Skip to content

Commit

Permalink
Update ERGateway.workbook displayUnit (#2856)
Browse files Browse the repository at this point in the history
  • Loading branch information
@srisakthimaheswari
srisakthimaheswari authored Dec 9, 2024
1 parent c0737fe commit a850a2e
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions Workbooks/Traffic Analytics/VNet/ERGateway/ERGateway.workbook
View file
Original file line number Diff line number Diff line change
Expand Up @@ -260,7 +260,7 @@
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "(NTATopologyDetails\r\n| where SubType == 'Topology'\r\n and AzureResourceType == 'VirtualNetworkGatewayConnection'\r\n and ConnectionType == 'ExpressRoute' \r\n//project connname, gateway here onwards \r\n| extend ConnectionName = strcat(Subscription, '/', Name)\r\n//filters\r\n | where iff({timeInterval:seconds} < 86400, TimeGenerated between (datetime_add('day', -1, todatetime('{timeInterval:endISO}')) .. todatetime('{timeInterval:endISO}')), TimeGenerated between (todatetime('{timeInterval:startISO}') .. todatetime('{timeInterval:endISO}')))\r\n | where isnotempty(Subscription) and iff(\"{subscriptions}\" == \"'*'\", true, Subscription in~ ({subscriptions}))\r\n | extend rgToCheck = split(Name, '/')[0]\r\n | where iff(\"{resourceGroups}\" == \"'*'\", true, rgToCheck in~ ({resourceGroups}))\r\n | extend vnet1ToCheck = VirtualNetwork1, vnet2ToCheck = VirtualNetwork2\r\n | where iff(\"{vnets}\" == \"'*'\", true, vnet1ToCheck in ({vnets})) or iff(\"{vnets}\" == \"'*'\", true, vnet2ToCheck in ({vnets}))\r\n//\r\n| project ConnectionName, Gateway = VirtualNetworkGateway1\r\n| distinct Gateway, ConnectionName)\r\n| join kind = inner (NTANetAnalytics\r\n| where SubType == 'FlowLog' and TimeGenerated between (todatetime('{timeInterval:startISO}') .. datetime_add('day', 7, todatetime('{timeInterval:endISO}'))) and (FaSchemaVersion == '3') and FlowStartTime between (datetime('{timeInterval:startISO}') .. datetime('{timeInterval:endISO}'))\r\n | extend ConnectionNameSplit = split(ConnectionName, '/')\r\n | extend subscription1ToCheck = tostring(ConnectionNameSplit[0])\r\n | where iff(\"{subscriptions}\" == \"'*'\", true, SrcSubscription in~ ({subscriptions}))\r\n | extend rg1ToCheck = tostring(ConnectionNameSplit[1])\r\n | where iff(\"{resourceGroups}\" == \"'*'\", true, rg1ToCheck in~ ({resourceGroups})) \r\n | where iff(\"{erGatewayConnections}\" == \"'*'\", true, ConnectionName in~ ({erGatewayConnections}))\r\n| where FlowType == 'S2S' and ConnectionType == 'ExpressRoute')\r\non ConnectionName\r\n | extend \r\n AllowedInboundBytesAtSrc = iff(FlowStatus == 'Allowed' and FlowDirection == 'Outbound', tolong(BytesDestToSrc), 0), \r\n BlockedInboundBytesAtSrc = iff(FlowStatus == 'Denied' and FlowDirection == 'Outbound', tolong(BytesDestToSrc), 0), \r\n AllowedOutboundBytesAtSrc = iff(FlowStatus == 'Allowed' and FlowDirection == 'Outbound', tolong(BytesSrcToDest), 0), \r\n BlockedOutboundBytesAtSrc = iff(FlowStatus == 'Denied' and FlowDirection == 'Outbound', tolong(BytesSrcToDest), 0), \r\n AllowedInboundBytesAtDest = iff(FlowStatus == 'Allowed' and FlowDirection == 'Inbound', tolong(BytesDestToSrc), 