Skip to content

Commit bd3e307

Browse files
v-albemiv-albemi
authored
Merge pull request #112126 from yossi-y/patch-77
Added function to template
2 parents 87e7137 + 041d23d commit bd3e307

File tree

1 file changed

+92
-71
lines changed

1 file changed

+92
-71
lines changed

‎articles/azure-monitor/platform/template-workspace-configuration.md

Lines changed: 92 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -176,14 +176,15 @@ The following template sample illustrates how to:
176176

177177
1. Add solutions to the workspace
178178
2. Create saved searches. To ensure that deployments don't override saved searches accidentally, an eTag property should be added in the "savedSearches" resource to override and maintain the idempotency of saved searches.
179-
3. Create a computer group
180-
4. Enable collection of IIS logs from computers with the Windows agent installed
181-
5. Collect Logical Disk perf counters from Linux computers (% Used Inodes; Free Megabytes; % Used Space; Disk Transfers/sec; Disk Reads/sec; Disk Writes/sec)
182-
6. Collect syslog events from Linux computers
183-
7. Collect Error and Warning events from the Application Event Log from Windows computers
184-
8. Collect Memory Available Mbytes performance counter from Windows computers
185-
9. Collect IIS logs and Windows Event logs written by Azure diagnostics to a storage account
186-
10. Collect custom logs from Windows computer
179+
3. Create saved function. The eTag should be added to override function and maintain idempotency.
180+
4. Create a computer group
181+
5. Enable collection of IIS logs from computers with the Windows agent installed
182+
6. Collect Logical Disk perf counters from Linux computers (% Used Inodes; Free Megabytes; % Used Space; Disk Transfers/sec; Disk Reads/sec; Disk Writes/sec)
183+
7. Collect syslog events from Linux computers
184+
8. Collect Error and Warning events from the Application Event Log from Windows computers
185+
9. Collect Memory Available Mbytes performance counter from Windows computers
186+
10. Collect IIS logs and Windows Event logs written by Azure diagnostics to a storage account
187+
11. Collect custom logs from Windows computer
187188

