Azure displaying status of all Virtual Machines

Question

My current simple heartbeat query is

Heartbeat
| summarize arg_max(TimeGenerated, *) by Computer

This displays the following columns,

Computer, TimeGenerated, SourceComputerId, ComputerIP, Category, OSType etc. along with other details.

Answer 1

Hello,
I hope I have understood correctly your need here.

If you want to Pin the resulted Log Search table in an Azure Dashboard, then you can enrich your resulted strings with Icons like this:

let LookBack = 7d;
let Threshold = 1h;
Heartbeat
| where TimeGenerated >= ago(LookBack)
| summarize arg_max(TimeGenerated, *) by Computer
| extend Status = iif(TimeGenerated >= ago(Threshold), "Connected", "Offline")
| extend Status = iif(Status == "Connected", strcat("🟢","Connected"),strcat("🔴","Offline"))
| project Computer,Status, TimeGenerated,  ComputerIP, Category, OSType

Another approach to populate your Azure Dashboard with meaningful tiles is the one where you could use existing Workbooks or create your own (for example use the Icon option for the visualization on the Status column), then from the advanced options of that section in the Workbook (in edit mode), you can enable the option to Pin to Dashboard:

Then when you complete your editing, on that section (visual) of the Workbook, you will find the Pin icon available, from where you can choose to pin that visual to an Azure Dashboard:

I hope that one of the above options will help you achieve your goal.

(Don't forget to Mark this as an answer if that's the case).

Thank you!

BR,

George

Answer 2

Vipeen Sekharan, thank you for the reply. After commenting line 1 & 4, if you are not getting some of the VMs in the output, it would mean either of the following:

1. The VM never reported to this log analytics workspace
2. The older data from log analytics workspace has been purged out based on the retention policy set on the workspace. For example, if the retention policy is set to 365 days, data older than 365 days will be removed. If the VM has been reported at some point in the past which was more than 365 days ago, therefore you are not seeing data for that VM.

Please post a new question if you have any further questions, so that the discussion can be scoped to a single topic on this thread which was about query in LA workspace to check VM state. This would help the community look for answers to specific questions/scenario.