
}
],
"showExportToExcel": true,
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "35.2857ch"
}
},
{
"columnMatch": "TableType",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "15.8571ch"
}
},
{
"columnMatch": "TablePlan",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "15ch"
}
},
{
"columnMatch": "TableInteractivePeriod",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "26.5714ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "LAW Table Size",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "IsBillable",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "16ch"
}
},
{
"columnMatch": "Estimated Ingestion Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Estimated Basic Logs Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "InteractiveRetention",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22.8571ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "ArchiveRetention",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20.8571ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TotalRetention",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": ">",
"thresholdValue": "{workspaceRetention}",
"representation": "yellow",
"text": "{0} {1}"
},
{
"operator": "Default",
"thresholdValue": null,
"text": "{0} {1}"
}
],
"customColumnWidthSetting": "18.2857ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Esitmated Workspace Retention Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Estimated Basic Log Costs",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "lastPlanModifiedDate",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "33.1429ch"
}
},
{
"columnMatch": "TableArchivePeriod",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "24ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TotalRetentionPeriod",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": ">",
"thresholdValue": "{workspaceRetention}",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": null,
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "23.4286ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Table Size",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Estimated Data Archive Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "TableSize",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "SizeUnit",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "Last Updated Time",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
}
],
"rowLimit": 10000,
"filter": true
},
"sortBy": []
},
"name": "query - 9 - Copy"
}
],
"exportParameters": true
},
"conditionalVisibilities": [
{
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "Cost"
},
{
"parameterName": "WorkspaceName",
"comparison": "isNotEqualTo"
},
{
"parameterName": "workspaceRetention",
"comparison": "isNotEqualTo"
}
],
"name": "CostAnalysis"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":\"{\\r\\n\\t\\\"properties\\\":{\\r\\n\\t\\t\\\"retentionInDays\\\": 180,\\r\\n\\t\\t\\\"totalRetentionInDays\\\": 200 \\r\\n\\t}\\r\\n}\",\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{TableName}\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-12-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties\",\"columns\":[{\"path\":\"$.schema.name\",\"columnid\":\"Name\"},{\"path\":\"$.plan\",\"columnid\":\"TablePlan\"},{\"path\":\"$.retentionInDays\",\"columnid\":\"InteractiveRetentionPeriod\"},{\"path\":\"$.archiveRetentionInDays\",\"columnid\":\"ArchiveRetentionPeriod\"},{\"path\":\"$.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"}]}}]}",
"size": 4,
"title": "Retention for the {TableName} Table in Days",
"showRefreshButton": true,
"queryType": 12,
"sortBy": []
},
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isNotEqualTo"
},
"name": "archiveTableQuery"
},
{
"type": 1,
"content": {
"json": "You are about to modify the settings of the **{TableName}** table to enable **Archive Logs**.\r\n\r\nThis will modify the **{TableName}** table with a different retention period from the default workspace retention period of {workspaceRetention} days up to 7 years (2,555 days)\r\n\r\n> **Note:** Tables will inherit the retention of workspace unless changed. \r\n- If a retention is set on a table and the workspace retention is changed, the table retention will not be affected. \r\n- To **reset** the table retention to the workspace retention, select the **Reset Retention** button\r\n- You can access archived data by running a **search job** or **restoring archived logs**\r\n- You can set the workspace default retention policy in the Azure portal to 30, 31, 60, 90, 120, 180, 270, 365, 550, and 730 days. \r\n",
