KQL Azure Workbook: Filtering AppInsights cross-resource query by subscription-CodePudding

I want to filter ApplicationInsights resources by a workbook parameter for subscriptions set in the Azure Workbook. I don't see documentation on how to do this, does anyone have a solution?

My cross-resource query takes the following form. I need to filter by subscriptionId and there is no parameter to do so on the resulting table, how do I filter in this way?

union withsource=SourceApp 
app('Contoso-app1').requests,  
app('Contoso-app2').requests, 
app('Contoso-app3').requests, 
app('Contoso-app4').requests, 
app('Contoso-app5').requests 
| parse SourceApp with * "('" applicationName "')" *  
| where success = False

Thanks in advance.

CodePudding user response：

In legacy application insights instance the appName property of any telemetry item has the following structure:

/subscriptions/<subscriptionId>/resourcegroups/<resourceGroup>/providers/microsoft.insights/components/<appInsightsName>

However, as you and I found out, sometimes the appName just reflects the name instead of the resource id. Anyway, when it is filled properly it can be used to get what you want.

By using the split() function we can extract the subscriptionId and create a filter using where like this:

union withsource=SourceApp 
app('Contoso-app1').requests,  
app('Contoso-app2').requests, 
app('Contoso-app3').requests, 
app('Contoso-app4').requests, 
app('Contoso-app5').requests 
| parse SourceApp with * "('" applicationName "')" *
| extend subscription = split(appName, "/")[2]
| where subscription == "<a subscriptionId>"

Workspace based application insights instances have a property _ResourceId that can be used, instead of appName. If you are using a legacy instance, convert it to a Workspace based application insights instance and new(!) log entries will get this _ResourceId property:

union withsource=SourceApp 
app('Contoso-app1').requests,  
app('Contoso-app2').requests, 
app('Contoso-app3').requests, 
app('Contoso-app4').requests, 
app('Contoso-app5').requests 
| parse SourceApp with * "('" applicationName "')" *
| extend subscription = split(_ResourceId, "/")[2]
| where subscription == "<a subscriptionId>"