Search code examples
azure-log-analyticsazure-monitor-workbooks

How to get dropdown parameter with included "All" in where clause to work?

I'm using Application Insight Workbook to design graphs over IIS logs. I want to add a parameter where users can filter on Computer. This is all well and working. This dropdown allows multiple selections and looks like this:

enter image description here

I want to include a checkbox for "All", so I do it here. enter image description here

I'm using the custom parameter like this in my query

W3CIISLog | where Computer in ({Computer})

How can I change my query to support both multiple selections and "All" from the dropdown? Is this at all possible to achieve?

Solution

  • We have some special github documentation with examples on how to special case all. (it doesn't look like this info has made it to the public azure docs yet)

    copied from there:

    one way is to use [] as the "all" value, and then write your query like this:

    let selection = dynamic([{Selection}]); 
SomeQuery  
| where array_length(selection) == 0 or SomeField in (selection)

    this will treat an empty selection OR the "all" selection the same (handled by the array_length check) AND will look for selected values in SomeField when anything else is selected

    Other common cases use '*' as the special marker value when a parameter is required, and then test with

    | where "*" in ({Selection}) or SomeField in ({Selection})

    (you can also use has_any instead of in (or in~ for case insensitive in) depending on the way you are querying and what your data is, etc.