1#@!#!123s

: / usr / share / grafana / public / app / plugins / datasource / azuremonitor / dashboards /
Filename : adx.json
back
{
  "__requires": [
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "7.4.3"
    },
    {
      "type": "datasource",
      "id": "grafana-azure-monitor-datasource",
      "name": "Azure Monitor",
      "version": "0.3.0"
    },
    {
      "type": "panel",
      "id": "graph",
      "name": "Graph",
      "version": ""
    },
    {
      "type": "panel",
      "id": "stat",
      "name": "Stat",
      "version": ""
    },
    {
      "type": "panel",
      "id": "table",
      "name": "Table",
      "version": ""
    }
  ],
  "editable": true,
  "gnetId": null,
  "graphTooltip": 0,
  "id": null,
  "iteration": 1622241391232,
  "links": [],
  "panels": [
    {
      "collapsed": false,
      "datasource": "$ds",
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 6,
      "panels": [],
      "title": "Overview",
      "type": "row"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 0,
        "y": 1
      },
      "id": 4,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": ["lastNotNull"],
          "fields": "",
          "values": false
        },
        "text": {},
        "textMode": "auto"
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "KeepAlive",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Keep Alive (Avg)",
      "type": "stat"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 3,
        "y": 1
      },
      "id": 12,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": ["lastNotNull"],
          "fields": "",
          "values": false
        },
        "text": {},
        "textMode": "auto"
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "CPU",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "CPU (Avg)",
      "type": "stat"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 6,
        "y": 1
      },
      "id": 13,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": ["lastNotNull"],
          "fields": "",
          "values": false
        },
        "text": {},
        "textMode": "auto"
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "IngestionUtilization",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Ingestion Utilization (Avg)  ",
      "type": "stat"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 9,
        "y": 1
      },
      "id": 14,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": ["lastNotNull"],
          "fields": "",
          "values": false
        },
        "text": {},
        "textMode": "auto"
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "IngestionLatencyInSeconds",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Ingestion Latency (Avg)  ",
      "type": "stat"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 12,
        "y": 1
      },
      "id": 15,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": ["lastNotNull"],
          "fields": "",
          "values": false
        },
        "text": {},
        "textMode": "auto"
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "CacheUtilization",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Cache Utilization (Avg)",
      "type": "stat"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 15,
        "y": 1
      },
      "id": 16,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": ["lastNotNull"],
          "fields": "",
          "values": false
        },
        "text": {},
        "textMode": "auto"
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Total"],
            "aggregation": "Total",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Status",
                "value": "IngestionResultDetails"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "IngestionResult",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Succeeded Ingestions (#)",
      "type": "stat"
    },
    {
      "datasource": "$ds",
      "description": "The aggregated usage in the cluster, out of the total used CPU and memory. To see more details, go to the Usage tab.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 9,
        "w": 12,
        "x": 0,
        "y": 6
      },
      "id": 17,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is KustoRunner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand \r\n    | where TimeGenerated > datetime(2020-09-09T09:30:00Z) \r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak) \r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State, FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest'\r\n    //| where totimespan(TotalCPU) > totimespan(0)\r\n    | summarize TotalCPU=max(TotalCPU) \r\n        , MemoryPeak=max(MemoryPeak)\r\n        by User, ApplicationName, CorrelationId \r\n;\r\nlet totalCPU = toscalar(dataset\r\n    | summarize sum((totimespan(TotalCPU) / 1s)));\r\nlet totalMemory = toscalar(dataset\r\n    | summarize sum(MemoryPeak));\r\nlet topMemory = \r\n    dataset\r\n    | top-nested 10000 of User with others=\"Others\" by sum(MemoryPeak), top-nested 10000 of ApplicationName with others=\"Others\" by sum(MemoryPeak)\r\n    | extend PercentOfTotalClusterMemoryUsed = aggregated_ApplicationName / toreal(totalMemory)\r\n;\r\nlet topCpu = \r\n    dataset\r\n    | top-nested 10000 of User with others=\"Others\" by sum(totimespan(TotalCPU) / 1s), top-nested 10000 of ApplicationName with others=\"Others\" by sum(totimespan(TotalCPU) / 1s)\r\n    | extend PercentOfTotalClusterCpuUsed = aggregated_ApplicationName / toreal(totalCPU)\r\n;\r\ntopMemory\r\n| join kind = fullouter(topCpu) on User, ApplicationName\r\n| extend BothPercentages = PercentOfTotalClusterMemoryUsed + PercentOfTotalClusterCpuUsed\r\n| top 10 by BothPercentages desc\r\n| extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n    ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n    User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n    User)\r\n| extend PercentOfTotalClusterMemoryUsed_display = iff(isnan(PercentOfTotalClusterMemoryUsed * 100), toreal(0), PercentOfTotalClusterMemoryUsed * 100)\r\n| extend PercentOfTotalClusterCpuUsed_display = iff(isnan(PercentOfTotalClusterCpuUsed * 100), toreal(0), PercentOfTotalClusterCpuUsed * 100)\r\n| where not (ApplicationName == \"Others\" and PercentOfTotalClusterMemoryUsed_display == 0 and PercentOfTotalClusterCpuUsed_display == 0)\r\n| project User, ApplicationName, PercentOfTotalClusterMemoryUsed_display, PercentOfTotalClusterCpuUsed_display",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "metricDefinition": "select",
            "metricName": "select",
            "metricNamespace": "select",
            "resourceGroup": "select",
            "resourceName": "select",
            "timeGrain": "auto",
            "timeGrains": [],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Top resource consumers",
      "transparent": true,
