Geolocation query from IP address
Hi, Any idea if that's possible (and if yes - how) to add resolving of IP address to geolocation and any other IP information in a query in Log Analytics? For example, part of the message body I have in custom log is IP address, I would like to add a column (e.g. - extend) that resolves this IP address to its location in the world. Alternatively, if there was an option to call a rest service during query, I could call something like ipstack, and receive the required information. An example of simple query: MyEvents | extend IPAddress = extractjson("$.request.ipaddress", Message) | extend Country = extractgeo("$.country", IPAddress) Hopefully that was clear enough 🙂 Thanks! P.S. In PowerBI this can be achieved with Json.Document(Web.Contents("rest service url")....
Query for App Service and outbound IP Query
Right now I need help writing a Query that shows this: AzureDiagnostics | where ResourceProvider == "MICROSOFT.CDN" and Category == "FrontDoorAccessLog" clientIp, backendHostname This query isn't working. I have a server that is using SSH and the logs there show stuff but I have a Front Door Globally and I need to see the logs there also. What is the best method.Azure Virtual Machine runtime calculation
Hello All, I currently have an azure automation runbook that executes a get-azurermvm command against all the subscriptions in our tenant. This script compiles a table, that lists the vmSize and Status of running / deallocated as well as other pertinent information. The out put is then formatted to JSON and posted to the log analytics Rest API where I have a custom Log called RunningVMs_CL What I would like to be able to do is calculate any VM running more than 8 hours and up to 40 hours and be able to alert on it when it reaches above 8 hours of runtime per day or more, and then when it reaches 40 hours of total run time. The 40 hours might be a bit difficult to check as logs are only 31 days old at max. Being new to Log Analytics language I'm struggling to find the right commands to use to facilitate at least the 8 hour calculation, any tips on how I should approach this query? Thanks john
