Grafana dashboard: Azure / Insights / Data Explorer Clusters
Description: The dashboard provides insights of Azure Data Explorer Cluster Resource overview, key mettrics, usage, tables, cache and ingestion.

More information:
- [Set up Azure Monitor data source](https://grafana.com/docs/grafana/next/datasources/azuremonitor/)
- [Azure Monitor](https://docs.microsoft.com/en-us/azure/azure-monitor/)
- [About Azure Data Explorer](https://docs.microsoft.com/en-us/azure/data-explorer/)

Send your feedback to [azmongrafana@microsoft.com](mailto:azmongrafana@microsoft.com)

{
  "__inputs": [],
  "__requires": [
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "7.4.3"
    },
    {
      "type": "datasource",
      "id": "grafana-azure-monitor-datasource",
      "name": "Azure Monitor",
      "version": "0.3.0"
    },
    {
      "type": "panel",
      "id": "graph",
      "name": "Graph",
      "version": ""
    },
    {
      "type": "panel",
      "id": "stat",
      "name": "Stat",
      "version": ""
    },
    {
      "type": "panel",
      "id": "table",
      "name": "Table",
      "version": ""
    }
  ],
  "editable": true,
  "id": null,
  "links": [],
  "panels": [
    {
      "collapsed": false,
      "datasource": "$ds",
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 6,
      "panels": [],
      "title": "Overview",
      "type": "row"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 0,
        "y": 1
      },
      "id": 4,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "text": {},
        "textMode": "auto"
      },
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "KeepAlive",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Keep Alive (Avg)",
      "type": "stat"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 3,
        "y": 1
      },
      "id": 12,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "text": {},
        "textMode": "auto"
      },
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "CPU",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "CPU (Avg)",
      "type": "stat"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 6,
        "y": 1
      },
      "id": 13,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "text": {},
        "textMode": "auto"
      },
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "IngestionUtilization",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Ingestion Utilization (Avg)  ",
      "type": "stat"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 9,
        "y": 1
      },
      "id": 14,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "text": {},
        "textMode": "auto"
      },
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "IngestionLatencyInSeconds",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Ingestion Latency (Avg)  ",
      "type": "stat"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 12,
        "y": 1
      },
      "id": 15,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "text": {},
        "textMode": "auto"
      },
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "CacheUtilization",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Cache Utilization (Avg)",
      "type": "stat"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {},
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 3,
        "x": 15,
        "y": 1
      },
      "id": 16,
      "options": {
        "colorMode": "value",
        "graphMode": "area",
        "justifyMode": "auto",
        "orientation": "auto",
        "reduceOptions": {
          "calcs": [
            "lastNotNull"
          ],
          "fields": "",
          "values": false
        },
        "text": {},
        "textMode": "auto"
      },
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Total"
            ],
            "aggregation": "Total",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Status",
                "value": "IngestionResultDetails"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "IngestionResult",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Succeeded Ingestions (#)",
      "type": "stat"
    },
    {
      "datasource": "$ds",
      "description": "The aggregated usage in the cluster, out of the total used CPU and memory. To see more details, go to the Usage tab.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 9,
        "w": 12,
        "x": 0,
        "y": 6
      },
      "id": 17,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is KustoRunner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand \r\n    | where TimeGenerated > datetime(2020-09-09T09:30:00Z) \r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak) \r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State, FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest'\r\n    //| where totimespan(TotalCPU) > totimespan(0)\r\n    | summarize TotalCPU=max(TotalCPU) \r\n        , MemoryPeak=max(MemoryPeak)\r\n        by User, ApplicationName, CorrelationId \r\n;\r\nlet totalCPU = toscalar(dataset\r\n    | summarize sum((totimespan(TotalCPU) / 1s)));\r\nlet totalMemory = toscalar(dataset\r\n    | summarize sum(MemoryPeak));\r\nlet topMemory = \r\n    dataset\r\n    | top-nested 10000 of User with others=\"Others\" by sum(MemoryPeak), top-nested 10000 of ApplicationName with others=\"Others\" by sum(MemoryPeak)\r\n    | extend PercentOfTotalClusterMemoryUsed = aggregated_ApplicationName / toreal(totalMemory)\r\n;\r\nlet topCpu = \r\n    dataset\r\n    | top-nested 10000 of User with others=\"Others\" by sum(totimespan(TotalCPU) / 1s), top-nested 10000 of ApplicationName with others=\"Others\" by sum(totimespan(TotalCPU) / 1s)\r\n    | extend PercentOfTotalClusterCpuUsed = aggregated_ApplicationName / toreal(totalCPU)\r\n;\r\ntopMemory\r\n| join kind = fullouter(topCpu) on User, ApplicationName\r\n| extend BothPercentages = PercentOfTotalClusterMemoryUsed + PercentOfTotalClusterCpuUsed\r\n| top 10 by BothPercentages desc\r\n| extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n    ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n    User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n    User)\r\n| extend PercentOfTotalClusterMemoryUsed_display = iff(isnan(PercentOfTotalClusterMemoryUsed * 100), toreal(0), PercentOfTotalClusterMemoryUsed * 100)\r\n| extend PercentOfTotalClusterCpuUsed_display = iff(isnan(PercentOfTotalClusterCpuUsed * 100), toreal(0), PercentOfTotalClusterCpuUsed * 100)\r\n| where not (ApplicationName == \"Others\" and PercentOfTotalClusterMemoryUsed_display == 0 and PercentOfTotalClusterCpuUsed_display == 0)\r\n| project User, ApplicationName, PercentOfTotalClusterMemoryUsed_display, PercentOfTotalClusterCpuUsed_display",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Top resource consumers",
      "transparent": true,
      "type": "table"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "description": "Over a sliding timeline window. Not affected by the time range parameter",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 9,
        "w": 12,
        "x": 12,
        "y": 6
      },
      "hiddenSeries": false,