"style": "warning"
},
"customWidth": "50",
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isNotEqualTo"
},
"name": "text - 5"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "ca66bbc0-8300-419d-9baf-2add3c5f2c37",
"version": "KqlParameterItem/1.0",
"name": "totalRetentionInDays",
"label": "Total Retention in Days",
"type": 1,
"description": "The table's total data retention including archive period. Set this property to null if you don't want to archive data.",
"isRequired": true,
"value": "255",
"typeSettings": {
"paramValidationRules": [
{
"regExp": "^([1-9]|[1-9][0-9]{1,2}|1[0-9]{3}|2[0-4][0-9]{2}|25[0-4][0-9]|255[0-5])$",
"match": true,
"message": "Specify the number of days between 1 and 2556"
}
]
},
"timeContext": {
"durationMs": 86400000
}
}
],
"style": "formVertical",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isNotEqualTo"
},
"name": "parameters - 7",
"styleSettings": {
"margin": "0px",
"padding": "0px"
}
},
{
"type": 1,
"content": {
"json": "\r\nSee the below table on estimated costs\r\n\r\n- Updating the Total Retention in Days will automatically update estimated costs. \r\n- Ensure you have updated your the price paramaters for an accurate estimate. \r\n- Leverage the Show Help selector for more informaiton. \r\n",
"style": "upsell"
},
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isNotEqualTo"
},
"name": "text - 5 - Copy"
}
],
"exportParameters": true
},
"customWidth": "25",
"name": "group - 6",
"styleSettings": {
"margin": "7px"
}
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "d0307859-0760-4b9a-972f-297a5be4efda",
"linkTarget": "ArmAction",
"linkLabel": "Update Retention",
"postText": "",
"style": "primary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{TableName}",
"headers": [],
"params": [
{
"key": "api-version",
"value": "2021-12-01-preview"
}
],
"body": "{\r\n\t\"properties\":{\r\n\t\t\"retentionInDays\": null,\r\n\t\t\"totalRetentionInDays\": \"{totalRetentionInDays}\"\r\n\t}\r\n}",
"httpMethod": "PATCH",
"title": "Caution",
"description": "## ARM actions can potentially modify resources.\n\n You are updating the **{TableName}** table to the Archive tier with a total retention period of **{totalRetentionInDays} days** \n\nThe current table retention period is set to:\n\n- InteractiveRetention: {InteractiveRetention}\n- ArchiveRetention: {ArchiveRetention}\n- TotalRetention: {TotalRetention}",
"actionName": "Update Table Retention Settings",
"runLabel": "Update Retention"
}
},
{
"id": "4a94621f-22d3-4330-8340-5624503fd3ea",
"linkTarget": "ArmAction",
"linkLabel": "Reset Retention",
"style": "secondary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{TableName}",
"headers": [],
"params": [
{
"key": "api-version",
"value": "2021-12-01-preview"
}
],
"body": "{\r\n \"properties\": {\r\n \"retentionInDays\": -1,\r\n \"totalRetentionInDays\": -1\r\n }\r\n}",
"httpMethod": "PATCH",
"title": "Caution",
"description": "## ARM actions can potentially modify resources.\n\n You are reseting the **{TableName}** table to the workspace default retention period pf {InteractiveRetention} days \n\nThe current table retention period is set to:\n\n- InteractiveRetention: {InteractiveRetention}\n- ArchiveRetention: {ArchiveRetention}\n- TotalRetention: {TotalRetention}",
"actionName": "Update Table Retention Settings",
"runLabel": "Reset Retention"
}
}
]
},
"customWidth": "25",
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isNotEqualTo"
},
"name": "links - 4",
"styleSettings": {
"margin": "0px",
"padding": "21px"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| summarize arg_max(TimeGenerated, *), size = sum(Quantity) / 1000 by DataType\r\n| where DataType == \"{TableName}\"\r\n| extend plan = \"{TablePlan}\"\r\n| project\r\n ['Table'] = DataType,\r\n ['Table Plan'] = plan,\r\n ['Table Size'] = size,\r\n ['Estimated Ingestion Cost'] = case(plan == \"Basic\", size * {basiclogPrice}, size * iif(IsBillable == false, 0.0, {IngestionPrice})),\r\n ['Estimated Workspace Retention Cost'] = size * iif({workspaceRetentionPeriod_estimate} <= 3, 0, ({workspaceRetentionPeriod_estimate} - 3)) * {RetentionPrice},\r\n ['Estimated Data Archive Cost'] = size * (round(todouble((todouble({totalRetentionInDays})) / 30), 2)) * {ArchivePrice},\r\n IsBillable",
"size": 4,
"title": "Estimated Monthly Costs",
"timeContext": {
