M365 PowerBI Overview

Time Picker -24h@h now Workspace All " " WorkSpaceName WorkSpaceName `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI |stats count by WorkSpaceName -24h@h now * *

`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI | dedup WorkSpaceName | stats count(WorkSpaceName) $time_picker.earliest$ $time_picker.latest$ none ["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"] progressbar Active Workspaces in Power BI `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ | dedup ReportName | stats count(ReportName) $time_picker.earliest$ $time_picker.latest$ none ["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"] progressbar Active Reports `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ | dedup DatasetName | stats count(DatasetName) $time_picker.earliest$ $time_picker.latest$ none ["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"] progressbar Active Datasets `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ | dedup DashboardName | stats count(DashboardName) $time_picker.earliest$ $time_picker.latest$ none ["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"] progressbar Active Dashboards `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ | timechart span=1d dc(UserId) -7d@h now 1 value block none 0 ["0xE7B711","0xE7B711"] [0] progressbar 1 1 0 1 medium standard absolute -7d Compared to last week after 1 1 `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI Operation=ViewDashboard WorkSpaceName=$workspace_tok$ | timechart dc(UserId) $time_picker.earliest$ $time_picker.latest$ 1 trend none none 0 ["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"] [0,30,70,100] progressbar 1 1 0 1 medium standard absolute Users Viewing Dashboards after 1 1 `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI Operation=CreateDashboard WorkSpaceName=$workspace_tok$ | timechart dc(UserId) $time_picker.earliest$ $time_picker.latest$ 1 trend none none 0 ["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"] [0,30,70,100] progressbar 1 1 0 1 medium standard absolute Users Creating Dashboards after 1 1 `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI Operation=CreateDataset WorkSpaceName=$workspace_tok$ | timechart dc(DatasetName) $time_picker.earliest$ $time_picker.latest$ 1 trend none none 0 ["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"] [0,30,70,100] progressbar 1 1 0 1 medium standard absolute Datasets Created after 1 1 `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI | top WorkSpaceName limit=5 -24h@h now bar none none `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ Activity=ViewReport | top AppName limit=5 $time_picker.earliest$ $time_picker.latest$ bar none none progressbar `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ DatasetName=* Activity=GetDatasetDatasourcesAsAdmin | dedup DatasetId | top Datasources{}.DatasourceType limit=5 $time_picker.earliest$ $time_picker.latest$ bar none none progressbar `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ Activity=ViewDashboard | top DashboardName limit=5 $time_picker.earliest$ $time_picker.latest$ bar none 1 none progressbar Enter onmicrosoft.com domain to further filter: domain_value `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI Operation=ShareReport WorkSpaceName=$workspace_tok$ | rex field=UserId "@(?<srcDomain>\S+)" | rex field=SharingInformation{}.RecipientEmail "@(?<targetDomain>\S+)" | eval results = if(match(upper(targetDomain),upper(srcDomain)), "match", "non-match") | search results=non-match SharingInformation{}.RecipientEmail!=*$omDomain$* | stats count by _time, UserId, SharingInformation{}.RecipientEmail, Datasets{}.DatasetName | fields - count | rename SharingInformation{}.RecipientEmail AS Recipient Datasets{}.DatasetName AS Dataset | sort - _time $time_picker.earliest$ $time_picker.latest$ 1 100nonenonefalseprogressbarfalsefalsetrue Activity Type `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ | eval category=case(!isNull(DashboardId),"Dashboard",!isNull(ReportId),"Report",!isNull(DatasetName),"Dataset") | stats count by category $user_act_time_tok.earliest$ $user_act_time_tok.latest$ All category category * * `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ | eval category=case(!isNull(DashboardId),"Dashboard",!isNull(ReportId),"Report",!isNull(DatasetName),"Dataset") | search category=$item_type_tok$ | timechart count by Activity $time_picker.earliest$ $time_picker.latest$ $start$ $end$ line all progressbar $earliest$ $latest$ $click.name2$ Operation Time Picker For User Activities -15m now Filter Field None User ID Object Operation makeresults makeresults |makeresults $user_act_time_tok.earliest$ $user_act_time_tok.latest$ Filter Value =" " Display Limit 50 50 `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ | eval category=case(!isNull(DashboardId),"Dashboard",!isNull(ReportId),"Report",!isNull(DatasetName),"Dataset") | search category=$item_type_tok$ $filter_field$$filter_value$ | stats count by UserId Operation | sort -count | head $display_limit_tok$ | rename UserId as source, Operation as target $user_act_time_tok.earliest$ $user_act_time_tok.latest$ none 578 progressbar `m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ | eval category=case(!isNull(DashboardId),"Dashboard",!isNull(ReportId),"Report",!isNull(DatasetName),"Dataset") | search category=$item_type_tok$ $filter_field$$filter_value$ | stats values(ObjectId) AS ObjectId by WorkSpaceName, UserId Operation $user_act_time_tok.earliest$ $user_act_time_tok.latest$ cellprogressbar $click.name2$ $click.value2$