      "id": 2,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 3,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak) \r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ApplicationName != 'Kusto.WinSvc.DM.Svc'\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ApplicationName != 'Kusto.WinSvc.DM.Svc'\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User,\r\n        ApplicationName,\r\n        Principal,\r\n        TotalCPU,\r\n        MemoryPeak,\r\n        CorrelationId,\r\n        cluster_name;\r\nlet raw = dataset_commands_queries\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where cluster_name == 'mitulktest'\r\n    | where StartedOn > ago(365d)\r\n;\r\nraw\r\n| evaluate activity_engagement(User, StartedOn, 1d, 7d)\r\n| join kind = inner (\r\n    raw\r\n    | evaluate activity_engagement(User, StartedOn, 1d, 30d)\r\n    )\r\n    on StartedOn\r\n| project StartedOn, Daily=dcount_activities_inner, Weekly=dcount_activities_outer, Monthly = dcount_activities_outer1     \r\n| where StartedOn > ago(90d)\r\n| project Daily, StartedOn, Weekly, Monthly\r\n| sort by StartedOn asc\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Unique user count",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "datasource": "$ds",
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 15
      },
      "id": 19,
      "panels": [],
      "title": "Key Metrics",
      "type": "row"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 0,
        "y": 16
      },
      "hiddenSeries": false,
      "id": 20,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "KeepAlive",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Keep Alive",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 6,
        "y": 16
      },
      "hiddenSeries": false,
      "id": 21,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "CPU",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "CPU",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "percent",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 12,
        "y": 16
      },
      "hiddenSeries": false,
      "id": 22,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "CacheUtilization",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Cache Utilization",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "percent",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 18,
        "y": 16
      },
      "hiddenSeries": false,
      "id": 23,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "InstanceCount",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Instance Count",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 0,
        "y": 26
      },
      "hiddenSeries": false,
      "id": 24,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "TotalNumberOfConcurrentQueries",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Concurrent Queries",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 6,
        "y": 26
      },
      "hiddenSeries": false,
      "id": 25,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum",
              "Total"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Query Status",
                "value": "QueryStatus"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "QueryDuration",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Query Duration",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "ms",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 12,
        "y": 26
      },
      "hiddenSeries": false,
      "id": 26,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum",
              "Total"
            ],
            "aggregation": "Total",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Command Type",
                "value": "CommandType"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "TotalNumberOfThrottledCommands",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Throttled Commands",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "ms",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 18,
        "y": 26
      },
      "hiddenSeries": false,
      "id": 27,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum",
              "Total"
            ],
            "aggregation": "Maximum",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "TotalNumberOfThrottledQueries",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Throttled Queries",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 0,
        "y": 36
      },
      "hiddenSeries": false,
      "id": 28,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "IngestionUtilization",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Ingestion Utilization",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "percent",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 6,
        "y": 36
      },
      "hiddenSeries": false,
      "id": 29,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Maximum",
              "Minimum"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "IngestionLatencyInSeconds",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Ingestion Latency",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "s",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 12,
        "y": 36
      },
      "hiddenSeries": false,
      "id": 30,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Total"
            ],
            "aggregation": "Total",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Status",
                "value": "IngestionResultDetails"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "IngestionResult",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Ingestion Result",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 18,
        "y": 36
      },
      "hiddenSeries": false,
      "id": 31,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Total",
              "Maximum"
            ],
            "aggregation": "Total",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Database",
                "value": "Database"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "IngestionVolumeInMB",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Ingestion Volume",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "decbytes",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 0,
        "y": 46
      },
      "hiddenSeries": false,
      "id": 32,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Minimum",
              "Maximum"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "StreamingIngestDataRate",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Streaming Ingest Data Rate",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 6,
        "y": 46
      },
      "hiddenSeries": false,
      "id": 33,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average",
              "Minimum",
              "Maximum"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "StreamingIngestDuration",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Streaming Ingest Duration",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "ms",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 12,
        "y": 46
      },
      "hiddenSeries": false,
      "id": 34,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "None",
              "Average",
              "Minimum",
              "Maximum",
              "Total",
              "Count"
            ],
            "aggregation": "None",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [],
            "metricDefinition": "$ns",
            "metricName": "SteamingIngestRequestRate",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Streaming Ingest Request Rate",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "ms",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 6,
        "x": 18,
        "y": 46
      },
      "hiddenSeries": false,
      "id": 35,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Result",
                "value": "Result"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "StreamingIngestResults",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Streaming Ingest Result",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 9,
        "w": 12,
        "x": 0,
        "y": 56
      },
      "hiddenSeries": false,
      "id": 36,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Total",