"durationMs": 2592000000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Table Size",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "18ch"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Estimated Ingestion Cost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "30ch"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
},
"tooltipFormat": {
"tooltip": "Estimated Ingestion Costs reflect the current Table Plan"
}
},
{
"columnMatch": "Estimated Workspace Retention Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Estimated Data Archive Cost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "33ch"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Esitmated Workspace Retention Cost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "38.5714ch"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
}
]
},
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Table",
"formatter": 1
},
"leftContent": {
"columnMatch": "Estimated Data Archive Cost",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Esitmated Workspace Retention Cost",
"formatter": 12,
"formatOptions": {
"palette": "blue"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
"showBorder": false,
"size": "full"
}
},
"name": "archiveTableEstimatedCosts"
}
]
},
"conditionalVisibilities": [
{
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "Archive"
},
{
"parameterName": "TableName",
"comparison": "isNotEqualTo"
}
],
"name": "Archive"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{TableName}?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.properties\",\"columns\":[{\"path\":\"$.schema.name\",\"columnid\":\"Name\"},{\"path\":\"$.plan\",\"columnid\":\"TablePlan\"},{\"path\":\"$.retentionInDays\",\"columnid\":\"InteractiveRetentionPeriod\"},{\"path\":\"$.totalRetentionInDays\",\"columnid\":\"ArchiveRetentionPeriod\"},{\"path\":\"$.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"}]}}]}",
"size": 4,
"title": "Select the Table Below to Update Plan Settings",
"noDataMessage": "Select a Table From the Above Grid",
"showRefreshButton": true,
"exportedParameters": [
{
"fieldName": "TablePlan",
"parameterName": "TablePlan",
"parameterType": 1
},
{
"fieldName": "TableInteractivePeriod",
"parameterName": "TableInteractivePeriod",
"parameterType": 1
}
],
"showExportToExcel": true,
"queryType": 12,
"visualization": "table",
"gridSettings": {
"sortBy": [
{
"itemKey": "TablePlan",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "TablePlan",
"sortOrder": 1
}
],
"tileSettings": {
"showBorder": false,
"titleContent": {
"columnMatch": "TablePlan",
"formatter": 1
},
"leftContent": {
"columnMatch": "TableInteractivePeriod",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "70",
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isNotEqualTo"
},
"showPin": false,
"name": "query - 7"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "\r\nYou are about to modify the settings of the **{TableName}** table to enable **Basic Logs**. This will modify the **{TableName}** table with a fixed retention of **8 days**.\r\n\r\nThe following Sentinel functionality will also be limited\r\n- Table retention fixed at 8 days\r\n- Alerts are not supported\r\n- Limited KQL language support\r\n\r\n> **Note:** The Table Plan can only be changed once per week\r\n\r\n[More Information on Basic Logs](https://docs.microsoft.com/azure/azure-monitor/logs/log-analytics-workspace-overview?WT.mc_id=modinfra-0000-rotrent#log-data-plans-preview)\r\n",
"style": "warning"
},
"customWidth": "50",
"name": "text - 5"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "d0307859-0760-4b9a-972f-297a5be4efda",
"linkTarget": "ArmAction",
"linkLabel": "Enable Basic Logs",
"style": "primary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{WorkspaceName}/tables/{TableName}",
"headers": [],
"params": [
{
"key": "api-version",
"value": "2021-12-01-preview"
}
],
"body": "{\r\n \"properties\": {\r\n \"plan\": \"Basic\"\r\n }\r\n}",
"httpMethod": "PATCH",
"title": "Caution",
"description": "## ARM actions can potentially modify resources.\n\n You are updating the **{TableName}** table to Basic Logs with a fixed retention period of **8 days** \n\nThe current table retention period is set to:\n\n- InteractiveRetention: {InteractiveRetention}\n- ArchiveRetention: {ArchiveRetention}\n- TotalRetention: {TotalRetention}\n\nThe Following Limitations Also Apply:\n- Alerts are not supported\n- Limited KQL language support",
"runLabel": "Update Plan"
}
}
]
},
"customWidth": "25",
"name": "links - 4",
"styleSettings": {
"margin": "5 px",
"padding": "0"
}
}
]
},
"conditionalVisibility": {
"parameterName": "TablePlan",
"comparison": "isEqualTo",