188189
```json
189190
{
@@ -224,74 +225,74 @@ The following template sample illustrates how to:
224225
"type": "bool",
225226
"defaultValue": "[bool('false')]",
226227
"metadata": {
227-
"description": "If set to true when changing retention to 30 days, older data will be immediately deleted. Use this with extreme caution. This only applies when retention is being set to 30 days."
228+
"description": "If set to true, changing retention to 30 days will immediately delete older data. Use this with extreme caution. This only applies when retention is being set to 30 days."
228229
}
229230
},
230231
"location": {
231232
"type": "string",
232233
"allowedValues": [
233-
"australiacentral",
234-
"australiaeast",
235-
"australiasoutheast",
234+
"australiacentral",
235+
"australiaeast",
236+
"australiasoutheast",
236237
"brazilsouth",
237-
"canadacentral",
238-
"centralindia",
239-
"centralus",
240-
"eastasia",
241-
"eastus",
242-
"eastus2",
243-
"francecentral",
244-
"japaneast",
245-
"koreacentral",
246-
"northcentralus",
247-
"northeurope",
248-
"southafricanorth",
249-
"southcentralus",
250-
"southeastasia",
251-
"uksouth",
252-
"ukwest",
253-
"westcentralus",
254-
"westeurope",
255-
"westus",
238+
"canadacentral",
239+
"centralindia",
240+
"centralus",
241+
"eastasia",
242+
"eastus",
243+
"eastus2",
244+
"francecentral",
245+
"japaneast",
246+
"koreacentral",
247+
"northcentralus",
248+
"northeurope",
249+
"southafricanorth",
250+
"southcentralus",
251+
"southeastasia",
252+
"uksouth",
253+
"ukwest",
254+
"westcentralus",
255+
"westeurope",
256+
"westus",
256257
"westus2"
257258
],
258259
"metadata": {
259260
"description": "Specifies the location in which to create the workspace."
260261
}
261262
},
262263
"applicationDiagnosticsStorageAccountName": {
263-
"type": "string",
264-
"metadata": {
265-
"description": "Name of the storage account with Azure diagnostics output"
266-
}
264+
"type": "string",
265+
"metadata": {
266+
"description": "Name of the storage account with Azure diagnostics output"
267+
}
267268
},
268269
"applicationDiagnosticsStorageAccountResourceGroup": {
269-
"type": "string",
270-
"metadata": {
271-
"description": "The resource group name containing the storage account with Azure diagnostics output"
272-
}
270+
"type": "string",
271+
"metadata": {
272+
"description": "The resource group name containing the storage account with Azure diagnostics output"
273+
}
273274
},
274275
"customLogName": {
275-
"type": "string",
276-
"metadata": {
277-
"description": "The custom log name"
276+
"type": "string",
277+
"metadata": {
278+
"description": "The custom log name"
278279
}
279-
}
280+
}
281+
},
282+
"variables": {
283+
"Updates": {
284+
"Name": "[Concat('Updates', '(', parameters('workspaceName'), ')')]",
285+
"GalleryName": "Updates"
280286
},
281-
"variables": {
282-
"Updates": {
283-
"Name": "[Concat('Updates', '(', parameters('workspaceName'), ')')]",
284-
"GalleryName": "Updates"
285-
},
286-
"AntiMalware": {
287-
"Name": "[concat('AntiMalware', '(', parameters('workspaceName'), ')')]",
288-
"GalleryName": "AntiMalware"
289-
},
290-
"SQLAssessment": {
291-
"Name": "[Concat('SQLAssessment', '(', parameters('workspaceName'), ')')]",
292-
"GalleryName": "SQLAssessment"
293-
},
294-
"diagnosticsStorageAccount": "[resourceId(parameters('applicationDiagnosticsStorageAccountResourceGroup'), 'Microsoft.Storage/storageAccounts', parameters('applicationDiagnosticsStorageAccountName'))]"
287+
"AntiMalware": {
288+
"Name": "[concat('AntiMalware', '(', parameters('workspaceName'), ')')]",
289+
"GalleryName": "AntiMalware"
290+
},
291+
"SQLAssessment": {
292+
"Name": "[Concat('SQLAssessment', '(', parameters('workspaceName'), ')')]",
293+
"GalleryName": "SQLAssessment"
294+
},
295+
"diagnosticsStorageAccount": "[resourceId(parameters('applicationDiagnosticsStorageAccountResourceGroup'), 'Microsoft.Storage/storageAccounts', parameters('applicationDiagnosticsStorageAccountName'))]"
295296
},
296297
"resources": [
297298
{
@@ -312,21 +313,41 @@ The following template sample illustrates how to:
312313
{
313314
"apiVersion": "2015-03-20",
314315
"name": "VMSS Queries2",
315-
"type": "savedSearches",
316+
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
316317
"dependsOn": [
317318
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
318319
],
319320
"properties": {
320-
"category": "VMSS",
321321
"eTag": "*",
322+
"category": "VMSS",
322323
"displayName": "VMSS Instance Count",
323324
"query": "Event | where Source == \"ServiceFabricNodeBootstrapAgent\" | summarize AggregatedValue = count() by Computer",
