{
    "contentVersion": "1.0.0.0",
    "parameters": {
      "workbookDisplayName": {
        "type": "string",
        "defaultValue": "Workbook 1",
        "metadata": {
          "description": "The friendly name for the workbook that is used in the Gallery or Saved List.  This name must be unique within a resource group."
        }
      },
      "workbookType": {
        "type": "string",
        "defaultValue": "workbook",
        "metadata": {
          "description": "The gallery that the workbook will been shown under. Supported values include workbook, tsg, etc. Usually, this is 'workbook'"
        }
      },
      "workbookSourceId": {
        "type": "string",
        "defaultValue": "Azure Monitor",
        "metadata": {
          "description": "The id of resource instance to which the workbook will be associated"
        }
      },
      "workbookId": {
        "type": "string",
        "defaultValue": "[newGuid()]",
        "metadata": {
          "description": "The unique guid for this workbook instance"
        }
      }
    },
    "resources": [
      {
        "name": "[parameters('workbookId')]",
        "type": "microsoft.insights/workbooks",
        "location": "[resourceGroup().location]",
        "apiVersion": "2022-04-01",
        "dependsOn": [],
        "kind": "shared",
        "properties": {
          "displayName": "[parameters('workbookDisplayName')]",
          "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Subscription}\"],\"parameters\":[{\"id\":\"c45ca29c-9e2d-4f6f-b109-0e822e1dcc48\",\"isRequired\":true,\"name\":\"TimeRange\",\"timeContext\":{\"durationMs\":86400000},\"type\":4,\"typeSettings\":{\"allowCustom\":true,\"selectableValues\":[{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}]},\"value\":{\"durationMs\":2592000000},\"version\":\"KqlParameterItem/1.0\"},{\"id\":\"560c2bfa-a56d-40ff-9136-d03468b5ec8b\",\"isRequired\":true,\"name\":\"Subscription\",\"timeContext\":{\"durationMs\":86400000},\"type\":6,\"typeSettings\":{\"additionalResourceOptions\":[],\"includeAll\":true,\"showDefault\":false},\"version\":\"KqlParameterItem/1.0\"},{\"id\":\"1d11f3d8-b7cb-4bf9-8ff1-0a16de61511b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"isRequired\":true,\"query\":\"resources | where type == \\\"microsoft.operationalinsights/workspaces\\\" \",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 3\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Workspace}\"],\"parameters\":[{\"crossComponentResources\":[\"{Workspace}\"],\"id\":\"f3c4fdb4-85c9-4bc6-978f-e1c5f4f31872\",\"isRequired\":true,\"name\":\"ResourceType\",\"query\":\"AzureMetrics\\r\\n| parse tolower(ResourceId) with \\\"/subscriptions/\\\" subscriptionId \\\"/resourcegroups/\\\" \\r\\n    resourceGroup \\\"/providers/\\\" provider \\\"/\\\" resourceType \\\"/\\\" resourceName \\r\\n| project resourceType=strcat(provider,\\\"/\\\",resourceType)\\r\\n| summarize by resourceType\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"type\":7,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"value\":\"microsoft.network/virtualnetworkgateways\",\"version\":\"KqlParameterItem/1.0\"},{\"crossComponentResources\":[\"{Workspace}\"],\"id\":\"a644919b-5c8c-4ee9-be76-af39d9ce4a0c\",\"isRequired\":true,\"name\":\"Resource\",\"query\":\"AzureMetrics\\r\\n| where ResourceId contains \\\"{ResourceType}\\\" \\r\\n| summarize by tolower(ResourceId)\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"type\":5,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"version\":\"KqlParameterItem/1.0\",\"value\":null},{\"crossComponentResources\":[\"{Workspace}\"],\"id\":\"0d7fec1b-28e1-4ecb-9b8c-b3d20844b4cc\",\"name\":\"Metric\",\"query\":\"AzureMetrics\\r\\n| where ResourceId =~ \\\"{Resource}\\\" \\r\\n|  summarize by MetricName\\r\\n| order by MetricName\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"type\":2,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"value\":\"BitsInPerSecond\",\"version\":\"KqlParameterItem/1.0\"},{\"id\":\"4d9154ac-a3de-4be3-b6af-0bc20a44a9e9\",\"isHiddenWhenLocked\":true,\"name\":\"AggregationFunction\",\"type\":1,\"version\":\"KqlParameterItem/1.0\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 3 - Copy\"},{\"type\":1,\"content\":{\"json\":\"# **{Resource:name}** ({ResourceType}) - *{Metric}*\"},\"name\":\"text - 4\"},{\"type\":1,\"content\":{\"json\":\"# Aggregation\"},\"customWidth\":\"35\",\"name\":\"text - 