"value": "Analytics"
},
"name": "Enable Basic Logs"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "\r\nYou are about to modify the settings of the **{TableName}** table to enable **Analytics Logs**. This will modify the **{TableName}** table retention period to the workspace retention period \r\n\r\n> **Note:** The Table Plan can only be changed once per week\r\n\r\n[More Information on Analytics Logs](https://docs.microsoft.com/azure/azure-monitor/logs/log-analytics-workspace-overview?WT.mc_id=modinfra-0000-rotrent#log-data-plans-preview)",
"style": "warning"
},
"customWidth": "50",
"name": "text - 5"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "d0307859-0760-4b9a-972f-297a5be4efda",
"linkTarget": "ArmAction",
"linkLabel": "Disable Basic Logs",
"style": "primary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{WorkspaceName}/tables/{TableName}",
"headers": [],
"params": [
{
"key": "api-version",
"value": "2021-12-01-preview"
}
],
"body": "{\r\n \"properties\": {\r\n \"plan\": \"Analytics\"\r\n }\r\n}",
"httpMethod": "PATCH",
"title": "Caution",
"description": "## ARM actions can potentially modify resources.\n\n You are updating the **{TableName}** table to Analytics Logs with a total retention period of **{TotalRetention} days** \n\nThe current table retention period is set to:\n\n- InteractiveRetention: {InteractiveRetention}\n- ArchiveRetention: {ArchiveRetention}\n- TotalRetention: {TotalRetention}",
"runLabel": "Update Plan"
}
}
]
},
"customWidth": "25",
"name": "links - 4",
"styleSettings": {
"margin": "5 px",
"padding": "0"
}
}
]
},
"conditionalVisibility": {
"parameterName": "TablePlan",
"comparison": "isEqualTo",
"value": "Basic"
},
"name": "Enable Analytics Logs"
},
{
"type": 1,
"content": {
"json": "It appears your workspace doesn't currently have any tables that support Basic Plans or You have not selected a table above.\r\n\r\nFor more information on what tables support Basic Logs please refer to:\r\n\r\n[Which tables support Basic Logs?](https://docs.microsoft.com/azure/azure-monitor/logs/basic-logs-configure?tabs=api-1%2Cportal-1#which-tables-support-basic-logs)",
"style": "warning"
},
"conditionalVisibilities": [
{
"parameterName": "TableName",
"comparison": "isEqualTo"
},
{
"parameterName": "TablePlan",
"comparison": "isEqualTo"
}
],
"name": "text - 3"
},
{
"type": 1,
"content": {
"json": "\r\nSee the below table on estimated costs \r\n- Ensure you have updated your the price paramaters for an accurate estimate. \r\n- Leverage the Show Help selector for more informaiton. \r\n",
"style": "upsell"
},
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isNotEqualTo"
},
"name": "text - 5 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| summarize arg_max(TimeGenerated, *), size = sum(Quantity) / 1000 by DataType\r\n| where DataType == \"{TableName}\"\r\n| extend plan = \"{TablePlan}\"\r\n| project\r\n ['Table'] = DataType,\r\n ['Table Plan'] = plan,\r\n ['Table Size'] = size,\r\n ['Estimated Ingestion Cost'] = size * iif(IsBillable = false, 0.0, {IngestionPrice}),\r\n ['Estimated Basic Logs Cost'] = size * {basiclogPrice},\r\n IsBillable",
"size": 4,
"title": "Estimated Monthly Costs",
"noDataMessage": "The query didn't return any results. The table may not have any billed data yet.",
"timeContext": {
"durationMs": 2592000000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Table Size",
"formatter": 0,
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Estimated Ingestion Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
},
"tooltipFormat": {
"tooltip": "Reflects the Analytics Plan Estimated Costs"
}
},
{
"columnMatch": "Estimated Basic Logs Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Esitmated Workspace Retention Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Estimated Data Archive Cost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
}
]
},
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Table",
"formatter": 1
},
"leftContent": {
"columnMatch": "Estimated Data Archive Cost",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Esitmated Workspace Retention Cost",
"formatter": 12,
"formatOptions": {
"palette": "blue"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
"showBorder": false,
"size": "full"
}
},
"conditionalVisibility": {
"parameterName": "TableName",
"comparison": "isNotEqualTo"
},
"name": "query - 4 - Copy"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "Basic"
},
