Azure Workbooks KQL queries filters doesn't work fully when pinned to Azure Dashboards

Tomasz Wieczorkowski 51 Reputation points
2024-07-20T14:28:54.3866667+00:00

I've found out that there is a problem with linking the filters from KQL queries to the Azure Dashboard from Azure Workbooks. Looks like a BUG of a FEATURE in Microsoft Azure Workbooks.

Description:

I've created a sample KQL script (Log Analytics Workspace (LAW) with the SigninLogs table from Entra ID -> Diagnostic Settings already created and is there)

SigninLogs
| where Identity contains "John" or Identity contains "Sam"
| summarize Count=count() by Identity

Then I ran this KQL script directly from the Log Analytics Workspace -> Logs -> Query:

1

And from there I've Pin it to the Azure Dashboard.

Then when I go to Azure Dashboard and the filter "Identity" (specified in the "where" clause of the KQL script) was not visible in "Add Filter" itself.

But when I "Edit" the Dashboard and next add just a sample "Metrics" tile, Save the dashboard and next click on "Add filter" the "Identity" filter magically shown up there.

2

3

Now I was able to filter the data on the "Azure Dashboard" element directly now.

BUG/FEATURE Description: The problem is that when I created "Azure Workbook" first - according to the Microsoft manuals - and then created KQL query in Azure Workbook (the same script) and pin the Query Result to the same Azure Dashboard and add a sample Metrics tile as earlier it doesn't work at all.

The SOLUTION to be able to see and filter results in Azure Dashboards is not to use Azure Workbooks but to use "Azure Portal -> Log Analytics Workspace (LAW) -> Logs -> Query", specify the KQL query there, then pin it to Azure Dashboard you need, then "Edit" the Azure Dashboard, add a sample tile like "Metrics", "Save" the Azure Dashboard and then in the "Add filter" our filters specified in the "where" clause of the KQL scripts will be there.

Microsoft, would it be possible for you to fix that, so when elements in Azure Workbooks with filters in KQL queries (or maybe parameters as well) be linked/transferred to Azure Dashboards when pinned to it to allow Azure Dashboard users to filter the data by using custom filters not just the predefined like Time, Subscription, Resource Group, Location, ResourceType? Without this functionality using Azure Workbooks is limited to static content and I think that's why the Azure Dashboards have the "Share/Publish" option to deliver them instead of Azure Workbooks to the final recipients of the Reports (Azure Workbooks are used mostly by technical staff members to prepare the content for Azure Dashboards). To be fully functional it would be very useful to be able to use Query filters on Azure Dashboards as well.

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,310 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.