      "type": "table"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "description": "Over a sliding timeline window. Not affected by the time range parameter",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 9,
        "w": 12,
        "x": 12,
        "y": 6
      },
      "hiddenSeries": false,
      "id": 2,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 3,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak) \r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ApplicationName != 'Kusto.WinSvc.DM.Svc'\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ApplicationName != 'Kusto.WinSvc.DM.Svc'\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User,\r\n        ApplicationName,\r\n        Principal,\r\n        TotalCPU,\r\n        MemoryPeak,\r\n        CorrelationId,\r\n        cluster_name;\r\nlet raw = dataset_commands_queries\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where cluster_name == 'mitulktest'\r\n    | where StartedOn > ago(365d)\r\n;\r\nraw\r\n| evaluate activity_engagement(User, StartedOn, 1d, 7d)\r\n| join kind = inner (\r\n    raw\r\n    | evaluate activity_engagement(User, StartedOn, 1d, 30d)\r\n    )\r\n    on StartedOn\r\n| project StartedOn, Daily=dcount_activities_inner, Weekly=dcount_activities_outer, Monthly = dcount_activities_outer1     \r\n| where StartedOn > ago(90d)\r\n| project Daily, StartedOn, Weekly, Monthly\r\n| sort by StartedOn asc\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "metricDefinition": "select",
            "metricName": "select",
            "metricNamespace": "select",
            "resourceGroup": "select",
            "resourceName": "select",
            "timeGrain": "auto",
            "timeGrains": [],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Unique user count",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "datasource": "$ds",
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 15
      },
      "id": 19,
      "panels": [],
      "title": "Key Metrics",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 0,
        "y": 16
      },
      "hiddenSeries": false,
      "id": 20,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "KeepAlive",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Keep Alive",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 6,
        "y": 16
      },
      "hiddenSeries": false,
      "id": 21,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "CPU",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "CPU",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "percent",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 12,
        "y": 16
      },
      "hiddenSeries": false,
      "id": 22,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "CacheUtilization",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Cache Utilization",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "percent",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 18,
        "y": 16
      },
      "hiddenSeries": false,
      "id": 23,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "InstanceCount",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Instance Count",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 0,
        "y": 26
      },
      "hiddenSeries": false,
      "id": 24,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "TotalNumberOfConcurrentQueries",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Concurrent Queries",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 6,
        "y": 26
      },
      "hiddenSeries": false,
      "id": 25,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum", "Total"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Query Status",
                "value": "QueryStatus"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "QueryDuration",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Query Duration",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "ms",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 12,
        "y": 26
      },
      "hiddenSeries": false,
      "id": 26,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum", "Total"],
            "aggregation": "Total",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Command Type",
                "value": "CommandType"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "TotalNumberOfThrottledCommands",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Throttled Commands",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "ms",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 18,
        "y": 26
      },
      "hiddenSeries": false,
      "id": 27,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum", "Total"],
            "aggregation": "Maximum",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "TotalNumberOfThrottledQueries",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Throttled Queries",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 0,
        "y": 36
      },
      "hiddenSeries": false,
      "id": 28,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "IngestionUtilization",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Ingestion Utilization",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "percent",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 6,
        "y": 36
      },
      "hiddenSeries": false,
      "id": 29,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Maximum", "Minimum"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "IngestionLatencyInSeconds",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Ingestion Latency",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "s",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 12,
        "y": 36
      },
      "hiddenSeries": false,
      "id": 30,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Total"],
            "aggregation": "Total",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Status",
                "value": "IngestionResultDetails"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "IngestionResult",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Ingestion Result",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 18,
        "y": 36
      },
      "hiddenSeries": false,
      "id": 31,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Total", "Maximum"],
            "aggregation": "Total",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Database",
                "value": "Database"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "IngestionVolumeInMB",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Ingestion Volume",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "decbytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 0,
        "y": 46
      },
      "hiddenSeries": false,
      "id": 32,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Minimum", "Maximum"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "StreamingIngestDataRate",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Streaming Ingest Data Rate",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 6,