"name": "Basic"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"loadType": "always",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.schema.tableType==\\\"SearchResults\\\" || @.properties.schema.tableType==\\\"RestoredLogs\\\")]\",\"columns\":[{\"path\":\"$.name\",\"columnid\":\"TableName\"},{\"path\":\"$.properties.schema.tableType\",\"columnid\":\"TableType\"},{\"path\":\"$.properties.plan\",\"columnid\":\"TablePlan\"},{\"path\":\"$.properties.retentionInDays\",\"columnid\":\"TableInteractivePeriod\"},{\"path\":\"$.properties.archiveRetentionInDays\",\"columnid\":\"TableArchivePeriod\"},{\"path\":\"$.properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionPeriod\"}]}}]}",
"size": 4,
"title": "Retention settings for All Tables",
"showRefreshButton": true,
"queryType": 12,
"visualization": "table",
"gridSettings": {
"sortBy": [
{
"itemKey": "TableType",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "TableType",
"sortOrder": 1
}
],
"tileSettings": {
"showBorder": false,
"titleContent": {
"columnMatch": "TablePlan",
"formatter": 1
},
"leftContent": {
"columnMatch": "TableInteractivePeriod",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
}
},
"conditionalVisibility": {
"parameterName": "ShowHiddenObjects",
"comparison": "isEqualTo",
"value": "Yes"
},
"showPin": false,
"name": "TableRetentionQuerySearch"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/metadata?api-version=2017-10-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.tables[?(@.tableType==\\\"SearchResults\\\" || @.tableType==\\\"RestoredLogs\\\")]\",\"columns\":[]}}]}",
"size": 4,
"title": "searchandrestoretables_meta",
"showRefreshButton": true,
"queryType": 12,
"visualization": "table",
"sortBy": [],
"tileSettings": {
"showBorder": false,
"titleContent": {
"columnMatch": "TablePlan",
"formatter": 1
},
"leftContent": {
"columnMatch": "TableInteractivePeriod",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
}
},
"conditionalVisibility": {
"parameterName": "ShowHiddenObjects",
"comparison": "isEqualTo",
"value": "Yes"
},
"showPin": false,
"name": "searchandrestoretables_meta"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\",\"mergeType\":\"leftouter\",\"leftTable\":\"searchandrestoretables_meta\",\"rightTable\":\"TableRetentionQuerySearch\",\"leftColumn\":\"name\",\"rightColumn\":\"TableName\"}],\"projectRename\":[{\"originalName\":\"[searchandrestoretables_meta].name\",\"mergedName\":\"TableName\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[searchandrestoretables_meta].tableType\",\"mergedName\":\"TableType\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuerySearch].TablePlan\",\"mergedName\":\"TablePlan\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuerySearch].TableInteractivePeriod\",\"mergedName\":\"InteractiveRetentionPeriod\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuerySearch].TableArchivePeriod\",\"mergedName\":\"ArchiveRetentionPeriod\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[TableRetentionQuerySearch].TotalRetentionPeriod\",\"mergedName\":\"TotalRetentionPeriod\",\"fromId\":\"e3a3f78c-f05b-458f-85ec-2bc8e5821101\"},{\"originalName\":\"[searchandrestoretables_meta].id\"},{\"originalName\":\"[searchandrestoretables_meta].timespanColumn\"},{\"originalName\":\"[TableRetentionQuerySearch].TableName\"},{\"originalName\":\"[searchandrestoretables_meta].columns\"},{\"originalName\":\"[TableRetentionQuerySearch].TableType\"}]}",
"size": 1,
"title": "Select a Search or Restore Table to Update Settings",
"showRefreshButton": true,
"exportedParameters": [
{
"fieldName": "TableName",
"parameterName": "srchrstTableName",
"parameterType": 1
},
{
"fieldName": "TablePlan",
"parameterName": "srchrstTablePlan",
"parameterType": 1
},
{
"fieldName": "ArchiveRetentionPeriod",
"parameterName": "srchrstArchiveRetentionPeriod",
"parameterType": 1
},
{
"fieldName": "TotalRetentionPeriod",
"parameterName": "srchrstTotalRetentionPeriod",
"parameterType": 1
},
{
"fieldName": "InteractiveRetentionPeriod",
"parameterName": "srchrstInteractiveRetentionPeriod",
"parameterType": 1
}
],
"showExportToExcel": true,
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "38.5714ch"
}
},
{
"columnMatch": "TableType",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "23.5714ch"
}
},
{
"columnMatch": "TablePlan",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "InteractiveRetentionPeriod",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "23.1429ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "ArchiveRetentionPeriod",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "21.5714ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TotalRetentionPeriod",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": ">",