6\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"160bc8e1-360d-4ec0-b730-a258631bd292\",\"cellValue\":\"AggregationFunction\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Average\",\"subTarget\":\"avg(avg)\",\"style\":\"link\"},{\"id\":\"b23aeda9-d502-4c62-92a8-bd72dceab2b4\",\"cellValue\":\"AggregationFunction\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Minimum\",\"subTarget\":\"min(min)\",\"style\":\"link\"},{\"id\":\"cfde3d56-164f-47e7-9344-6455e26be300\",\"cellValue\":\"AggregationFunction\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Maximum\",\"subTarget\":\"max(max)\",\"style\":\"link\"},{\"id\":\"42e0f350-37e2-4e11-8380-b77b77a6a7f1\",\"cellValue\":\"AggregationFunction\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Percentile 5\",\"subTarget\":\"percentile(pct5,5)\",\"style\":\"link\"},{\"id\":\"cfa64306-729f-4869-b08d-21fce13ca0d1\",\"cellValue\":\"AggregationFunction\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Percentile 10\",\"subTarget\":\"percentile(pct10,10)\",\"style\":\"link\"},{\"id\":\"af6b9b84-af97-435b-a723-3a097f3de025\",\"cellValue\":\"AggregationFunction\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Percentile 50\",\"subTarget\":\"percentile(pct50,50)\",\"style\":\"link\"},{\"id\":\"8480291a-e382-4d9c-b495-75819f0f09cd\",\"cellValue\":\"AggregationFunction\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Percentile 90\",\"subTarget\":\"percentile(pct90,90)\",\"style\":\"link\"},{\"id\":\"16068529-609f-4dbc-ab0b-dd55fd1ba74b\",\"cellValue\":\"AggregationFunction\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Percentile 95\",\"subTarget\":\"percentile(pct95,95)\",\"style\":\"link\"}]},\"customWidth\":\"65\",\"name\":\"links - 5\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"0a0c703a-be3a-4e68-a49d-70acea508f4e\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Forecast\",\"subTarget\":\"Forecast\",\"style\":\"link\"},{\"id\":\"ee6b4d14-2b72-4a14-b56e-1b5e59f64ed8\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Trendline\",\"subTarget\":\"Trendline\",\"style\":\"link\"},{\"id\":\"31d7efe0-e9d3-4e57-9cf8-118fc16bf0d3\",\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Anomalies\",\"subTarget\":\"Anomalies\",\"style\":\"link\"}]},\"name\":\"links - 14\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## 1 week forecast\\r\\n\\r\\nPredicts future values of a set of time series. Builds the decomposition model and then, for each time series, extrapolates the baseline component into the future.\"},\"name\":\"text - 9\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ea85abf1-9637-44fe-82dd-30a9dd64fac3\",\"jsonData\":\"[\\\"7\\\",\\\"14\\\",\\\"31\\\"]\",\"label\":\"Forcast Horizon Days\",\"name\":\"ForcastHorizon\",\"timeContext\":{\"durationMs\":86400000},\"type\":2,\"typeSettings\":{\"additionalResourceOptions\":[]},\"value\":\"7\",\"version\":\"KqlParameterItem/1.0\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let min_t = todatetime(\\\"{TimeRange:startISO}\\\");\\r\\nlet max_t = now(-1d);\\r\\nlet dt = 1h;\\r\\nlet horizon={ForcastHorizon}d;\\r\\nAzureMetrics\\r\\n| where ResourceId =~ \\\"{Resource}\\\" \\r\\n| where MetricName =~ \\\"{Metric}\\\"\\r\\n| summarize \\r\\npct5 = percentile(Average, 5), \\r\\npct10 = percentile(Average, 10), \\r\\npct50 = percentile(Average, 50), \\r\\npct90 = percentile(Average, 90), \\r\\npct95 = percentile(Average, 95), \\r\\nmin = min(Minimum),\\r\\nmax = max(Maximum),\\r\\navg = avg(Average)  \\r\\nby ResourceId=tolower(ResourceId), ResourceProvider, MetricName, UnitName, bin(TimeGenerated, 1h)\\r\\n| project pct5,pct10, pct50, pct90, pct95, min, max, avg, ResourceId, ResourceProvider, MetricName, UnitName, TimeGenerated\\r\\n| make-series {Metric}={AggregationFunction} on TimeGenerated from min_t to max_t+horizon step dt\\r\\n| extend forecast = series_decompose_forecast({Metric}, toint(horizon/dt))\\r\\n| render timechart \",\"size\":0,\"noDataMessageStyle\":5,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"name\":\"1 week forecast\"}]},\"conditionalVisibility\":{\"comparison\":\"isEqualTo\",\"parameterName\":\"selectedTab\",\"value\":\"Forecast\"},\"name\":\"group - Forecast\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## TrendLine\\r\\n\\r\\nTakes a set of time series and automatically decomposes each time series to its trend components.