        "y": 46
      },
      "hiddenSeries": false,
      "id": 33,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average", "Minimum", "Maximum"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "StreamingIngestDuration",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Streaming Ingest Duration",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "ms",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 12,
        "y": 46
      },
      "hiddenSeries": false,
      "id": 35,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Result",
                "value": "Result"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "StreamingIngestResults",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Streaming Ingest Result",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 9,
        "w": 12,
        "x": 0,
        "y": 56
      },
      "hiddenSeries": false,
      "id": 36,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Total", "Average", "Minimum", "Maximum"],
            "aggregation": "Total",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "EventsProcessed",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Events Processed",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 9,
        "w": 12,
        "x": 12,
        "y": 56
      },
      "hiddenSeries": false,
      "id": 37,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//change this example to create your own time series query\n<table name>                                                              //the table to query (e.g. Usage, Heartbeat, Perf)\n| where $__timeFilter(TimeGenerated)                                      //this is a macro used to show the full chart’s time range, choose the datetime column here\n| summarize count() by <group by column>, bin(TimeGenerated, $__interval) //change “group by column” to a column in your table, such as “Computer”. The $__interval macro is used to auto-select the time grain. Can also use 1h, 5m etc.\n| order by TimeGenerated asc",
            "resultFormat": "time_series",
            "workspace": "657b3e91-7c0b-438b-86a5-f769445e237d"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Discovery Latency",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "datasource": "$ds",
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 65
      },
      "id": 40,
      "panels": [],
      "title": "Usage",
      "type": "row"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 14,
        "x": 0,
        "y": 66
      },
      "id": 43,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is KustoRunner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand \r\n    | where TimeGenerated > datetime(2020-09-09T09:30:00Z) \r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak) \r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State, FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest'\r\n    //| where totimespan(TotalCPU) > totimespan(0)\r\n    | summarize TotalCPU=max(TotalCPU) \r\n        , MemoryPeak=max(MemoryPeak)\r\n        by User, ApplicationName, CorrelationId \r\n;\r\nlet totalCPU = toscalar(dataset\r\n    | summarize sum((totimespan(TotalCPU) / 1s)));\r\nlet totalMemory = toscalar(dataset\r\n    | summarize sum(MemoryPeak));\r\nlet topMemory = \r\n    dataset\r\n    | top-nested 10000 of User with others=\"Others\" by sum(MemoryPeak), top-nested 10000 of ApplicationName with others=\"Others\" by sum(MemoryPeak)\r\n    | extend PercentOfTotalClusterMemoryUsed = aggregated_ApplicationName / toreal(totalMemory)\r\n;\r\nlet topCpu = \r\n    dataset\r\n    | top-nested 10000 of User with others=\"Others\" by sum(totimespan(TotalCPU) / 1s), top-nested 10000 of ApplicationName with others=\"Others\" by sum(totimespan(TotalCPU) / 1s)\r\n    | extend PercentOfTotalClusterCpuUsed = aggregated_ApplicationName / toreal(totalCPU)\r\n;\r\ntopMemory\r\n| join kind = fullouter(topCpu) on User, ApplicationName\r\n| extend BothPercentages = PercentOfTotalClusterMemoryUsed + PercentOfTotalClusterCpuUsed\r\n| top 10 by BothPercentages desc\r\n| extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n    ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n    User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n    User)\r\n| extend PercentOfTotalClusterMemoryUsed_display = iff(isnan(PercentOfTotalClusterMemoryUsed * 100), toreal(0), PercentOfTotalClusterMemoryUsed * 100)\r\n| extend PercentOfTotalClusterCpuUsed_display = iff(isnan(PercentOfTotalClusterCpuUsed * 100), toreal(0), PercentOfTotalClusterCpuUsed * 100)\r\n| where not (ApplicationName == \"Others\" and PercentOfTotalClusterMemoryUsed_display == 0 and PercentOfTotalClusterCpuUsed_display == 0)\r\n| project User, ApplicationName, PercentOfTotalClusterMemoryUsed_display, PercentOfTotalClusterCpuUsed_display",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Top resource consumers (within the CPU and memory consumption of the cluster)",
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 10,
        "x": 14,
        "y": 66
      },
      "id": 44,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest'\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | summarize Count=count() by User, ApplicationName\r\n    | project User, ApplicationName, Count\r\n    | extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n        User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters\r\n        User)\r\n    | top 10 by Count;\r\n//| order by Count desc\r\n// <Option #1 for top-nested> | top-nested 10 of User with others=\"Other Values\" by agg_User=sum(Count) desc;\r\n// <Option #2 for top-nested>| top-nested 10 of User by agg_User=sum(Count) desc, top-nested 5 of ApplicationName with others=\"Other applications\" by agg_App=sum(Count) desc\r\n// <Option #2 for top-nested>| where not (ApplicationName == \"Other applications\" and agg_App == 0)\r\n// <Option #2 for top-nested>| project-away agg_User;\r\ndataset\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Top principals and applications by command and query count",
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 0,
        "y": 70
      },
      "id": 38,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is KustoRunner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\",\r\n        ApplicationName)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest'\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | summarize Count=count() by ApplicationName\r\n    | project ApplicationName, Count\r\n    | order by Count desc\r\n    //| top-nested 10 of User with others=\"Other Values\" by agg_User=sum(Count) desc;\r\n    | top-nested 7 of ApplicationName with others=\"Other Values\"  by agg_App=sum(Count) desc;\r\n//|where not (ApplicationName == \"Other applications\" and agg_App == 0)\r\n//|project-away agg_User;\r\ndataset\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Top applications by command and query count",