"thresholdValue": "{workspaceRetention}",
"representation": "yellow",
"text": "{0} {1}"
},
{
"operator": "Default",
"thresholdValue": null,
"text": "{0} {1}"
}
],
"customColumnWidthSetting": "22.5714ch"
},
"numberFormat": {
"unit": 27,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TableSize",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "15ch"
}
},
{
"columnMatch": "SizeUnit",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "InteractiveRetention",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22.8571ch"
}
},
{
"columnMatch": "ArchiveRetention",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20.8571ch"
}
},
{
"columnMatch": "TotalRetention",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "18.2857ch"
}
},
{
"columnMatch": "Last Updated Time",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
}
],
"rowLimit": 10000,
"filter": true,
"labelSettings": [
{
"columnId": "InteractiveRetentionPeriod",
"label": "InteractiveRetention"
},
{
"columnId": "ArchiveRetentionPeriod",
"label": "ArchiveRetention"
},
{
"columnId": "TotalRetentionPeriod",
"label": "TotalRetention"
}
]
},
"sortBy": []
},
"name": "query - 9 - Copy - Copy"
},
{
"type": 1,
"content": {
"json": "You are about to modify the settings of the **{srchrstTableName}** table\r\n\r\nThis will modify the **{srchrstTableName}** table with a different retention period from the default workspace retention period of {workspaceRetention} days up to 7 years (2,555 days)\r\n\r\n> **Note:** Tables will inherit the retention of workspace unless changed. \r\n- If a retention is set on a table and the workspace retention is changed, the table retention will not be affected. \r\n- To **reset** the table retention to the workspace retention, select the **Reset Retention** button\r\n- To **delete** the table, select the **Delete Table** button\r\n- You can access archived data by running a **search job** or **restoring archived logs**\r\n- You can set the workspace default retention policy in the Azure portal to 30, 31, 60, 90, 120, 180, 270, 365, 550, and 730 days. \r\n",
"style": "warning"
},
"customWidth": "50",
"conditionalVisibility": {
"parameterName": "srchrstTableName",
"comparison": "isNotEqualTo"
},
"name": "text - 5 - Copy"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "7ecd7de7-8165-46aa-81da-5be9f30b6d4f",
"version": "KqlParameterItem/1.0",
"name": "totalRetentionInDays",
"label": "Total Retention in Days",
"type": 1,
"description": "The table's total data retention including archive period. Set this property to null if you don't want to archive data.",
"isRequired": true,
"value": "100",
"typeSettings": {
"paramValidationRules": [
{
"regExp": "^([1-9]|[1-9][0-9]{1,2}|1[0-9]{3}|2[0-4][0-9]{2}|25[0-4][0-9]|255[0-5])$",
"match": true,
"message": "Specify the number of days between 1 and 2556"
}
]
},
"timeContext": {
"durationMs": 86400000
}
}
],
"style": "formVertical",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 7 - Copy",
"styleSettings": {
"margin": "0px",
"padding": "0px"
}
},
{
"type": 1,
"content": {
"json": "\r\nSee the below table on estimated costs\r\n\r\n- Updating the Total Retention in Days will automatically update estimated costs. \r\n- Ensure you have updated your the price paramaters for an accurate estimate. \r\n- Leverage the Show Help selector for more informaiton. \r\n",
"style": "upsell"
},
"name": "text - 5 - Copy - Copy"
}
],
"exportParameters": true
},
"customWidth": "25",
"conditionalVisibility": {
"parameterName": "srchrstTableName",
"comparison": "isNotEqualTo"
},
"name": "group - 8",
"styleSettings": {
"margin": "10px"
}
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "8e557d7d-8f49-4ffb-93b6-71f7b8a719bc",
"linkTarget": "ArmAction",
"linkLabel": "Update Retention",
"postText": "",
"style": "primary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{srchrstTableName}",
"headers": [],
"params": [
{
"key": "api-version",
"value": "2021-12-01-preview"
}
],
"body": "{\r\n\t\"properties\":{\r\n\t\t\"retentionInDays\": null,\r\n\t\t\"totalRetentionInDays\": \"{totalRetentionInDays}\"\r\n\t}\r\n}",
"httpMethod": "PATCH",
"title": "Caution",
"description": "## ARM actions can potentially modify resources.\n\n You are updating the **{srchrstTableName}** table to the Archive tier with a total retention period of **{totalRetentionInDays} days** \n\nThe current table retention period is set to:\n\n- InteractiveRetention: {srchrstInteractiveRetentionPeriod}\n- ArchiveRetention: {srchrstArchiveRetentionPeriod}\n- TotalRetention: {srchrstTotalRetentionPeriod}",