              "Average",
              "Minimum",
              "Maximum"
            ],
            "aggregation": "Total",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "EventsProcessed",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Events Processed",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 9,
        "w": 12,
        "x": 12,
        "y": 56
      },
      "hiddenSeries": false,
      "id": 37,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Discovery Latency",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "datasource": "$ds",
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 65
      },
      "id": 40,
      "panels": [],
      "title": "Usage",
      "type": "row"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 14,
        "x": 0,
        "y": 66
      },
      "id": 43,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is KustoRunner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand \r\n    | where TimeGenerated > datetime(2020-09-09T09:30:00Z) \r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak) \r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State, FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest'\r\n    //| where totimespan(TotalCPU) > totimespan(0)\r\n    | summarize TotalCPU=max(TotalCPU) \r\n        , MemoryPeak=max(MemoryPeak)\r\n        by User, ApplicationName, CorrelationId \r\n;\r\nlet totalCPU = toscalar(dataset\r\n    | summarize sum((totimespan(TotalCPU) / 1s)));\r\nlet totalMemory = toscalar(dataset\r\n    | summarize sum(MemoryPeak));\r\nlet topMemory = \r\n    dataset\r\n    | top-nested 10000 of User with others=\"Others\" by sum(MemoryPeak), top-nested 10000 of ApplicationName with others=\"Others\" by sum(MemoryPeak)\r\n    | extend PercentOfTotalClusterMemoryUsed = aggregated_ApplicationName / toreal(totalMemory)\r\n;\r\nlet topCpu = \r\n    dataset\r\n    | top-nested 10000 of User with others=\"Others\" by sum(totimespan(TotalCPU) / 1s), top-nested 10000 of ApplicationName with others=\"Others\" by sum(totimespan(TotalCPU) / 1s)\r\n    | extend PercentOfTotalClusterCpuUsed = aggregated_ApplicationName / toreal(totalCPU)\r\n;\r\ntopMemory\r\n| join kind = fullouter(topCpu) on User, ApplicationName\r\n| extend BothPercentages = PercentOfTotalClusterMemoryUsed + PercentOfTotalClusterCpuUsed\r\n| top 10 by BothPercentages desc\r\n| extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n    ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n    User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n    User)\r\n| extend PercentOfTotalClusterMemoryUsed_display = iff(isnan(PercentOfTotalClusterMemoryUsed * 100), toreal(0), PercentOfTotalClusterMemoryUsed * 100)\r\n| extend PercentOfTotalClusterCpuUsed_display = iff(isnan(PercentOfTotalClusterCpuUsed * 100), toreal(0), PercentOfTotalClusterCpuUsed * 100)\r\n| where not (ApplicationName == \"Others\" and PercentOfTotalClusterMemoryUsed_display == 0 and PercentOfTotalClusterCpuUsed_display == 0)\r\n| project User, ApplicationName, PercentOfTotalClusterMemoryUsed_display, PercentOfTotalClusterCpuUsed_display",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Top resource consumers (within the CPU and memory consumption of the cluster)",
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 10,
        "x": 14,
        "y": 66
      },
      "id": 44,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest'\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | summarize Count=count() by User, ApplicationName\r\n    | project User, ApplicationName, Count\r\n    | extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n        User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters\r\n        User)\r\n    | top 10 by Count;\r\n//| order by Count desc\r\n// <Option #1 for top-nested> | top-nested 10 of User with others=\"Other Values\" by agg_User=sum(Count) desc;\r\n// <Option #2 for top-nested>| top-nested 10 of User by agg_User=sum(Count) desc, top-nested 5 of ApplicationName with others=\"Other applications\" by agg_App=sum(Count) desc\r\n// <Option #2 for top-nested>| where not (ApplicationName == \"Other applications\" and agg_App == 0)\r\n// <Option #2 for top-nested>| project-away agg_User;\r\ndataset\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Top principals and applications by command and query count",
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 0,
        "y": 70
      },
      "id": 38,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is KustoRunner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\",\r\n        ApplicationName)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest'\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | summarize Count=count() by ApplicationName\r\n    | project ApplicationName, Count\r\n    | order by Count desc\r\n    //| top-nested 10 of User with others=\"Other Values\" by agg_User=sum(Count) desc;\r\n    | top-nested 7 of ApplicationName with others=\"Other Values\"  by agg_App=sum(Count) desc;\r\n//|where not (ApplicationName == \"Other applications\" and agg_App == 0)\r\n//|project-away agg_User;\r\ndataset\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Top applications by command and query count",
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 8,
        "y": 70
      },
      "id": 41,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is KustoRunner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest'\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n        ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n        User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n        User)\r\n    | summarize Count=count() by User\r\n    | project User, Count\r\n    | order by Count desc\r\n    | top-nested 7 of User with others=\"Other Values\" by agg_User=sum(Count) desc;\r\ndataset\r\n\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Top principals by command and query count",
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 8,
        "x": 16,
        "y": 70
      },
      "id": 42,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is KustoRunner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest'\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | summarize Count=count() by CommandType\r\n    | project CommandType, Count\r\n    | order by Count desc\r\n    | top-nested 7 of CommandType with others=\"Other Values\"  by agg_App=sum(Count) desc;\r\ndataset\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Queries and top commands by command type",
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 14,
        "x": 0,
        "y": 75
      },
      "id": 45,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is KustoRunner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | where TimeGenerated > ago(17d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where TimeGenerated > ago(17d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend';\r\nlet Last24Hours =\r\n    FullList\r\n    | where StartedOn >= ago(1d) and StartedOn < now()\r\n    | summarize Count=count() by User, ApplicationName\r\n    | top 100 by Count desc\r\n;\r\nlet HistoricalDailyAverage =\r\n    FullList\r\n    | where StartedOn >= ago(16d) and StartedOn < ago(1d)\r\n    | summarize Count=count() / 15.0 by User, ApplicationName\r\n    | top 100 by Count desc\r\n;\r\nlet TimeRangeComparison =\r\n    Last24Hours\r\n    | join kind=leftouter (HistoricalDailyAverage) on User, ApplicationName\r\n    | project User=coalesce(User, User1), ApplicationName, Last24Hours=Count, HistoricalDailyAverage=round(Count1, 0)\r\n    | extend PercentChange=round((Last24Hours - HistoricalDailyAverage) / toreal(HistoricalDailyAverage), 2)\r\n    | top 10 by Last24Hours desc\r\n;\r\nTimeRangeComparison\r\n| extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n    ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n    User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n    User)\r\n| project User, ApplicationName, HistoricalDailyAverage=round(HistoricalDailyAverage, 0), Last24Hours, PercentChange\r\n| order by Last24Hours desc",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Changes in query count by principal (not affected by the the time range parameter)",