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 8,
        "y": 70
      },
      "id": 41,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is KustoRunner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest'\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n        ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n        User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n        User)\r\n    | summarize Count=count() by User\r\n    | project User, Count\r\n    | order by Count desc\r\n    | top-nested 7 of User with others=\"Other Values\" by agg_User=sum(Count) desc;\r\ndataset\r\n\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Top principals by command and query count",
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 16,
        "y": 70
      },
      "id": 42,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is KustoRunner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest'\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | summarize Count=count() by CommandType\r\n    | project CommandType, Count\r\n    | order by Count desc\r\n    | top-nested 7 of CommandType with others=\"Other Values\"  by agg_App=sum(Count) desc;\r\ndataset\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Queries and top commands by command type",
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 14,
        "x": 0,
        "y": 75
      },
      "id": 45,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is KustoRunner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | where TimeGenerated > ago(17d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where TimeGenerated > ago(17d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend';\r\nlet Last24Hours =\r\n    FullList\r\n    | where StartedOn >= ago(1d) and StartedOn < now()\r\n    | summarize Count=count() by User, ApplicationName\r\n    | top 100 by Count desc\r\n;\r\nlet HistoricalDailyAverage =\r\n    FullList\r\n    | where StartedOn >= ago(16d) and StartedOn < ago(1d)\r\n    | summarize Count=count() / 15.0 by User, ApplicationName\r\n    | top 100 by Count desc\r\n;\r\nlet TimeRangeComparison =\r\n    Last24Hours\r\n    | join kind=leftouter (HistoricalDailyAverage) on User, ApplicationName\r\n    | project User=coalesce(User, User1), ApplicationName, Last24Hours=Count, HistoricalDailyAverage=round(Count1, 0)\r\n    | extend PercentChange=round((Last24Hours - HistoricalDailyAverage) / toreal(HistoricalDailyAverage), 2)\r\n    | top 10 by Last24Hours desc\r\n;\r\nTimeRangeComparison\r\n| extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n    ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n    User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n    User)\r\n| project User, ApplicationName, HistoricalDailyAverage=round(HistoricalDailyAverage, 0), Last24Hours, PercentChange\r\n| order by Last24Hours desc",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Changes in query count by principal (not affected by the the time range parameter)",
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 10,
        "x": 14,
        "y": 75
      },
      "id": 46,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Quert Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\ndataset\r\n| where CommandType != 'TableSetOrAppend' and State == 'Failed'\r\n| summarize Count=count() by User, ApplicationName\r\n| top 10 by Count desc\r\n| extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n    ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n    User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n    User)\r\n| order by Count desc\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Failed queries",
      "transparent": true,
      "type": "table"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 0,
        "y": 79
      },
      "hiddenSeries": false,
      "id": 47,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | project User, StartedOn, ApplicationName, CommandType\r\n;\r\nlet Top =\r\n    dataset\r\n    | summarize Count=count() by User\r\n    | top 10 by Count desc\r\n    | extend OriginalUser = User\r\n    | extend Category=User\r\n;\r\nFullList\r\n| join kind=leftouter(Top) on $left.User == $right.OriginalUser\r\n| project User=coalesce(Category, 'Other'), ApplicationName, CommandType, StartedOn\r\n| extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n    ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n    User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n    User)\r\n| summarize count() by User, bin(StartedOn, 1h)\r\n| summarize sum(count_) by bin(StartedOn, 1h), tostring(User)\r\n| sort by StartedOn asc",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Command + query count by principal",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 8,
        "y": 79
      },
      "hiddenSeries": false,
      "id": 48,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | project User, ApplicationName, CommandType, StartedOn, MemoryPeak\r\n    | extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n        ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n        User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n        User)\r\n;\r\nlet Top =\r\n    FullList\r\n    | summarize Memory=sum(MemoryPeak) by User\r\n    | top 10 by Memory desc\r\n    | extend OriginalUser = User\r\n    | project OriginalUser, Category=User\r\n;\r\nFullList\r\n| join kind=leftouter(Top) on $left.User == $right.OriginalUser\r\n| project User=coalesce(Category, 'Other'), StartedOn, MemoryPeakGB=MemoryPeak / 1024.0 / 1024.0 / 1024.0\r\n| summarize MemoryPeakGB=sum(MemoryPeakGB) by User, bin(StartedOn, 1h)\r\n| summarize sum(MemoryPeakGB) by bin(StartedOn, 1h), tostring(User)\r\n| sort by StartedOn asc",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Total memory by principal",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 16,
        "y": 79
      },
      "hiddenSeries": false,
      "id": 49,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where StartedOn > ago(7d)\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | project User, ApplicationName, CommandType, StartedOn, TotalCPU\r\n    | extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n        ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n        User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n        User)\r\n;\r\nlet Top =\r\n    FullList\r\n    | summarize TotalCpu=sum(totimespan(TotalCPU)) by User\r\n    | top 10 by TotalCpu desc\r\n    | extend OriginalUser = User\r\n    | project OriginalUser, Category=User\r\n;\r\nFullList\r\n| join kind=leftouter(Top) on $left.User == $right.OriginalUser\r\n| project User=coalesce(Category, 'Other'), StartedOn, TotalCpuMinutes=totimespan(TotalCPU) / 1m\r\n| summarize TotalCpuMinutes=sum(TotalCpuMinutes) by User, bin(StartedOn, 1h)\r\n| top-nested of bin(StartedOn, 1h) by sum(TotalCpuMinutes), top-nested 5 of User with others=\"Other Values\" by sum_TotalCpuMinutes=sum(TotalCpuMinutes) desc\r\n| sort by StartedOn asc\r\n| project StartedOn, User, sum_TotalCpuMinutes\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Total CPU by principal",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 0,
