Microsoft Azure Operational Insights Preview Series – Time Matters in Dashboard (Part 6)

So far I’ve covered almost every Intelligence Pack. Last week a new feature “My Dashboard” was released. This is one of the features I’ve voted on. With this short post I want to share a tip how to make your tiles in My Dashboard more useful.

When you create Tiles in my dashboard you may found that more information than needed is displayed.

You can have a query like that:

Type:RequiredUpdate UpdateClassification:”Security Updates”  Product:”Windows Server 2008 R2″ or Product:”Windows Server 2012″ or Product:”Windows Server 2012 R2″   | select UpdateTitle,KBID,UpdateClassification,UpdateSeverity,PublishDate,Server

and such query will return a lot of results because it is based on the last 7 days. This is the default when you go to the search pane. Of course you can narrow down the time trough the bar on the left but if you save the query that narrowing of time will not be saved.

If you than later you use the same query in My Dashboards you will end with result Test instead of the result in Test2

Test2 is more accurate in our case and it is simple achieved by adding time constrain in our query:

Type:RequiredUpdate UpdateClassification:”Security Updates”  Product:”Windows Server 2008 R2″ or Product:”Windows Server 2012″ or Product:”Windows Server 2012 R2″ TimeGenerated:NOW/DAY  | select UpdateTitle,KBID,UpdateClassification,UpdateSeverity,PublishDate,Server

As you probably see these events are generated always at midnight and that is why I’ve chosen NOW which gives me the current date and time and by providing /DAY gives me midnight of the current date. Basically this query gives me the latest information on missing updates and not information that is 5 days old. That way your tiles become more meaningful.

Similarly  we can have this query :

Type:ProtectionStatus   | measure max(ProtectionStatusRank) as Rank by DeviceName | where Rank:270

Which gives us inaccurate current information. A simple time constrain statement results in  accurate up-to-date results.

Type:ProtectionStatus  TimeGenerated>NOW-2DAYS | measure max(ProtectionStatusRank) as Rank by DeviceName | where Rank:270

In this example I get current date(NOW) and return two days from now (-2DAYS) and I get every result after that date (TimeGenerated>).

With this query now I can have a tile that will be highlighted if the query returns more than 2 counts:

You can see that time matters in search queries and especially in Live tiles. It is also very useful when you search information for specific time frame in the past.