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 10,
        "x": 14,
        "y": 75
      },
      "id": 46,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Quert Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where LastUpdatedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\ndataset\r\n| where CommandType != 'TableSetOrAppend' and State == 'Failed'\r\n| summarize Count=count() by User, ApplicationName\r\n| top 10 by Count desc\r\n| extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n    ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n    User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n    User)\r\n| order by Count desc\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Failed queries",
      "transparent": true,
      "type": "table"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 0,
        "y": 79
      },
      "hiddenSeries": false,
      "id": 47,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | project User, StartedOn, ApplicationName, CommandType\r\n;\r\nlet Top =\r\n    dataset\r\n    | summarize Count=count() by User\r\n    | top 10 by Count desc\r\n    | extend OriginalUser = User\r\n    | extend Category=User\r\n;\r\nFullList\r\n| join kind=leftouter(Top) on $left.User == $right.OriginalUser\r\n| project User=coalesce(Category, 'Other'), ApplicationName, CommandType, StartedOn\r\n| extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n    ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n    User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n    User)\r\n| summarize count() by User, bin(StartedOn, 1h)\r\n| summarize sum(count_) by bin(StartedOn, 1h), tostring(User)\r\n| sort by StartedOn asc",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Command + query count by principal",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 8,
        "y": 79
      },
      "hiddenSeries": false,
      "id": 48,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | project User, ApplicationName, CommandType, StartedOn, MemoryPeak\r\n    | extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n        ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n        User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n        User)\r\n;\r\nlet Top =\r\n    FullList\r\n    | summarize Memory=sum(MemoryPeak) by User\r\n    | top 10 by Memory desc\r\n    | extend OriginalUser = User\r\n    | project OriginalUser, Category=User\r\n;\r\nFullList\r\n| join kind=leftouter(Top) on $left.User == $right.OriginalUser\r\n| project User=coalesce(Category, 'Other'), StartedOn, MemoryPeakGB=MemoryPeak / 1024.0 / 1024.0 / 1024.0\r\n| summarize MemoryPeakGB=sum(MemoryPeakGB) by User, bin(StartedOn, 1h)\r\n| summarize sum(MemoryPeakGB) by bin(StartedOn, 1h), tostring(User)\r\n| sort by StartedOn asc",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Total memory by principal",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 16,
        "y": 79
      },
      "hiddenSeries": false,
      "id": 49,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where StartedOn > ago(7d)\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | project User, ApplicationName, CommandType, StartedOn, TotalCPU\r\n    | extend User = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", strcat(\"Kusto Data Management \", \"(\", User, \")\"),\r\n        ApplicationName == \"KustoQueryRunner\", strcat(\"Kusto Query Runner \", \"(\", User, \")\"),\r\n        User == \"AAD app id=e0331ea9-83fc-4409-a17d-6375364c3280\", \"DataMap Agent 001 (app id: e0331ea9-83fc-4409-a17d-6375364c3280)\", // Used for internal MS clusters \r\n        User)\r\n;\r\nlet Top =\r\n    FullList\r\n    | summarize TotalCpu=sum(totimespan(TotalCPU)) by User\r\n    | top 10 by TotalCpu desc\r\n    | extend OriginalUser = User\r\n    | project OriginalUser, Category=User\r\n;\r\nFullList\r\n| join kind=leftouter(Top) on $left.User == $right.OriginalUser\r\n| project User=coalesce(Category, 'Other'), StartedOn, TotalCpuMinutes=totimespan(TotalCPU) / 1m\r\n| summarize TotalCpuMinutes=sum(TotalCpuMinutes) by User, bin(StartedOn, 1h)\r\n| top-nested of bin(StartedOn, 1h) by sum(TotalCpuMinutes), top-nested 5 of User with others=\"Other Values\" by sum_TotalCpuMinutes=sum(TotalCpuMinutes) desc\r\n| sort by StartedOn asc\r\n| project StartedOn, User, sum_TotalCpuMinutes\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Total CPU by principal",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 0,
        "y": 89
      },
      "hiddenSeries": false,
      "id": 51,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\", ApplicationName)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | project ApplicationName, StartedOn, CommandType, User\r\n;\r\nlet Top =\r\n    FullList\r\n    | summarize Count=count() by ApplicationName\r\n    | top 10 by Count desc\r\n    | extend Category=ApplicationName\r\n;\r\nFullList\r\n| join kind=leftouter(Top) on ApplicationName \r\n| project Application=coalesce(Category, '-'), CommandType, User, StartedOn\r\n| summarize count() by Application, bin(StartedOn, 1h)\r\n| summarize sum(count_) by bin(StartedOn, time(1h)), tostring(Application)\r\n| sort by StartedOn asc\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Command + query count by application",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 8,
        "y": 89
      },
      "hiddenSeries": false,
      "id": 52,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak) \r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\", ApplicationName)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | project ApplicationName, StartedOn, CommandType, User, MemoryPeak\r\n;\r\nlet Top =\r\n    FullList\r\n    | summarize Memory=sum(MemoryPeak) by ApplicationName\r\n    | top 10 by Memory desc\r\n    | extend Category=ApplicationName;\r\nFullList\r\n| join kind=inner(Top) on ApplicationName\r\n| project Application=coalesce(Category, '-'), CommandType, User, StartedOn, MemoryPeakMB=MemoryPeak / 1024.0 / 1024.0\r\n| summarize MemoryPeakMB=sum(MemoryPeakMB) by Application, bin(StartedOn, 1h)\r\n| summarize sum(MemoryPeakMB) by bin(StartedOn, time(1h)), tostring(Application)\r\n| sort by StartedOn asc\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Total memory by application",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 16,
        "y": 89
      },
      "hiddenSeries": false,
      "id": 50,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\", ApplicationName)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\nlet FullList = dataset\r\n    | where CommandType != 'TableSetOrAppend'\r\n    | project ApplicationName, CommandType, User, StartedOn, TotalCPU\r\n;\r\nlet Top =\r\n    FullList\r\n    | summarize TotalCPU=sum(totimespan(TotalCPU)) by ApplicationName\r\n    | top 10 by TotalCPU desc\r\n    | extend Category=ApplicationName\r\n;\r\nFullList\r\n| join kind=inner(Top) on ApplicationName\r\n| project Application=coalesce(Category, '-'), CommandType, User, StartedOn, TotalCpuMinutes=totimespan(TotalCPU) / 1m\r\n| summarize TotalCpuMinutes=sum(TotalCpuMinutes) by Application, bin(StartedOn, 1h)\r\n| summarize sum(TotalCpuMinutes) by bin(StartedOn, time(1h)), tostring(Application)\r\n| sort by StartedOn asc\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Total CPU by application",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 0,