        "y": 89
      },
      "hiddenSeries": false,
      "id": 51,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\", ApplicationName)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | project ApplicationName, StartedOn, CommandType, User\r\n;\r\nlet Top =\r\n    FullList\r\n    | summarize Count=count() by ApplicationName\r\n    | top 10 by Count desc\r\n    | extend Category=ApplicationName\r\n;\r\nFullList\r\n| join kind=leftouter(Top) on ApplicationName \r\n| project Application=coalesce(Category, '-'), CommandType, User, StartedOn\r\n| summarize count() by Application, bin(StartedOn, 1h)\r\n| summarize sum(count_) by bin(StartedOn, time(1h)), tostring(Application)\r\n| sort by StartedOn asc\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Command + query count by application",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 8,
        "y": 89
      },
      "hiddenSeries": false,
      "id": 52,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak) \r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\", ApplicationName)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | project ApplicationName, StartedOn, CommandType, User, MemoryPeak\r\n;\r\nlet Top =\r\n    FullList\r\n    | summarize Memory=sum(MemoryPeak) by ApplicationName\r\n    | top 10 by Memory desc\r\n    | extend Category=ApplicationName;\r\nFullList\r\n| join kind=inner(Top) on ApplicationName\r\n| project Application=coalesce(Category, '-'), CommandType, User, StartedOn, MemoryPeakMB=MemoryPeak / 1024.0 / 1024.0\r\n| summarize MemoryPeakMB=sum(MemoryPeakMB) by Application, bin(StartedOn, 1h)\r\n| summarize sum(MemoryPeakMB) by bin(StartedOn, time(1h)), tostring(Application)\r\n| sort by StartedOn asc\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Total memory by application",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 16,
        "y": 89
      },
      "hiddenSeries": false,
      "id": 50,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\", ApplicationName)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | project ApplicationName, CommandType, User, StartedOn, TotalCPU\r\n;\r\nlet Top =\r\n    FullList\r\n    | summarize TotalCPU=sum(totimespan(TotalCPU)) by ApplicationName\r\n    | top 10 by TotalCPU desc\r\n    | extend Category=ApplicationName\r\n;\r\nFullList\r\n| join kind=inner(Top) on ApplicationName\r\n| project Application=coalesce(Category, '-'), CommandType, User, StartedOn, TotalCpuMinutes=totimespan(TotalCPU) / 1m\r\n| summarize TotalCpuMinutes=sum(TotalCpuMinutes) by Application, bin(StartedOn, 1h)\r\n| summarize sum(TotalCpuMinutes) by bin(StartedOn, time(1h)), tostring(Application)\r\n| sort by StartedOn asc\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Total CPU by application",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 0,
        "y": 99
      },
      "hiddenSeries": false,
      "id": 53,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\ndataset\r\n| where CommandType != 'TableSetOrAppend' \r\n| top-nested of bin(StartedOn, time(1h)) by count(), top-nested 5 of CommandType by count_=count() desc\r\n| sort by StartedOn asc\r\n| project StartedOn, CommandType, count_\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Queries + command count by type",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 8,
        "y": 99
      },
      "hiddenSeries": false,
      "id": 54,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak) \r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\ndataset\r\n| where CommandType != 'TableSetOrAppend' \r\n| extend MemoryPeakGB=MemoryPeak / 1024.0 / 1024.0 / 1024.0\r\n| top-nested of bin(StartedOn, time(1h)) by sum(MemoryPeakGB), top-nested 5 of CommandType with others=\"Other Values\" by sum_MemoryPeakGB=sum(MemoryPeakGB) desc\r\n| sort by StartedOn asc\r\n| project StartedOn, CommandType, sum_MemoryPeakGB\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Total memory by type",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 16,
        "y": 99
      },
      "hiddenSeries": false,
      "id": 55,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak) \r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\ndataset\r\n| where CommandType != 'TableSetOrAppend' \r\n| extend TotalCpuMinutes = totimespan(TotalCPU) / 1m\r\n| top-nested of bin(StartedOn, time(1h)) by sum(TotalCpuMinutes), top-nested 5 of CommandType with others=\"Other Values\" by sum_TotalCpuMinutes=sum(TotalCpuMinutes) desc\r\n| sort by StartedOn asc\r\n| project StartedOn, CommandType, sum_TotalCpuMinutes\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Total CPU by type",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 8,
        "x": 0,
        "y": 109
      },
      "id": 56,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet commandTable = \r\n    ADXCommand \r\n    | where StartedOn > ago(7d)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | project User, StartedOn, ApplicationName, CommandType, WorkloadGroup\r\n;\r\nlet queryTable = \r\n    ADXQuery \r\n    | where StartedOn > ago(7d)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | extend CommandType = 'Query'\r\n    | project User, StartedOn, ApplicationName, CommandType, WorkloadGroup;\r\nlet FullList = commandTable\r\n    | union (queryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\", ApplicationName)\r\n    | project User, StartedOn, ApplicationName, CommandType, WorkloadGroup;\r\nlet Top =\r\n    FullList\r\n    | summarize Count=count() by WorkloadGroup\r\n    | top 10 by Count desc\r\n    | distinct WorkloadGroup\r\n;\r\nFullList\r\n| project WorkloadGroup = iff((WorkloadGroup in(Top)) == true, WorkloadGroup, 'Other'), CommandType, StartedOn\r\n| make-series count() on StartedOn from ago(7d) to now() step 1h by WorkloadGroup\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Command + query count by workload group",
      "transformations": [],
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 8,
        "x": 8,
        "y": 109
      },
