You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

433 lines
18 KiB

<form theme="dark" version="1.1">
<label>M365 PowerBI Overview</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="time_picker" searchWhenChanged="true">
<label>Time Picker</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="workspace_tok" searchWhenChanged="true">
<label>Workspace</label>
<choice value="*">All</choice>
<prefix>"</prefix>
<suffix>"</suffix>
<fieldForLabel>WorkSpaceName</fieldForLabel>
<fieldForValue>WorkSpaceName</fieldForValue>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI |stats count by WorkSpaceName</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
<row>
<panel>
<single>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI
| dedup WorkSpaceName
| stats count(WorkSpaceName)</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<option name="underLabel">Active Workspaces in Power BI</option>
</single>
<single>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI
WorkSpaceName=$workspace_tok$
| dedup ReportName
| stats count(ReportName)</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<option name="underLabel">Active Reports</option>
</single>
<single>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$
| dedup DatasetName
| stats count(DatasetName)</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<option name="underLabel">Active Datasets</option>
</single>
<single>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$
| dedup DashboardName
| stats count(DashboardName)</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<option name="underLabel">Active Dashboards</option>
</single>
</panel>
</row>
<row>
<panel>
<single>
<title>Active Users</title>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ | timechart span=1d dc(UserId)</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0xE7B711","0xE7B711"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="trendInterval">-7d</option>
<option name="underLabel">Compared to last week</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
<row>
<panel>
<single>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI Operation=ViewDashboard WorkSpaceName=$workspace_tok$ | timechart dc(UserId)</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">trend</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="underLabel">Users Viewing Dashboards</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
<single>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI Operation=CreateDashboard WorkSpaceName=$workspace_tok$ | timechart dc(UserId)</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">trend</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="underLabel">Users Creating Dashboards</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
<single>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI Operation=CreateDataset WorkSpaceName=$workspace_tok$ | timechart dc(DatasetName)</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">trend</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="underLabel">Datasets Created</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
<row>
<panel>
<chart>
<title>Top Workspaces in Power BI</title>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI
| top WorkSpaceName limit=5</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">bar</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">none</option>
</chart>
</panel>
<panel>
<chart>
<title>Top Viewed Reports</title>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ Activity=ViewReport
| top AppName limit=5</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
</search>
<option name="charting.chart">bar</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<chart>
<title>Top Used Datasources</title>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ DatasetName=* Activity=GetDatasetDatasourcesAsAdmin | dedup DatasetId | top Datasources{}.DatasourceType limit=5</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
</search>
<option name="charting.chart">bar</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<chart>
<title>Top Viewed Dashboards</title>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$ Activity=ViewDashboard
| top DashboardName limit=5</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
</search>
<option name="charting.chart">bar</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">1</option>
<option name="charting.legend.placement">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>Externally Shared Reports</title>
<input type="text" token="omDomain" searchWhenChanged="true">
<label>Enter onmicrosoft.com domain to further filter:</label>
<default>domain_value</default>
</input>
<table>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI Operation=ShareReport WorkSpaceName=$workspace_tok$
| rex field=UserId "@(?&lt;srcDomain&gt;\S+)"