        "y": 99
      },
      "hiddenSeries": false,
      "id": 53,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\ndataset\r\n| where CommandType != 'TableSetOrAppend' \r\n| top-nested of bin(StartedOn, time(1h)) by count(), top-nested 5 of CommandType by count_=count() desc\r\n| sort by StartedOn asc\r\n| project StartedOn, CommandType, count_\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Queries + command count by type",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 8,
        "y": 99
      },
      "hiddenSeries": false,
      "id": 54,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak) \r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\ndataset\r\n| where CommandType != 'TableSetOrAppend' \r\n| extend MemoryPeakGB=MemoryPeak / 1024.0 / 1024.0 / 1024.0\r\n| top-nested of bin(StartedOn, time(1h)) by sum(MemoryPeakGB), top-nested 5 of CommandType with others=\"Other Values\" by sum_MemoryPeakGB=sum(MemoryPeakGB) desc\r\n| sort by StartedOn asc\r\n| project StartedOn, CommandType, sum_MemoryPeakGB\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Total memory by type",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 8,
        "x": 16,
        "y": 99
      },
      "hiddenSeries": false,
      "id": 55,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet CommandTable = ADXCommand\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak) \r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | project-away ResourceUtilization;\r\nlet QueryTable = ADXQuery\r\n    | where StartedOn > ago(7d)\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | extend MemoryPeak = tolong(MemoryPeak)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | extend CommandType = 'Query';\r\nlet dataset_commands_queries = CommandTable\r\n    | union (QueryTable)\r\n    | project CommandType, DatabaseName, StartedOn, LastUpdatedOn, Duration, State,\r\n        FailureReason, RootActivityId, User, ApplicationName, Principal, TotalCPU, MemoryPeak, CorrelationId, cluster_name;\r\nlet dataset = dataset_commands_queries\r\n    | where cluster_name == 'mitulktest';\r\ndataset\r\n| where CommandType != 'TableSetOrAppend' \r\n| extend TotalCpuMinutes = totimespan(TotalCPU) / 1m\r\n| top-nested of bin(StartedOn, time(1h)) by sum(TotalCpuMinutes), top-nested 5 of CommandType with others=\"Other Values\" by sum_TotalCpuMinutes=sum(TotalCpuMinutes) desc\r\n| sort by StartedOn asc\r\n| project StartedOn, CommandType, sum_TotalCpuMinutes\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Total CPU by type",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 8,
        "x": 0,
        "y": 109
      },
      "id": 56,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet commandTable = \r\n    ADXCommand \r\n    | where StartedOn > ago(7d)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | project User, StartedOn, ApplicationName, CommandType, WorkloadGroup\r\n;\r\nlet queryTable = \r\n    ADXQuery \r\n    | where StartedOn > ago(7d)\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | extend CommandType = 'Query'\r\n    | project User, StartedOn, ApplicationName, CommandType, WorkloadGroup;\r\nlet FullList = commandTable\r\n    | union (queryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\", ApplicationName)\r\n    | project User, StartedOn, ApplicationName, CommandType, WorkloadGroup;\r\nlet Top =\r\n    FullList\r\n    | summarize Count=count() by WorkloadGroup\r\n    | top 10 by Count desc\r\n    | distinct WorkloadGroup\r\n;\r\nFullList\r\n| project WorkloadGroup = iff((WorkloadGroup in(Top)) == true, WorkloadGroup, 'Other'), CommandType, StartedOn\r\n| make-series count() on StartedOn from ago(7d) to now() step 1h by WorkloadGroup\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Command + query count by workload group",
      "transformations": [],
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 8,
        "x": 8,
        "y": 109
      },
      "id": 57,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet commandTable = \r\n    ADXCommand\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where StartedOn > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | extend MemoryPeak = tolong(ResourceUtilization.MemoryPeak)\r\n    | project User, ApplicationName, CommandType, StartedOn, MemoryPeak, WorkloadGroup\r\n;\r\nlet queryTable = \r\n    ADXQuery \r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where StartedOn > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | extend CommandType = 'Query'\r\n    | project User, ApplicationName, CommandType, StartedOn, MemoryPeak, WorkloadGroup;\r\nlet FullList = commandTable\r\n    | union (queryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\", ApplicationName)\r\n    | project User, ApplicationName, CommandType, StartedOn, MemoryPeak, WorkloadGroup;\r\nlet Top =\r\n    FullList\r\n    | summarize Memory=sum(MemoryPeak) by WorkloadGroup\r\n    | top 10 by Memory desc\r\n    | distinct WorkloadGroup\r\n;\r\nFullList\r\n| project WorkloadGroup = iff((WorkloadGroup in(Top)) == true, WorkloadGroup, 'Other'), CommandType, User, StartedOn, MemoryPeakGB=MemoryPeak / 1024.0 / 1024.0 / 1024.0\r\n| make-series MemoryPeakGB=sum(MemoryPeakGB) on StartedOn from ago(7d) to now() step 1h by WorkloadGroup",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Total memory by workload group",
      "transformations": [],
      "transparent": true,
      "type": "table"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 8,
        "x": 16,
        "y": 109
      },
      "id": 58,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let system_databases = dynamic(['KustoMonitoringPersistentDatabase', '$systemdb']); \r\nlet system_users = dynamic(['AAD app id=b753584e-c468-4503-852a-374280ce7a62', 'KustoServiceBuiltInPrincipal']); // b753584e-c468-4503-852a-374280ce7a62 is Kusto Query Runner\r\nlet system_cluster_management_applications = dynamic(['Kusto.WinSvc.CM.Svc']); // Kusto Cluster Management\r\nlet commandTable = \r\n    ADXCommand\r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where StartedOn > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | project User, ApplicationName, CommandType, StartedOn, TotalCPU, WorkloadGroup\r\n;\r\nlet queryTable = \r\n    ADXQuery \r\n    | where ((false == \"false\" and ApplicationName != 'Kusto.WinSvc.DM.Svc') or false == \"true\")\r\n    | where DatabaseName !in (system_databases) and User !in (system_users) and ApplicationName !in (system_cluster_management_applications)\r\n    | where StartedOn > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | extend CommandType = 'Query'\r\n    | project User, ApplicationName, CommandType, StartedOn, TotalCPU, WorkloadGroup;\r\nlet FullList = commandTable\r\n    | union (queryTable)\r\n    | extend ApplicationName = case(ApplicationName == \"Kusto.WinSvc.DM.Svc\", \"Kusto Data Management\", ApplicationName)\r\n    | project User, ApplicationName, CommandType, StartedOn, totimespan(TotalCPU), WorkloadGroup;\r\nlet Top =\r\n    FullList\r\n    | summarize TotalCpu=sum(TotalCPU) by WorkloadGroup\r\n    | top 10 by TotalCpu desc\r\n    | distinct WorkloadGroup\r\n;\r\nFullList\r\n| project WorkloadGroup = iff((WorkloadGroup in(Top)) == true, WorkloadGroup, 'Other'), StartedOn, TotalCpuMinutes=totimespan(TotalCPU) / 1m\r\n| make-series TotalCpuMinutes=sum(TotalCpuMinutes) on StartedOn from ago(7d) to now() step 1h by WorkloadGroup",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Total CPU by workload group",