      "id": 57,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet commandTable = \r\n    ADXCommand\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where StartedOn > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | project User, ApplicationName, CommandType, StartedOn, MemoryPeak, WorkloadGroup\r\n;\r\nlet queryTable = \r\n    ADXQuery \r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where StartedOn > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | extend CommandType = 'Query'\r\n    | project User, ApplicationName, CommandType, StartedOn, MemoryPeak, WorkloadGroup;\r\nlet FullList = commandTable\r\n    | union (queryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\", ApplicationName)\r\n    | project User, ApplicationName, CommandType, StartedOn, MemoryPeak, WorkloadGroup;\r\nlet Top =\r\n    FullList\r\n    | summarize Memory=sum(MemoryPeak) by WorkloadGroup\r\n    | top 10 by Memory desc\r\n    | distinct WorkloadGroup\r\n;\r\nFullList\r\n| project WorkloadGroup = iff((WorkloadGroup in(Top)) == true, WorkloadGroup, 'Other'), CommandType, User, StartedOn, MemoryPeakGB=MemoryPeak / 1024.0 / 1024.0 / 1024.0\r\n| make-series MemoryPeakGB=sum(MemoryPeakGB) on StartedOn from ago(7d) to now() step 1h by WorkloadGroup",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Total memory by workload group",
      "transformations": [],
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 8,
        "x": 16,
        "y": 109
      },
      "id": 58,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet commandTable = \r\n    ADXCommand\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where StartedOn > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | project User, ApplicationName, CommandType, StartedOn, TotalCPU, WorkloadGroup\r\n;\r\nlet queryTable = \r\n    ADXQuery \r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where StartedOn > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | extend CommandType = 'Query'\r\n    | project User, ApplicationName, CommandType, StartedOn, TotalCPU, WorkloadGroup;\r\nlet FullList = commandTable\r\n    | union (queryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\", ApplicationName)\r\n    | project User, ApplicationName, CommandType, StartedOn, totimespan(TotalCPU), WorkloadGroup;\r\nlet Top =\r\n    FullList\r\n    | summarize TotalCpu=sum(TotalCPU) by WorkloadGroup\r\n    | top 10 by TotalCpu desc\r\n    | distinct WorkloadGroup\r\n;\r\nFullList\r\n| project WorkloadGroup = iff((WorkloadGroup in(Top)) == true, WorkloadGroup, 'Other'), StartedOn, TotalCpuMinutes=totimespan(TotalCPU) / 1m\r\n| make-series TotalCpuMinutes=sum(TotalCpuMinutes) on StartedOn from ago(7d) to now() step 1h by WorkloadGroup",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Total CPU by workload group",
      "transformations": [],
      "transparent": true,
      "type": "table"
    },
    {
      "collapsed": false,
      "datasource": "$ds",
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 113
      },
      "id": 60,
      "panels": [],
      "title": "Tables",
      "type": "row"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 114
      },
      "id": 61,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "ADXTableDetails \r\n| where TimeGenerated >= ago(1d)\r\n| project TimeGenerated,\r\n    DatabaseName,\r\n    TableName,\r\n    RetentionPolicyOrigin,\r\n    CachingPolicyOrigin,\r\n    OriginalSize = TotalOriginalSize, \r\n    TotalExtentSize, \r\n    HotExtentSize = HotExtentSize, \r\n    RowCount = TotalRowCount, \r\n    ExtentCount = TotalExtentCount,\r\n    SoftDelete = format_timespan(totimespan(todynamic(RetentionPolicy).SoftDeletePeriod), 'd'),\r\n    HotCache = format_timespan(totimespan(todynamic(CachingPolicy).DataHotSpan), 'd')      \r\n| extend CompressionRatio = round(toreal(OriginalSize) / TotalExtentSize, 1)\r\n| extend SoftDelete = iff(RetentionPolicyOrigin == \"default\" and isempty(SoftDelete), \"unlimited\", SoftDelete)\r\n| extend HotCache = iff(CachingPolicyOrigin == \"default\" and isempty(HotCache), \"unlimited\", HotCache)\r\n| summarize arg_max(TimeGenerated, *) by DatabaseName, TableName\r\n| top 351 by HotExtentSize desc\r\n| project DatabaseName,\r\n    TableName,\r\n    RowCount, \r\n    HotExtentSize,\r\n    SoftDelete,\r\n    HotCache,\r\n    OriginalSize, \r\n    TotalExtentSize,\r\n    CompressionRatio, \r\n    ExtentCount\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "  Table details",
      "transformations": [],
      "transparent": true,
      "type": "table"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 12,
        "x": 0,
        "y": 117
      },
      "hiddenSeries": false,
      "id": 62,
      "legend": {
        "avg": false,
        "current": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let TotalRowCountTable = ADXTableDetails\r\n    | where TimeGenerated > ago(7d)\r\n    | project Time = TimeGenerated, Category = strcat(TableName, \" (DB: \", DatabaseName, \")\"), Value = toreal(TotalRowCount);\r\nlet topCategories = \r\n    TotalRowCountTable\r\n    | summarize sum(Value) by Category\r\n    | top 9 by sum_Value desc\r\n;\r\nTotalRowCountTable\r\n| join kind = leftouter (topCategories) on Category\r\n| project Category = coalesce(Category1, 'Other Tables'), Value, Time\r\n| summarize max(Value) by Category, bin(Time, 1h)\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Top tables by row count",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transformations": [],
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 12,
        "x": 12,
        "y": 117
      },
      "hiddenSeries": false,
      "id": 63,
      "legend": {
        "avg": false,
        "current": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let HotExtentSizeTable = ADXTableDetails\r\n    | where TimeGenerated > ago(7d)\r\n    | project Time = TimeGenerated, Category = strcat(TableName, \" (DB: \", DatabaseName, \")\"), Value = HotExtentSize;\r\nlet topCategories = \r\n    HotExtentSizeTable\r\n    | summarize sum(Value) by Category\r\n    | top 9 by sum_Value desc;\r\nHotExtentSizeTable\r\n| join kind = leftouter (topCategories) on Category\r\n| project Category = coalesce(Category1, 'Other Tables'), Value, Time\r\n| summarize max(Value) by Category, bin(Time, 1h)\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Top tables by hot cache size",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transformations": [],
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 12,
        "x": 0,
        "y": 127
      },
      "hiddenSeries": false,
      "id": 64,
      "legend": {
        "avg": false,
        "current": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let TotalExtentCountTable = ADXTableDetails\r\n    | where TimeGenerated > ago(7d)\r\n    | project Time = TimeGenerated, Category = strcat(TableName, \" (DB: \", DatabaseName, \")\"), Value = toreal(TotalExtentCount);\r\nlet topCategories = \r\n    TotalExtentCountTable\r\n    | summarize sum(Value) by Category\r\n    | top 9 by sum_Value desc\r\n;\r\nTotalExtentCountTable\r\n| join kind = leftouter (topCategories) on Category\r\n| project Category = coalesce(Category1, 'Other Tables'), Value, Time\r\n| summarize max(Value) by Category, bin(Time, 1h)\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Top tables by extent count",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transformations": [],
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 12,
        "x": 12,
        "y": 127
      },
      "hiddenSeries": false,
      "id": 65,