| rex field=SharingInformation{}.RecipientEmail "@(?&lt;targetDomain&gt;\S+)"
| eval results = if(match(upper(targetDomain),upper(srcDomain)), "match", "non-match")
| search results=non-match SharingInformation{}.RecipientEmail!=*$omDomain$*
| stats count by _time, UserId, SharingInformation{}.RecipientEmail, Datasets{}.DatasetName
| fields - count
| rename SharingInformation{}.RecipientEmail AS Recipient Datasets{}.DatasetName AS Dataset
| sort - _time</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="UserId">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
</table>
</panel>
</row>
<row>
<panel>
<title>Activities</title>
<input type="dropdown" token="item_type_tok" searchWhenChanged="true">
<label>Activity Type</label>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$
| eval category=case(!isNull(DashboardId),"Dashboard",!isNull(ReportId),"Report",!isNull(DatasetName),"Dataset") | stats count by category</query>
<earliest>$user_act_time_tok.earliest$</earliest>
<latest>$user_act_time_tok.latest$</latest>
</search>
<choice value="*">All</choice>
<fieldForLabel>category</fieldForLabel>
<fieldForValue>category</fieldForValue>
<default>*</default>
<initialValue>*</initialValue>
</input>
</panel>
</row>
<row>
<panel>
<title>Activities Timechart</title>
<chart>
<title>Select or Zoom in Chart to Drilldown</title>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI
WorkSpaceName=$workspace_tok$
| eval category=case(!isNull(DashboardId),"Dashboard",!isNull(ReportId),"Report",!isNull(DatasetName),"Dataset")
| search category=$item_type_tok$
| timechart count by Activity</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
</search>
<selection>
<set token="form.user_act_time_tok.earliest">$start$</set>
<set token="form.user_act_time_tok.latest">$end$</set>
</selection>
<option name="charting.chart">line</option>
<option name="charting.drilldown">all</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="form.user_act_time_tok.earliest">$earliest$</set>
<set token="form.user_act_time_tok.latest">$latest$</set>
<set token="form.filter_value">$click.name2$</set>
<set token="form.filter_field">Operation</set>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel>
<title>User Activity by Operations</title>
<input type="time" token="user_act_time_tok" searchWhenChanged="true">
<label>Time Picker For User Activities</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="filter_field" searchWhenChanged="true">
<label>Filter Field</label>
<choice value="">None</choice>
<choice value="user_id">User ID</choice>
<choice value="ObjectId">Object</choice>
<choice value="Operation">Operation</choice>
<fieldForLabel>makeresults</fieldForLabel>
<fieldForValue>makeresults</fieldForValue>
<search>
<query>|makeresults</query>
<earliest>$user_act_time_tok.earliest$</earliest>
<latest>$user_act_time_tok.latest$</latest>
</search>
<change>
<condition label="None">
<set token="form.filter_value"></set>
<set token="filter_value"></set>
</condition>
</change>
<default></default>
</input>
<input type="text" token="filter_value" searchWhenChanged="true">
<label>Filter Value</label>
<default></default>
<prefix>="</prefix>
<suffix>"</suffix>
</input>
<input type="text" token="display_limit_tok" searchWhenChanged="true">
<label>Display Limit</label>
<default>50</default>
<initialValue>50</initialValue>
</input>
<viz type="sankey_diagram_app.sankey_diagram">
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$
| eval category=case(!isNull(DashboardId),"Dashboard",!isNull(ReportId),"Report",!isNull(DatasetName),"Dataset")
| search category=$item_type_tok$ $filter_field$$filter_value$
| stats count by UserId Operation
| sort -count
| head $display_limit_tok$
| rename UserId as source, Operation as target</query>
<earliest>$user_act_time_tok.earliest$</earliest>
<latest>$user_act_time_tok.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="height">578</option>
<option name="refresh.display">progressbar</option>
</viz>
</panel>
</row>
<row>
<panel>
<table>
<title>Select User, Operation or Action Target to Drilldown</title>
<search>
<query>`m365_cp_default_index` sourcetype="o365:management:activity" Workload=PowerBI WorkSpaceName=$workspace_tok$
| eval category=case(!isNull(DashboardId),"Dashboard",!isNull(ReportId),"Report",!isNull(DatasetName),"Dataset")
| search category=$item_type_tok$ $filter_field$$filter_value$
| stats values(ObjectId) AS ObjectId by WorkSpaceName, UserId Operation</query>
<earliest>$user_act_time_tok.earliest$</earliest>
<latest>$user_act_time_tok.latest$</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="form.filter_field">$click.name2$</set>
<set token="form.filter_value">$click.value2$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
<img src="/static/app/DA-ITSI-CP-m365/PowerBI.png" width="100"/>
</html>
</panel>
</row>
</form>