324325
"version": 1
325326
}
326327
},
328+
{
329+
"apiVersion": "2017-04-26-preview",
330+
"name": "Cross workspace function",
331+
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
332+
"dependsOn": [
333+
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
334+
],
335+
"properties": {
336+
"etag": "*",
337+
"displayName": "failedLogOnEvents",
338+
"category": "Security",
339+
"FunctionAlias": "failedlogonsecurityevents",
340+
"query": "
341+
union withsource=SourceWorkspace
342+
workspace('workspace1').SecurityEvent,
343+
workspace('workspace2').SecurityEvent,
344+
workspace('workspace3').SecurityEvent,
345+
| where EventID == 4625"
346+
}
347+
},
327348
{
328349
"apiVersion": "2015-11-01-preview",
329-
"type": "datasources",
350+
"type": "Microsoft.OperationalInsights/workspaces/datasources",
330351
"name": "sampleWindowsEvent1",
331352
"dependsOn": [
332353
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
@@ -346,7 +367,7 @@ The following template sample illustrates how to:
346367
},
347368
{
348369
"apiVersion": "2015-11-01-preview",
349-
"type": "datasources",
370+
"type": "Microsoft.OperationalInsights/workspaces/datasources",
350371
"name": "sampleWindowsPerfCounter1",
351372
"dependsOn": [
352373
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
@@ -361,7 +382,7 @@ The following template sample illustrates how to:
361382
},
362383
{
363384
"apiVersion": "2015-11-01-preview",
364-
"type": "datasources",
385+
"type": "Microsoft.OperationalInsights/workspaces/datasources",
365386
"name": "sampleIISLog1",
366387
"dependsOn": [
367388
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
@@ -373,7 +394,7 @@ The following template sample illustrates how to:
373394
},
374395
{
375396
"apiVersion": "2015-11-01-preview",
376-
"type": "datasources",
397+
"type": "Microsoft.OperationalInsights/workspaces/datasources",
377398
"name": "sampleSyslog1",
378399
"dependsOn": [
379400
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
@@ -402,7 +423,7 @@ The following template sample illustrates how to:
402423
},
403424
{
404425
"apiVersion": "2015-11-01-preview",
405-
"type": "datasources",
426+
"type": "Microsoft.OperationalInsights/workspaces/datasources",
406427
"name": "sampleSyslogCollection1",
407428
"dependsOn": [
408429
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
@@ -414,7 +435,7 @@ The following template sample illustrates how to:
414435
},
415436
{
416437
"apiVersion": "2015-11-01-preview",
417-
"type": "datasources",
438+
"type": "Microsoft.OperationalInsights/workspaces/datasources",
418439
"name": "sampleLinuxPerf1",
419440
"dependsOn": [
420441
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
@@ -448,7 +469,7 @@ The following template sample illustrates how to:
448469
},
449470
{
450471
"apiVersion": "2015-11-01-preview",
451-
"type": "dataSources",
472+
"type": "Microsoft.OperationalInsights/workspaces/dataSources",
452473
"name": "[concat(parameters('workspaceName'), parameters('customLogName'))]",
453474
"dependsOn": [
454475
"[concat('Microsoft.OperationalInsights/workspaces/', '/', parameters('workspaceName'))]"
@@ -497,7 +518,7 @@ The following template sample illustrates how to:
497518
},
498519
{
499520
"apiVersion": "2015-11-01-preview",
500-
"type": "datasources",
521+
"type": "Microsoft.OperationalInsights/workspaces/datasources",
501522
"name": "sampleLinuxPerfCollection1",
502523
"dependsOn": [
503524
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
@@ -510,13 +531,13 @@ The following template sample illustrates how to:
510531
{
511532
"apiVersion": "2015-03-20",
512533
"name": "[concat(parameters('applicationDiagnosticsStorageAccountName'),parameters('workspaceName'))]",
513-
"type": "storageinsightconfigs",
534+
"type": "Microsoft.OperationalInsights/workspaces/storageinsightconfigs",
514535
"dependsOn": [
515536
"[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]"
516537
],
517538
"properties": {
518-
"containers": [
519-
"wad-iis-logfiles"
539+
"containers": [
540+
"wad-iis-logfiles"
520541
],
521542
"tables": [
522543
"WADWindowsEventLogsTable"
@@ -612,7 +633,7 @@ The following template sample illustrates how to:
612633
"type": "int",
613634
"value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2015-11-01-preview').retentionInDays]"
614635
},
615-
"immediatePurgeDataOn30Days": {
636+
"immediatePurgeDataOn30Days": {
616637
"type": "bool",
617638
"value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2015-11-01-preview').features.immediatePurgeDataOn30Days]"
618639
},

0 commit comments

Comments
 (0)