0), \r\n BlockedInboundBytesAtDest = iff(FlowStatus == 'Denied' and FlowDirection == 'Inbound', tolong(BytesDestToSrc), 0), \r\n AllowedOutboundBytesAtDest = iff(FlowStatus == 'Allowed' and FlowDirection == 'Inbound', tolong(BytesSrcToDest), 0), \r\n BlockedOutboundBytesAtDest = iff(FlowStatus == 'Denied' and FlowDirection == 'Inbound', tolong(BytesSrcToDest), 0)\r\n | extend \r\n AllowedInboundPacketsAtSrc = iff(FlowStatus == 'Allowed' and FlowDirection == 'Outbound', tolong(PacketsDestToSrc), 0), \r\n BlockedInboundPacketsAtSrc = iff(FlowStatus == 'Denied' and FlowDirection == 'Outbound', tolong(PacketsDestToSrc), 0), \r\n AllowedOutboundPacketsAtSrc = iff(FlowStatus == 'Allowed' and FlowDirection == 'Outbound', tolong(PacketsSrcToDest), 0), \r\n BlockedOutboundPacketsAtSrc = iff(FlowStatus == 'Denied' and FlowDirection == 'Outbound', tolong(PacketsSrcToDest), 0), \r\n AllowedInboundPacketsAtDest = iff(FlowStatus == 'Allowed' and FlowDirection == 'Inbound', tolong(PacketsDestToSrc), 0), \r\n BlockedInboundPacketsAtDest = iff(FlowStatus == 'Denied' and FlowDirection == 'Inbound', tolong(PacketsDestToSrc), 0), \r\n AllowedOutboundPacketsAtDest = iff(FlowStatus == 'Allowed' and FlowDirection == 'Inbound', tolong(PacketsSrcToDest), 0), \r\n BlockedOutboundPacketsAtDest = iff(FlowStatus == 'Denied' and FlowDirection == 'Inbound', tolong(PacketsSrcToDest), 0)\r\n | extend AllowedOutbound_inferred = max_of(AllowedOutFlows, AllowedInFlows + DeniedInFlows)\r\n | extend Outbound = AllowedOutbound_inferred + DeniedOutFlows, Inbound = AllowedOutbound_inferred\r\n | extend FlowCount = max_of(Inbound, Outbound)\r\n | extend AllowedOutboundBytesAtSrc_inferred = max_of(AllowedOutboundBytesAtSrc, AllowedInboundBytesAtDest + BlockedInboundBytesAtDest)\r\n | extend AllowedOutboundBytesAtDest_inferred = max_of(AllowedOutboundBytesAtDest, AllowedInboundBytesAtSrc + BlockedInboundBytesAtSrc)\r\n | extend OutboundBytesAtSrc = AllowedOutboundBytesAtSrc_inferred + BlockedOutboundBytesAtSrc, InboundBytesAtSrc = AllowedOutboundBytesAtDest_inferred\r\n | extend OutboundBytesAtDest = AllowedOutboundBytesAtDest_inferred + BlockedOutboundBytesAtDest, InboundBytesAtDest = AllowedOutboundBytesAtSrc_inferred\r\n | extend BytesCount = max_of(OutboundBytesAtSrc, InboundBytesAtDest) + max_of(OutboundBytesAtDest, InboundBytesAtSrc)\r\n | extend AllowedOutboundPacketsAtSrc_inferred = max_of(AllowedOutboundPacketsAtSrc, AllowedInboundPacketsAtDest + BlockedInboundPacketsAtDest)\r\n | extend AllowedOutboundPacketsAtDest_inferred = max_of(AllowedOutboundPacketsAtDest, AllowedInboundPacketsAtSrc + BlockedInboundPacketsAtSrc)\r\n | extend OutboundPacketsAtSrc = AllowedOutboundPacketsAtSrc_inferred + BlockedOutboundPacketsAtSrc, InboundPacketsAtSrc = AllowedOutboundPacketsAtDest_inferred\r\n | extend OutboundPacketsAtDest = AllowedOutboundPacketsAtDest_inferred + BlockedOutboundPacketsAtDest, InboundPacketsAtDest = AllowedOutboundPacketsAtSrc_inferred\r\n | extend PacketsCount = max_of(OutboundPacketsAtSrc, InboundPacketsAtDest) + max_of(OutboundPacketsAtDest, InboundPacketsAtSrc)\r\n| summarize TotalTraffic = sum(iff('{displayUnit:value}' =~ 'bytes', BytesCount, iff('{displayUnit:value}' =~ 'packets', PacketsCount, tolong(FlowCount)))) by Gateway\r\n| where TotalTraffic > 0\r\n| top 5 by TotalTraffic",