      "transformations": [],
      "transparent": true,
      "type": "table"
    },
    {
      "collapsed": false,
      "datasource": "$ds",
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 113
      },
      "id": 60,
      "panels": [],
      "title": "Tables",
      "type": "row"
    },
    {
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 114
      },
      "id": 61,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "ADXTableDetails \r\n| where TimeGenerated >= ago(1d)\r\n| project TimeGenerated,\r\n    DatabaseName,\r\n    TableName,\r\n    RetentionPolicyOrigin,\r\n    CachingPolicyOrigin,\r\n    OriginalSize = TotalOriginalSize, \r\n    TotalExtentSize, \r\n    HotExtentSize = HotExtentSize, \r\n    RowCount = TotalRowCount, \r\n    ExtentCount = TotalExtentCount,\r\n    SoftDelete = format_timespan(totimespan(todynamic(RetentionPolicy).SoftDeletePeriod), 'd'),\r\n    HotCache = format_timespan(totimespan(todynamic(CachingPolicy).DataHotSpan), 'd')      \r\n| extend CompressionRatio = round(toreal(OriginalSize) / TotalExtentSize, 1)\r\n| extend SoftDelete = iff(RetentionPolicyOrigin == \"default\" and isempty(SoftDelete), \"unlimited\", SoftDelete)\r\n| extend HotCache = iff(CachingPolicyOrigin == \"default\" and isempty(HotCache), \"unlimited\", HotCache)\r\n| summarize arg_max(TimeGenerated, *) by DatabaseName, TableName\r\n| top 351 by HotExtentSize desc\r\n| project DatabaseName,\r\n    TableName,\r\n    RowCount, \r\n    HotExtentSize,\r\n    SoftDelete,\r\n    HotCache,\r\n    OriginalSize, \r\n    TotalExtentSize,\r\n    CompressionRatio, \r\n    ExtentCount\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "  Table details",
      "transformations": [],
      "transparent": true,
      "type": "table"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 12,
        "x": 0,
        "y": 117
      },
      "hiddenSeries": false,
      "id": 62,
      "legend": {
        "avg": false,
        "current": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let TotalRowCountTable = ADXTableDetails\r\n    | where TimeGenerated > ago(7d)\r\n    | project Time = TimeGenerated, Category = strcat(TableName, \" (DB: \", DatabaseName, \")\"), Value = toreal(TotalRowCount);\r\nlet topCategories = \r\n    TotalRowCountTable\r\n    | summarize sum(Value) by Category\r\n    | top 9 by sum_Value desc\r\n;\r\nTotalRowCountTable\r\n| join kind = leftouter (topCategories) on Category\r\n| project Category = coalesce(Category1, 'Other Tables'), Value, Time\r\n| summarize max(Value) by Category, bin(Time, 1h)\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Top tables by row count",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transformations": [],
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 12,
        "x": 12,
        "y": 117
      },
      "hiddenSeries": false,
      "id": 63,
      "legend": {
        "avg": false,
        "current": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let HotExtentSizeTable = ADXTableDetails\r\n    | where TimeGenerated > ago(7d)\r\n    | project Time = TimeGenerated, Category = strcat(TableName, \" (DB: \", DatabaseName, \")\"), Value = HotExtentSize;\r\nlet topCategories = \r\n    HotExtentSizeTable\r\n    | summarize sum(Value) by Category\r\n    | top 9 by sum_Value desc;\r\nHotExtentSizeTable\r\n| join kind = leftouter (topCategories) on Category\r\n| project Category = coalesce(Category1, 'Other Tables'), Value, Time\r\n| summarize max(Value) by Category, bin(Time, 1h)\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Top tables by hot cache size",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transformations": [],
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 12,
        "x": 0,
        "y": 127
      },
      "hiddenSeries": false,
      "id": 64,
      "legend": {
        "avg": false,
        "current": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let TotalExtentCountTable = ADXTableDetails\r\n    | where TimeGenerated > ago(7d)\r\n    | project Time = TimeGenerated, Category = strcat(TableName, \" (DB: \", DatabaseName, \")\"), Value = toreal(TotalExtentCount);\r\nlet topCategories = \r\n    TotalExtentCountTable\r\n    | summarize sum(Value) by Category\r\n    | top 9 by sum_Value desc\r\n;\r\nTotalExtentCountTable\r\n| join kind = leftouter (topCategories) on Category\r\n| project Category = coalesce(Category1, 'Other Tables'), Value, Time\r\n| summarize max(Value) by Category, bin(Time, 1h)\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Top tables by extent count",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transformations": [],
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 10,
        "w": 12,
        "x": 12,
        "y": 127
      },
      "hiddenSeries": false,
      "id": 65,
      "legend": {
        "avg": false,
        "current": true,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let TotalExtentSizeTable = ADXTableDetails\r\n    | where TimeGenerated > ago(7d)\r\n    | project Time = TimeGenerated, Category = strcat(TableName, \" (DB: \", DatabaseName, \")\"), Value = TotalExtentSize;\r\nlet topCategories = \r\n    TotalExtentSizeTable\r\n    | summarize sum(Value) by Category\r\n    | top 9 by sum_Value desc;\r\nTotalExtentSizeTable\r\n| join kind = leftouter (topCategories) on Category\r\n| project Category = coalesce(Category1, 'Other Tables'), Value, Time\r\n| summarize max(Value) by Category, bin(Time, 1h)\r\n",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Top tables by extent size",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transformations": [],
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "collapsed": false,
      "datasource": "$ds",
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 137
      },
      "id": 67,
      "panels": [],
      "title": "Cache",
      "type": "row"
    },
    {
      "datasource": "$ds",
      "description": "This page presents data based on the Time Range parameter. You can change the Time Range parameter to present data starting from 05/25/21 ,11:38 PM (based on your oldest diagnostic logs data).\n  The table names and the Cache policy column refreshes every 8 hours.\n  Notice the queries statistics presented are based only on queries that scanned data. For instance queries that failed, and queries with time operator of future don't scan any data therefore would not be part of the queries statistics presented.",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 24,
        "x": 0,
        "y": 138
      },
      "id": 72,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "let TableUsageStatsWithLookBack = ADXTableUsageStatistics\r\n    | where TimeGenerated > ago(7d)\r\n    | extend LookBackPeriod = datetime_diff('day', StartedOn, MinCreatedOn) \r\n    | summarize CountQueries=count() by DatabaseName, TableName, LookBackPeriod;\r\nlet sumAllQueries = TableUsageStatsWithLookBack\r\n    | summarize sumQueries=sum(CountQueries) by DatabaseName, TableName;\r\nlet percentileLookBackTable= TableUsageStatsWithLookBack\r\n    | summarize percentile_LookbackDuration_ = percentilesw(LookBackPeriod, CountQueries, 95) by DatabaseName, TableName;\r\nlet defaultRetention = 365d * 10;\r\nADXTableDetails \r\n| where TimeGenerated >= ago(1d) // so we filter out tables that are deprecated\r\n| summarize arg_max(TimeGenerated, *) by DatabaseName, TableName\r\n| extend RetentionPolicy = iff(isnull(RetentionPolicy) or RetentionPolicy == \"null\", defaultRetention, totimespan(parse_json(tostring(RetentionPolicy)).SoftDeletePeriod)),\r\n    CachingPolicy = iff(isnull(CachingPolicy) or RetentionPolicy == \"null\", defaultRetention, totimespan(parse_json(tostring(CachingPolicy)).DataHotSpan))\r\n| extend ActiveCachingPolicy = min_of(CachingPolicy, RetentionPolicy)\r\n| join kind = leftouter (percentileLookBackTable) on DatabaseName, TableName\r\n| join kind = leftouter (sumAllQueries) on DatabaseName, TableName\r\n| where DatabaseName != \"KustoMonitoringPersistentDatabase\"\r\n| top 351 by HotExtentSize desc\r\n| project DatabaseName, TableName, CacheSize = HotExtentSize, format_timespan(ActiveCachingPolicy, 'd'),  \r\n    sumQueries=sumQueries, QueryPeriod = percentile_LookbackDuration_",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Table usage details",