"actionName": "Update Table Retention Settings",
"runLabel": "Update Retention"
}
},
{
"id": "e8619397-15ff-4dae-b15a-48ee2d15f3a8",
"linkTarget": "ArmAction",
"linkLabel": "Reset Retention",
"style": "secondary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{srchrstTableName}",
"headers": [],
"params": [
{
"key": "api-version",
"value": "2021-12-01-preview"
}
],
"body": "{\r\n \"properties\": {\r\n \"retentionInDays\": -1,\r\n \"totalRetentionInDays\": -1\r\n }\r\n}",
"httpMethod": "PATCH",
"title": "Caution",
"description": "## ARM actions can potentially modify resources.\n\n You are reseting the **{srchrstTableName}** table to the workspace default retention period of {srchrstInteractiveRetentionPeriod} days \n\nThe current table retention period is set to:\n\n- InteractiveRetention: {srchrstInteractiveRetentionPeriod}\n- ArchiveRetention: {srchrstArchiveRetentionPeriod}\n- TotalRetention: {srchrstTotalRetentionPeriod}",
"actionName": "Update Table Retention Settings",
"runLabel": "Reset Retention"
}
},
{
"id": "aa1cea45-d8aa-460c-91ce-585b569e62ed",
"linkTarget": "ArmAction",
"linkLabel": "Delete Table",
"style": "secondary",
"linkIsContextBlade": true,
"armActionContext": {
"path": "{Subscription}/resourcegroups/{resourceGroup}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}/tables/{srchrstTableName}",
"headers": [],
"params": [
{
"key": "api-version",
"value": "2021-12-01-preview"
}
],
"httpMethod": "DELETE",
"title": "Warning",
"description": "\n## Delete Table Operation\n\nThis operation will **DELETE** the following table:\n\n **{srchrstTableName}**\n\nThis action **CANNOT** be undone\n\nThe current table retention period is set to:\n\n- InteractiveRetention: {srchrstInteractiveRetentionPeriod}\n- ArchiveRetention: {srchrstArchiveRetentionPeriod}\n- TotalRetention: {srchrstTotalRetentionPeriod}",
"actionName": "Table Delete Operation",
"runLabel": "Delete Table"
}
}
]
},
"customWidth": "25",
"conditionalVisibility": {
"parameterName": "srchrstTableName",
"comparison": "isNotEqualTo"
},
"name": "links - 4 - Copy",
"styleSettings": {
"margin": "0px",
"padding": "21px"
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{srchrstTableName}\r\n| where TimeGenerated >= ago({workspaceRetention}d)\r\n| summarize arg_max(TimeGenerated, *), size = sum(_BilledSize) by Type\r\n| extend plan = \"{srchrstTablePlan}\"\r\n| project \r\n ['Table'] = Type, \r\n ['Table Plan'] = plan,\r\n ['Table Size'] = size,\r\n ['Estimated Workspace Retention Cost'] = (size/(1000*1000*1000)) * iif({workspaceRetentionPeriod_estimate} <= 3, 0, ({workspaceRetentionPeriod_estimate} - 3)) * {RetentionPrice},\r\n ['Estimated Data Archive Cost'] = (size/(1000*1000*1000)) * (round(todouble((todouble({totalRetentionInDays})) / 30), 2)) * {ArchivePrice},\r\n ['IsBillable'] = _IsBillable ",
"size": 4,
"title": "Estimated Monthly Costs",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Table Size",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "18ch"
},
"numberFormat": {
"unit": 36,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Esitmated Workspace Retention Cost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "38.5714ch"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Estimated Data Archive Cost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "33ch"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
{
"columnMatch": "Estimated Ingestion Cost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "30ch"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
},
"tooltipFormat": {
"tooltip": "Estimated Ingestion Costs reflect the current Table Plan"
}
}
]
},
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Table",
"formatter": 1
},
"leftContent": {
"columnMatch": "Estimated Data Archive Cost",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Esitmated Workspace Retention Cost",
"formatter": 12,
"formatOptions": {
"palette": "blue"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency"
}
}
},
"showBorder": false,
"size": "full"
}
},
"conditionalVisibility": {
"parameterName": "srchrstTableName",
"comparison": "isNotEqualTo"
},
"name": "archiveTableEstimatedCosts - Copy"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "Search"
},
"name": "Search"
}
],
"fallbackResourceIds": [],
"fromTemplateId": "sentinel-ArchivingBasicLogsRetention",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}