"query": "(NTATopologyDetails\r\n| where SubType == 'Topology'\r\n and AzureResourceType == 'VirtualNetworkGatewayConnection'\r\n and ConnectionType == 'ExpressRoute' \r\n//project connname, gateway here onwards \r\n| extend ConnectionName = strcat(Subscription, '/', Name)\r\n//filters\r\n | where iff({timeInterval:seconds} < 86400, TimeGenerated between (datetime_add('day', -1, todatetime('{timeInterval:endISO}')) .. todatetime('{timeInterval:endISO}')), TimeGenerated between (todatetime('{timeInterval:startISO}') .. todatetime('{timeInterval:endISO}')))\r\n | where isnotempty(Subscription) and iff(\"{subscriptions}\" == \"'*'\", true, Subscription in~ ({subscriptions}))\r\n | extend rgToCheck = split(Name, '/')[0]\r\n | where iff(\"{resourceGroups}\" == \"'*'\", true, rgToCheck in~ ({resourceGroups}))\r\n | extend vnet1ToCheck = VirtualNetwork1, vnet2ToCheck = VirtualNetwork2\r\n | where iff(\"{vnets}\" == \"'*'\", true, vnet1ToCheck in ({vnets})) or iff(\"{vnets}\" == \"'*'\", true, vnet2ToCheck in ({vnets}))\r\n//\r\n| project ConnectionName, Gateway = VirtualNetworkGateway1\r\n| distinct Gateway, ConnectionName)\r\n| join kind = inner (NTANetAnalytics\r\n| where SubType == 'FlowLog' and TimeGenerated between (todatetime('{timeInterval:startISO}') .. datetime_add('day', 7, todatetime('{timeInterval:endISO}'))) and (FaSchemaVersion == '3') and FlowStartTime between (datetime('{timeInterval:startISO}') .. datetime('{timeInterval:endISO}'))\r\n | extend ConnectionNameSplit = split(ConnectionName, '/')\r\n | extend subscription1ToCheck = tostring(ConnectionNameSplit[0])\r\n | where iff(\"{subscriptions}\" == \"'*'\", true, SrcSubscription in~ ({subscriptions}))\r\n | extend rg1ToCheck = tostring(ConnectionNameSplit[1])\r\n | where iff(\"{resourceGroups}\" == \"'*'\", true, rg1ToCheck in~ ({resourceGroups})) \r\n | where iff(\"{erGatewayConnections}\" == \"'*'\", true, ConnectionName in~ ({erGatewayConnections}))\r\n| where FlowType == 'S2S' and ConnectionType == 'ExpressRoute')\r\non ConnectionName\r\n | extend \r\n AllowedInboundBytesAtSrc = iff(FlowStatus == 'Allowed' and FlowDirection == 'Outbound', tolong(BytesDestToSrc), 0), \r\n BlockedInboundBytesAtSrc = iff(FlowStatus == 'Denied' and FlowDirection == 'Outbound', tolong(BytesDestToSrc), 0), \r\n AllowedOutboundBytesAtSrc = iff(FlowStatus == 'Allowed' and FlowDirection == 'Outbound', tolong(BytesSrcToDest), 0), \r\n BlockedOutboundBytesAtSrc = iff(FlowStatus == 'Denied' and FlowDirection == 'Outbound', tolong(BytesSrcToDest), 0), \r\n AllowedInboundBytesAtDest = iff(FlowStatus == 'Allowed' and FlowDirection == 'Inbound', tolong(BytesDestToSrc), 0), \r\n BlockedInboundBytesAtDest = iff(FlowStatus == 'Denied' and FlowDirection == 'Inbound', tolong(BytesDestToSrc), 0), \r\n AllowedOutboundBytesAtDest = iff(FlowStatus == 'Allowed' and FlowDirection == 'Inbound', tolong(BytesSrcToDest), 0), \r\n BlockedOutboundBytesAtDest = iff(FlowStatus == 'Denied' and FlowDirection == 'Inbound', tolong(BytesSrcToDest), 0)\r\n | extend \r\n AllowedInboundPacketsAtSrc = iff(FlowStatus == 'Allowed' and FlowDirection == 'Outbound', tolong(PacketsDestToSrc), 0), \r\n BlockedInboundPacketsAtSrc = iff(FlowStatus == 'Denied' and FlowDirection == 'Outbound', tolong(PacketsDestToSrc), 0), \r\n AllowedOutboundPacketsAtSrc = iff(FlowStatus == 'Allowed' and FlowDirection == 'Outbound', tolong(PacketsSrcToDest), 0), \r\n BlockedOutboundPacketsAtSrc = iff(FlowStatus == 'Denied' and FlowDirection == 'Outbound', tolong(PacketsSrcToDest), 0), \r\n AllowedInboundPacketsAtDest = iff(FlowStatus == 'Allowed' and FlowDirection == 'Inbound', tolong(PacketsDestToSrc), 0), \r\n BlockedInboundPacketsAtDest = iff(FlowStatus == 'Denied' and FlowDirection == 'Inbound', tolong(PacketsDestToSrc), 0), \r\n AllowedOutboundPacketsAtDest = iff(FlowStatus == 'Allowed' and FlowDirection == 'Inbound', tolong(PacketsSrcToDest), 0), \r\n BlockedOutboundPacketsAtDest = iff(FlowStatus == 'Denied' and FlowDirection == 'Inbound', tolong(PacketsSrcToDest), 0)\r\n | extend AllowedOutbound_inferred = max_of(AllowedOutFlows, AllowedInFlows + DeniedInFlows)\r\n | extend Outbound = AllowedOutbound_inferred + DeniedOutFlows, Inbound = AllowedOutbound_inferred\r\n | extend FlowCount = max_of(Inbound, Outbound)\r\n | extend AllowedOutboundBytesAtSrc_inferred = max_of(AllowedOutboundBytesAtSrc, AllowedInboundBytesAtDest + BlockedInboundBytesAtDest)\r\n | extend AllowedOutboundBytesAtDest_inferred = max_of(AllowedOutboundBytesAtDest, AllowedInboundBytesAtSrc + BlockedInboundBytesAtSrc)\r\n | extend OutboundBytesAtSrc = AllowedOutboundBytesAtSrc_inferred + BlockedOutboundBytesAtSrc, InboundBytesAtSrc = AllowedOutboundBytesAtDest_inferred\r\n | extend OutboundBytesAtDest = AllowedOutboundBytesAtDest_inferred + BlockedOutboundBytesAtDest, InboundBytesAtDest = AllowedOutboundBytesAtSrc_inferred\r\n | extend BytesCount = max_of(OutboundBytesAtSrc, InboundBytesAtDest) + max_of(OutboundBytesAtDest, InboundBytesAtSrc)\r\n | extend AllowedOutboundPacketsAtSrc_inferred = max_of(AllowedOutboundPacketsAtSrc, AllowedInboundPacketsAtDest + BlockedInboundPacketsAtDest)\r\n | extend AllowedOutboundPacketsAtDest_inferred = max_of(AllowedOutboundPacketsAtDest, AllowedInboundPacketsAtSrc + BlockedInboundPacketsAtSrc)\r\n | extend OutboundPacketsAtSrc = AllowedOutboundPacketsAtSrc_inferred + BlockedOutboundPacketsAtSrc, InboundPacketsAtSrc = AllowedOutboundPacketsAtDest_inferred\r\n | extend OutboundPacketsAtDest = AllowedOutboundPacketsAtDest_inferred + BlockedOutboundPacketsAtDest, InboundPacketsAtDest = AllowedOutboundPacketsAtSrc_inferred\r\n | extend PacketsCount = max_of(OutboundPacketsAtSrc, InboundPacketsAtDest) + max_of(OutboundPacketsAtDest, InboundPacketsAtSrc)\r\n| summarize TotalTraffic = sum(iff('{graphUnit:value}' =~ 'bytes', BytesCount, iff('{graphUnit:value}' =~ 'packets', PacketsCount, tolong(FlowCount)))) by Gateway\r\n| where TotalTraffic > 0\r\n| top 5 by TotalTraffic",
"crossComponentResources": [
"{workspace}"
],
Expand Down Expand Up @@ -396,4 +396,4 @@
"Azure Monitor"
],
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}
}

0 comments on commit a850a2e

Please sign in to comment.