      "transformations": [],
      "transparent": true,
      "type": "table"
    },
    {
      "collapsed": false,
      "datasource": "$ds",
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 142
      },
      "id": 69,
      "panels": [],
      "title": "Ingestion",
      "type": "row"
    },
    {
      "datasource": "$ds",
      "description": "",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": null,
            "filterable": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 4,
        "w": 8,
        "x": 0,
        "y": 143
      },
      "id": 73,
      "options": {
        "showHeader": true
      },
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//SucceededIngestion\r\n//| where TimeGenerated > ago(7d)\r\n//| parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n//| where cluster_name == 'mitulktest'\r\n//| summarize count=dcount(IngestionSourcePath) by Database, Table\r\n//| order by ['count'],Database, Table\r\nlet tenant=\r\n    FailedIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | distinct TenantId\r\n    | take 1; //choose one tenant as logs are transferred to many tenants which represents workSpace\r\nlet failures = FailedIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | where TenantId == toscalar(tenant)\r\n    | summarize f_count=count() by Database, Table;\r\nlet tenant_success=\r\n    SucceededIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | distinct TenantId\r\n    | take 1; //choose one tenant as logs are transferred to many tenants which represents workSpace\r\nlet success = SucceededIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | where TenantId == toscalar(tenant_success)\r\n    | summarize s_count=count() by Database, Table;\r\nsuccess\r\n| join kind=leftouter failures on Database, Table\r\n| extend f_count = iif(isnull(f_count), 0, f_count)\r\n| extend s_count = iif(isnull(s_count), 0, s_count)\r\n| extend overall = iif(isnull(s_count), 0.0, s_count * 100.0 / (s_count + f_count))\r\n| project Database, Table, s_count, overall\r\n| order by s_count, Database, Table",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [],
            "dimensions": [
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "DiscoveryLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Log Analytics",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "timeFrom": null,
      "timeShift": null,
      "title": "Succeeded ingestions by table",
      "transformations": [],
      "transparent": true,
      "type": "table"
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "description": "Time from when a message is discovered by Azure Data Explorer, until its content is received by the Engine Storage for processing.",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 9,
        "w": 8,
        "x": 8,
        "y": 143
      },
      "hiddenSeries": false,
      "id": 74,
      "legend": {
        "avg": true,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": false,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//SucceededIngestion\r\n//| where TimeGenerated > ago(7d)\r\n//| parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n//| where cluster_name == 'mitulktest'\r\n//| summarize count=dcount(IngestionSourcePath) by Database, Table\r\n//| order by ['count'],Database, Table\r\nlet tenant=\r\n    FailedIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | distinct TenantId\r\n    | take 1; //choose one tenant as logs are transferred to many tenants which represents workSpace\r\nlet failures = FailedIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | where TenantId == toscalar(tenant)\r\n    | summarize f_count=count() by Database, Table;\r\nlet tenant_success=\r\n    SucceededIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | distinct TenantId\r\n    | take 1; //choose one tenant as logs are transferred to many tenants which represents workSpace\r\nlet success = SucceededIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | where TenantId == toscalar(tenant_success)\r\n    | summarize s_count=count() by Database, Table;\r\nsuccess\r\n| join kind=leftouter failures on Database, Table\r\n| extend f_count = iif(isnull(f_count), 0, f_count)\r\n| extend s_count = iif(isnull(s_count), 0, s_count)\r\n| extend overall = iif(isnull(s_count), 0.0, s_count * 100.0 / (s_count + f_count))\r\n| project Database, Table, s_count, overall\r\n| order by s_count, Database, Table",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Average"
            ],
            "aggregation": "Average",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [
              {
                "dimension": "ComponentType",
                "filter": "StorageEngine",
                "operator": "eq"
              }
            ],
            "dimensions": [
              {
                "text": "Database",
                "value": "Database"
              },
              {
                "text": "Component Type",
                "value": "ComponentType"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "StageLatency",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Stage latency (accumulative latency)",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transformations": [],
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    },
    {
      "aliasColors": {},
      "bars": false,
      "dashLength": 10,
      "dashes": false,
      "datasource": "$ds",
      "description": "Number of blobs processed by the Storage Engine.",
      "fieldConfig": {
        "defaults": {
          "color": {},
          "custom": {},
          "thresholds": {
            "mode": "absolute",
            "steps": []
          }
        },
        "overrides": []
      },
      "fill": 1,
      "fillGradient": 0,
      "gridPos": {
        "h": 9,
        "w": 8,
        "x": 16,
        "y": 143
      },
      "hiddenSeries": false,
      "id": 75,
      "legend": {
        "avg": false,
        "current": false,
        "max": false,
        "min": false,
        "show": true,
        "total": true,
        "values": true
      },
      "lines": true,
      "linewidth": 1,
      "nullPointMode": "null",
      "options": {
        "alertThreshold": true
      },
      "percentage": false,
      "pointradius": 2,
      "points": false,
      "renderer": "flot",
      "seriesOverrides": [],
      "spaceLength": 10,
      "stack": false,
      "steppedLine": false,
      "targets": [
        {
          "appInsights": {
            "dimension": [],
            "metricName": "select",
            "timeGrain": "auto"
          },
          "azureLogAnalytics": {