      "legend": {
        "avg": false,
        "current": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let TotalExtentSizeTable = ADXTableDetails\r\n    | where TimeGenerated > ago(7d)\r\n    | project Time = TimeGenerated, Category = strcat(TableName, \" (DB: \", DatabaseName, \")\"), Value = TotalExtentSize;\r\nlet topCategories = \r\n    TotalExtentSizeTable\r\n    | summarize sum(Value) by Category\r\n    | top 9 by sum_Value desc;\r\nTotalExtentSizeTable\r\n| join kind = leftouter (topCategories) on Category\r\n| project Category = coalesce(Category1, 'Other Tables'), Value, Time\r\n| summarize max(Value) by Category, bin(Time, 1h)\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Top tables by extent size",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transformations": [],
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "datasource": "$ds",
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 137
      },
      "id": 67,
      "panels": [],
      "title": "Cache",
      "type": "row"
    },
    {
      "datasource": "$ds",
      "description": "This page presents data based on the Time Range parameter. You can change the Time Range parameter to present data starting from 05/25/21 ,11:38 PM (based on your oldest diagnostic logs data).\n  The table names and the Cache policy column refreshes every 8 hours.\n  Notice the queries statistics presented are based only on queries that scanned data. For instance queries that failed, and queries with time operator of future don't scan any data therefore would not be part of the queries statistics presented.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 24,
        "x": 0,
        "y": 138
      },
      "id": 72,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let TableUsageStatsWithLookBack = ADXTableUsageStatistics\r\n    | where TimeGenerated > ago(7d)\r\n    | extend LookBackPeriod = datetime_diff('day', StartedOn, MinCreatedOn) \r\n    | summarize CountQueries=count() by DatabaseName, TableName, LookBackPeriod;\r\nlet sumAllQueries = TableUsageStatsWithLookBack\r\n    | summarize sumQueries=sum(CountQueries) by DatabaseName, TableName;\r\nlet percentileLookBackTable= TableUsageStatsWithLookBack\r\n    | summarize percentile_LookbackDuration_ = percentilesw(LookBackPeriod, CountQueries, 95) by DatabaseName, TableName;\r\nlet defaultRetention = 365d * 10;\r\nADXTableDetails \r\n| where TimeGenerated >= ago(1d) // so we filter out tables that are deprecated\r\n| summarize arg_max(TimeGenerated, *) by DatabaseName, TableName\r\n| extend RetentionPolicy = iff(isnull(RetentionPolicy) or RetentionPolicy == \"null\", defaultRetention, totimespan(parse_json(tostring(RetentionPolicy)).SoftDeletePeriod)),\r\n    CachingPolicy = iff(isnull(CachingPolicy) or RetentionPolicy == \"null\", defaultRetention, totimespan(parse_json(tostring(CachingPolicy)).DataHotSpan))\r\n| extend ActiveCachingPolicy = min_of(CachingPolicy, RetentionPolicy)\r\n| join kind = leftouter (percentileLookBackTable) on DatabaseName, TableName\r\n| join kind = leftouter (sumAllQueries) on DatabaseName, TableName\r\n| where DatabaseName != \"KustoMonitoringPersistentDatabase\"\r\n| top 351 by HotExtentSize desc\r\n| project DatabaseName, TableName, CacheSize = HotExtentSize, format_timespan(ActiveCachingPolicy, 'd'),  \r\n    sumQueries=sumQueries, QueryPeriod = percentile_LookbackDuration_",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Table usage details",
      "transformations": [],
      "transparent": true,
      "type": "table"
    },
    {
      "collapsed": false,
      "datasource": "$ds",
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 142
      },
      "id": 69,
      "panels": [],
      "title": "Ingestion",
      "type": "row"
    },
    {
      "datasource": "$ds",
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 8,
        "x": 0,
        "y": 143
      },
      "id": 73,
      "options": {
        "showHeader": true
      },
      "pluginVersion": "7.4.3",
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//SucceededIngestion\r\n//| where TimeGenerated > ago(7d)\r\n//| parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n//| where cluster_name == 'mitulktest'\r\n//| summarize count=dcount(IngestionSourcePath) by Database, Table\r\n//| order by ['count'],Database, Table\r\nlet tenant=\r\n    FailedIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | distinct TenantId\r\n    | take 1; //choose one tenant as logs are transferred to many tenants which represents workSpace\r\nlet failures = FailedIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | where TenantId == toscalar(tenant)\r\n    | summarize f_count=count() by Database, Table;\r\nlet tenant_success=\r\n    SucceededIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | distinct TenantId\r\n    | take 1; //choose one tenant as logs are transferred to many tenants which represents workSpace\r\nlet success = SucceededIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | where TenantId == toscalar(tenant_success)\r\n    | summarize s_count=count() by Database, Table;\r\nsuccess\r\n| join kind=leftouter failures on Database, Table\r\n| extend f_count = iif(isnull(f_count), 0, f_count)\r\n| extend s_count = iif(isnull(s_count), 0, s_count)\r\n| extend overall = iif(isnull(s_count), 0.0, s_count * 100.0 / (s_count + f_count))\r\n| project Database, Table, s_count, overall\r\n| order by s_count, Database, Table",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Succeeded ingestions by table",
      "transformations": [],
      "transparent": true,
      "type": "table"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "description": "Time from when a message is discovered by Azure Data Explorer, until its content is received by the Engine Storage for processing.",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 9,
        "w": 8,
        "x": 8,
        "y": 143
      },
      "hiddenSeries": false,
      "id": 74,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//SucceededIngestion\r\n//| where TimeGenerated > ago(7d)\r\n//| parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n//| where cluster_name == 'mitulktest'\r\n//| summarize count=dcount(IngestionSourcePath) by Database, Table\r\n//| order by ['count'],Database, Table\r\nlet tenant=\r\n    FailedIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | distinct TenantId\r\n    | take 1; //choose one tenant as logs are transferred to many tenants which represents workSpace\r\nlet failures = FailedIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | where TenantId == toscalar(tenant)\r\n    | summarize f_count=count() by Database, Table;\r\nlet tenant_success=\r\n    SucceededIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | distinct TenantId\r\n    | take 1; //choose one tenant as logs are transferred to many tenants which represents workSpace\r\nlet success = SucceededIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | where TenantId == toscalar(tenant_success)\r\n    | summarize s_count=count() by Database, Table;\r\nsuccess\r\n| join kind=leftouter failures on Database, Table\r\n| extend f_count = iif(isnull(f_count), 0, f_count)\r\n| extend s_count = iif(isnull(s_count), 0, s_count)\r\n| extend overall = iif(isnull(s_count), 0.0, s_count * 100.0 / (s_count + f_count))\r\n| project Database, Table, s_count, overall\r\n| order by s_count, Database, Table",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Average"],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [
              {
                "dimension": "ComponentType",
                "filter": "StorageEngine",
                "operator": "eq"
              }
            ],
            "dimensions": [
              {
                "text": "Database",
                "value": "Database"
              },
              {
                "text": "Component Type",
                "value": "ComponentType"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "StageLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Stage latency (accumulative latency)",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transformations": [],
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "description": "Number of blobs processed by the Storage Engine.",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 9,
        "w": 8,
        "x": 16,
        "y": 143
      },
      "hiddenSeries": false,
      "id": 75,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pluginVersion": "7.4.3",
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//SucceededIngestion\r\n//| where TimeGenerated > ago(7d)\r\n//| parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n//| where cluster_name == 'mitulktest'\r\n//| summarize count=dcount(IngestionSourcePath) by Database, Table\r\n//| order by ['count'],Database, Table\r\nlet tenant=\r\n    FailedIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | distinct TenantId\r\n    | take 1; //choose one tenant as logs are transferred to many tenants which represents workSpace\r\nlet failures = FailedIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | where TenantId == toscalar(tenant)\r\n    | summarize f_count=count() by Database, Table;\r\nlet tenant_success=\r\n    SucceededIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | distinct TenantId\r\n    | take 1; //choose one tenant as logs are transferred to many tenants which represents workSpace\r\nlet success = SucceededIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | where TenantId == toscalar(tenant_success)\r\n    | summarize s_count=count() by Database, Table;\r\nsuccess\r\n| join kind=leftouter failures on Database, Table\r\n| extend f_count = iif(isnull(f_count), 0, f_count)\r\n| extend s_count = iif(isnull(s_count), 0, s_count)\r\n| extend overall = iif(isnull(s_count), 0.0, s_count * 100.0 / (s_count + f_count))\r\n| project Database, Table, s_count, overall\r\n| order by s_count, Database, Table",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": ["Total", "Average", "Minimum", "Maximum"],
            "aggregation": "Total",
            "allowedTimeGrainsMs": [60000, 300000, 900000, 1800000, 3600000, 21600000, 43200000, 86400000],
            "dimensionFilter": "*",
            "dimensionFilters": [
              {
                "dimension": "ComponentType",
                "filter": "StorageEngine",
                "operator": "eq"
              }
            ],
            "dimensions": [
              {
                "text": "Database",
                "value": "Database"
              },
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "BlobsProcessed",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "insightsAnalytics": {
            "query": "",
            "resultFormat": "time_series"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Data Processed Successfuly",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transformations": [],
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    }
  ],
  "refresh": false,
  "schemaVersion": 27,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": [
      {
        "current": {
          "selected": false,
          "text": "Azure Monitor Datasource",
          "value": "$ds"
        },
        "description": null,
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Datasource",
        "multi": false,
        "name": "ds",
        "options": [],
        "query": "grafana-azure-monitor-datasource",
        "queryValue": "",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "type": "datasource"
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "$ds",
        "definition": "subscriptions()",
        "description": null,
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Subscription",
        "multi": false,
        "name": "sub",
        "options": [],
        "query": "subscriptions()",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 5,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "$ds",
        "definition": "ResourceGroups($sub)",
        "description": null,
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Resource Group",
        "multi": false,
        "name": "rg",
        "options": [],
        "query": "ResourceGroups($sub)",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 5,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "selected": false,
          "text": "Microsoft.Kusto/clusters",
          "value": "Microsoft.Kusto/clusters"
        },
        "description": null,
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Name Space",
        "multi": false,
        "name": "ns",
        "options": [
          {
            "selected": true,
            "text": "Microsoft.Kusto/clusters",
            "value": "Microsoft.Kusto/clusters"
          }
        ],
        "query": "Microsoft.Kusto/clusters",
        "skipUrlSync": false,
        "type": "custom"
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "$ds",
        "definition": "ResourceNames($sub, $rg, $ns)",
        "description": null,
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Resource",
        "multi": false,
        "name": "resource",
        "options": [],
        "query": "ResourceNames($sub, $rg, $ns)",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 5,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "$ds",
        "definition": "workspaces()",
        "description": null,
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Workspace",
        "multi": false,
        "name": "ws",
        "options": [],
        "query": "workspaces()",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 5,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      }
    ]
  },
  "time": {
    "from": "now-12h",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "",
  "title": "Azure / Insights / Data Explorer Clusters",
  "uid": "8UDB1s3Gk",
  "version": 11
}