Cloudy Journey: Building Azure workbook to visualize your data

Azure Monitor Log Analytics can collect large amounts of data and it is important to have effective methods to make it easy to visualize it in a simple way. Azure Workbooks are part of the Azure Monitor services and offer a solution to visualize different data sources across your Azure tenant.

Visualizations are great feature of workbooks that provide a rich set of capabilities to show up data:

Text
Charts
Grids
Tiles
Trees
Graphs
Composite bar
Honeycomb
Map

Workbooks use the KQL query language to explore the data. KQL uses schema entities that are organized in a hierarchy like SQLs: databases, tables, and columns. In this article, I will explain how to create Azure workbook from scratch, but I will not go into the details of the KQL language, I will do it in another article.

Getting started

Open the Azure Portal, go to your Log Analytics Workspace, and click Workbooks

Open the Azure Portal, go to your Log Analytics Workspace, and click Workbooks

The workbook can be composed of different sections that show graphs, tables, text etc.

The workbook can be composed of different sections that show graphs, tables, text

In this example, select “Add text”. A new section appears to write your text using the Markdown language. Once you are happy with your text, you can click “Done Editing”

Editing text item

This text section can be used to give information about your workbook. In this example, my workbook will query information across multiple workspaces.

Azure workbook

Now, click Add and select Parameters. If you work with multiple subscriptions/workspaces, you probably want to query different workspaces from a single workbook instead of creating multiple workbooks. This parameter will help us to select the desired workspace.

Enter the parameter name and the display name, then edit the parameter:

Enter the parameter name and the display name, then edit the parameter

Choose which options are interesting for you, in my case, I selected Required and Allow multiple selections. The important thing is to select parameter type = resource picker.

Then, select Query and enter the following query:

Select Query and enter the following query

Once you have saved the parameter, you should see the new parameter called “workspace” and you should be able to query multiple workspaces:

Once you have saved the parameter, you should see the new parameter called “workspace”

We can add a new text section and select the text style named “Upsell”. That could be interesting for changing log information.

We can add a new text section and select the text style named “Upsell”

Output should be like the following screenshot:

Change Log

Now, add a Query and customize the parameters:

Datasource = logs
Resource type = Log analytics
Log Analytics workspace = workspaces (which is the parameter name created previously)
Time range = Set in query
Visualization = Pie chart
Size = large

The query is based on the Azure Update Management service to visualize the Windows Updates status.

The query is based on the Azure Update Management service to visualize the Windows Updates status

Save the query and confirm the result.

Save the query and confirm the result

You may need a way to segment information in different sections in your Azure workbooks. We can build tabs very simply using the following option:

We can build tabs very simply using the following option

Add two tabs :

Tab name = Tab1 and Tab2 (this name will be visible in your workbook)
Action = Set a parameter value
Value = view (but you can enter whatever you want)
Settings = tab1 and tab2 (but you can enter whatever you want)

Add two tabs

You should see two tabs appear

Then, we need to organize resources in both tabs. Edit a text section created earlier and go to Advanced Settings, click Make this item conditionally visible.