            "query": "//SucceededIngestion\r\n//| where TimeGenerated > ago(7d)\r\n//| parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n//| where cluster_name == 'mitulktest'\r\n//| summarize count=dcount(IngestionSourcePath) by Database, Table\r\n//| order by ['count'],Database, Table\r\nlet tenant=\r\n    FailedIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | distinct TenantId\r\n    | take 1; //choose one tenant as logs are transferred to many tenants which represents workSpace\r\nlet failures = FailedIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | where TenantId == toscalar(tenant)\r\n    | summarize f_count=count() by Database, Table;\r\nlet tenant_success=\r\n    SucceededIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | distinct TenantId\r\n    | take 1; //choose one tenant as logs are transferred to many tenants which represents workSpace\r\nlet success = SucceededIngestion\r\n    | where TimeGenerated > ago(7d)\r\n    | parse _ResourceId with * \"providers/microsoft.kusto/clusters/\" cluster_name\r\n    | where cluster_name == 'mitulktest'\r\n    | where TenantId == toscalar(tenant_success)\r\n    | summarize s_count=count() by Database, Table;\r\nsuccess\r\n| join kind=leftouter failures on Database, Table\r\n| extend f_count = iif(isnull(f_count), 0, f_count)\r\n| extend s_count = iif(isnull(s_count), 0, s_count)\r\n| extend overall = iif(isnull(s_count), 0.0, s_count * 100.0 / (s_count + f_count))\r\n| project Database, Table, s_count, overall\r\n| order by s_count, Database, Table",
            "resultFormat": "time_series",
            "workspace": "$ws"
          },
          "azureMonitor": {
            "aggOptions": [
              "Total",
              "Average",
              "Minimum",
              "Maximum"
            ],
            "aggregation": "Total",
            "allowedTimeGrainsMs": [
              60000,
              300000,
              900000,
              1800000,
              3600000,
              21600000,
              43200000,
              86400000
            ],
            "dimensionFilter": "*",
            "dimensionFilters": [
              {
                "dimension": "ComponentType",
                "filter": "StorageEngine",
                "operator": "eq"
              }
            ],
            "dimensions": [
              {
                "text": "Database",
                "value": "Database"
              },
              {
                "text": "Component Type",
                "value": "ComponentType"
              },
              {
                "text": "Component Name",
                "value": "ComponentName"
              }
            ],
            "metricDefinition": "$ns",
            "metricName": "BlobsProcessed",
            "metricNamespace": "Microsoft.Kusto/clusters",
            "resourceGroup": "$rg",
            "resourceName": "$resource",
            "timeGrain": "auto",
            "timeGrains": [
              {
                "text": "auto",
                "value": "auto"
              },
              {
                "text": "1 minute",
                "value": "PT1M"
              },
              {
                "text": "5 minutes",
                "value": "PT5M"
              },
              {
                "text": "15 minutes",
                "value": "PT15M"
              },
              {
                "text": "30 minutes",
                "value": "PT30M"
              },
              {
                "text": "1 hour",
                "value": "PT1H"
              },
              {
                "text": "6 hours",
                "value": "PT6H"
              },
              {
                "text": "12 hours",
                "value": "PT12H"
              },
              {
                "text": "1 day",
                "value": "P1D"
              }
            ],
            "top": "10"
          },
          "queryType": "Azure Monitor",
          "refId": "A",
          "subscription": "$sub"
        }
      ],
      "thresholds": [],
      "timeFrom": null,
      "timeRegions": [],
      "timeShift": null,
      "title": "Data Processed Successfuly",
      "tooltip": {
        "shared": true,
        "sort": 0,
        "value_type": "individual"
      },
      "transformations": [],
      "transparent": true,
      "type": "graph",
      "xaxis": {
        "buckets": null,
        "mode": "time",
        "name": null,
        "show": true,
        "values": []
      },
      "yaxes": [
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        },
        {
          "format": "short",
          "label": null,
          "logBase": 1,
          "max": null,
          "min": null,
          "show": true
        }
      ],
      "yaxis": {
        "align": false,
        "alignLevel": null
      }
    }
  ],
  "refresh": false,
  "schemaVersion": 27,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": [
      {
        "current": {},
        "description": null,
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Datasource",
        "multi": false,
        "name": "ds",
        "options": [],
        "query": "grafana-azure-monitor-datasource",
        "queryValue": "",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "type": "datasource"
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "$ds",
        "definition": "subscriptions()",
        "description": null,
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Subscription",
        "multi": false,
        "name": "sub",
        "options": [],
        "query": "subscriptions()",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 5,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "$ds",
        "definition": "ResourceGroups($sub)",
        "description": null,
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Resource Group",
        "multi": false,
        "name": "rg",
        "options": [],
        "query": "ResourceGroups($sub)",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 5,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {
          "selected": false,
          "text": "Microsoft.Kusto/clusters",
          "value": "Microsoft.Kusto/clusters"
        },
        "description": null,
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Namespace",
        "multi": false,
        "name": "ns",
        "options": [
          {
            "selected": true,
            "text": "Microsoft.Kusto/clusters",
            "value": "Microsoft.Kusto/clusters"
          }
        ],
        "query": "Microsoft.Kusto/clusters",
        "skipUrlSync": false,
        "type": "custom"
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "$ds",
        "definition": "ResourceNames($sub, $rg, $ns)",
        "description": null,
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Resource",
        "multi": false,
        "name": "resource",
        "options": [],
        "query": "ResourceNames($sub, $rg, $ns)",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 5,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      },
      {
        "allValue": null,
        "current": {},
        "datasource": "$ds",
        "definition": "workspaces()",
        "description": null,
        "error": null,
        "hide": 0,
        "includeAll": false,
        "label": "Workspace",
        "multi": false,
        "name": "ws",
        "options": [],
        "query": "workspaces()",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 5,
        "tagValuesQuery": "",
        "tags": [],
        "tagsQuery": "",
        "type": "query",
        "useTags": false
      }
    ]
  },
  "time": {
    "from": "now-12h",
    "to": "now"
  },
  "title": "Azure / Insights / Data Explorer Clusters",
  "uid": "8UDB1s3Gk",
  "version": 10,
  "description": "The dashboard provides insights of Azure Data Explorer Cluster Resource overview, key mettrics, usage, tables, cache and ingestion.",
  "gnetId": 14761
}