Azure Useful Queries

Log Analytics 

// Percentiles Calculation
search *
| where Category == 'SQLSecurityAuditEvents'
| order by event_time_t , server_principal_name_s ,duration_milliseconds_d
| where database_name_s == "UserDB"
| where server_principal_name_s == "databaselogin"
| summarize percentiles(duration_milliseconds_d, 25, 50, 75, 90,95,99) by substring(statement_s, 0, 40) , server_principal_name_s ,application_name_s
| where application_name_s == "Core .Net SqlClient Data Provider"

search *
| where Category == 'SQLSecurityAuditEvents'
| order by event_time_t , server_principal_name_s ,duration_milliseconds_d
| where database_name_s == "UserDB"
| where server_principal_name_s == "UserLogin"
| summarize count() , percentiles(duration_milliseconds_d, 25, 50, 75, 90,95,99) by substring(statement_s, 0, 40) , server_principal_name_s ,application_name_s
| where application_name_s == "Core .Net SqlClient Data Provider"
| order by count_ desc

 

let startTimestamp = ago(1h);
 KubePodInventory
 | where TimeGenerated > startTimestamp
 | where ClusterName =~ ""
 | distinct ContainerID
 | join
 (
     ContainerLog
     | where TimeGenerated > startTimestamp
 )
 on ContainerID
 | project LogEntrySource, LogEntry, TimeGenerated, Computer, Image, Name, ContainerID
 | order by TimeGenerated desc
 | where LogEntrySource == "stdout"
 | where Image == "dummy-logger"
 | render table
 ContainerInventory
 | where ContainerState == "Failed"
 | order by CreatedTime desc
 //| summarize AggregatedValue = dcount(ContainerID) by Computer, Image, ContainerState
 // | order  by Computer , Image
 https://github.com/denniszielke/container_demos/blob/master/KubernetesOMSAKS.md