\"},\"name\":\"text - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let grain = 1h;\\r\\nAzureMetrics\\r\\n| where ResourceId =~ \\\"{Resource}\\\" \\r\\n| where MetricName =~ \\\"{Metric}\\\"\\r\\n| summarize \\r\\npct5 = percentile(Average, 5), \\r\\npct10 = percentile(Average, 10), \\r\\npct50 = percentile(Average, 50), \\r\\npct90 = percentile(Average, 90), \\r\\npct95 = percentile(Average, 95), \\r\\nmin = min(Minimum),\\r\\nmax = max(Maximum),\\r\\navg = avg(Average)  \\r\\nby ResourceId=tolower(ResourceId), ResourceProvider, MetricName, UnitName, bin(TimeGenerated, 1h)\\r\\n| project pct5,pct10, pct50, pct90, pct95, min, max, avg, ResourceId, ResourceProvider, MetricName, UnitName, TimeGenerated\\r\\n| make-series {Metric} = {AggregationFunction} default = 0 on TimeGenerated from {TimeRange:start} to now(-1d) step grain\\r\\n| extend  (RSquare,Slope,Variance,RVariance,Interception,LineFit)= series_fit_line({Metric})\\r\\n| project TimeGenerated, {Metric}, LineFit\",\"size\":0,\"noDataMessageStyle\":5,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"graphSettings\":{\"type\":0}},\"name\":\"TrendLine\"}]},\"conditionalVisibility\":{\"comparison\":\"isEqualTo\",\"parameterName\":\"selectedTab\",\"value\":\"Trendline\"},\"name\":\"group - Trendline\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Anomalies\\r\\n\\r\\nCalculates anomaly scores for each point of the residual component using Tukey's fence test. \\r\\n\\r\\n**Multiplied by average**\\r\\n\\r\\nAnomaly scores above 1.5 or below -1.5 indicate a mild anomaly rise or decline respectively. \\r\\n\\r\\nAnomaly scores above 3.0 or below -3.0 indicate a strong anomaly.\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let grain = 1h;\\r\\nlet metric_scale = toscalar(\\r\\nAzureMetrics\\r\\n| where ResourceId =~ \\\"{Resource}\\\" \\r\\n| where MetricName =~ \\\"{Metric}\\\"\\r\\n| summarize \\r\\npct5 = percentile(Average, 5), \\r\\npct10 = percentile(Average, 10), \\r\\npct50 = percentile(Average, 50), \\r\\npct90 = percentile(Average, 90), \\r\\npct95 = percentile(Average, 95), \\r\\nmin = min(Minimum),\\r\\nmax = max(Maximum),\\r\\navg = avg(Average)  \\r\\n| summarize {AggregationFunction});\\r\\nAzureMetrics\\r\\n| where ResourceId =~ \\\"{Resource}\\\" \\r\\n| where MetricName =~ \\\"{Metric}\\\"\\r\\n| summarize \\r\\npct5 = percentile(Average, 5), \\r\\npct10 = percentile(Average, 10), \\r\\npct50 = percentile(Average, 50), \\r\\npct90 = percentile(Average, 90), \\r\\npct95 = percentile(Average, 95), \\r\\nmin = min(Minimum),\\r\\nmax = max(Maximum),\\r\\navg = avg(Average)  \\r\\nby ResourceId=tolower(ResourceId), ResourceProvider, MetricName, UnitName, bin(TimeGenerated, 1h)\\r\\n| project pct5,pct10, pct50, pct90, pct95, min, max, avg, ResourceId, ResourceProvider, MetricName, UnitName, TimeGenerated\\r\\n| make-series {Metric} = {AggregationFunction} default = 0 on TimeGenerated from {TimeRange:start} to now(-1d) step grain\\r\\n| extend (anomalies) = series_decompose_anomalies({Metric}, 1.5, -1, 'linefit')\\r\\n| extend anomalies = \\r\\nseries_multiply(metric_scale, anomalies) // multiplied for visualization purposes\\r\\n| render timechart \",\"size\":0,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\",\"chartSettings\":{\"xAxis\":\"TimeGenerated\"}},\"name\":\"Anomalies\"},{\"type\":1,\"content\":{\"json\":\"## Anomalies - Outliers\"},\"name\":\"text - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let grain = 1h;\\r\\nAzureMetrics\\r\\n| where ResourceId =~ \\\"{Resource}\\\" \\r\\n| where MetricName =~ \\\"{Metric}\\\"\\r\\n| summarize \\r\\npct5 = percentile(Average, 5), \\r\\npct10 = percentile(Average, 10), \\r\\npct50 = percentile(Average, 50), \\r\\npct90 = percentile(Average, 90), \\r\\npct95 = percentile(Average, 95), \\r\\nmin = min(Minimum),\\r\\nmax = max(Maximum),\\r\\navg = avg(Average)  \\r\\nby ResourceId=tolower(ResourceId), ResourceProvider, MetricName, UnitName, bin(TimeGenerated, 1h)\\r\\n| project pct5,pct10, pct50, pct90, pct95, min, max, avg, ResourceId, ResourceProvider, MetricName, UnitName, TimeGenerated\\r\\n| make-series MetricSeries = {AggregationFunction} default = 0 on TimeGenerated from {TimeRange:start} to now(-1d) step grain\\r\\n| extend outliers=series_decompose_anomalies(MetricSeries, 1.5, -1, 'linefit')\\r\\n| mv-expand TimeGenerated, MetricSeries, outliers\\r\\n| where outliers == 1\\r\\n| project todatetime(TimeGenerated), MetricValue=round(todouble(MetricSeries),4)\\r\\n| extend TimeGenerated=strcat(format_datetime(TimeGenerated, \\\"yyyy-MM-dd HH\\\"), \\\":00:00\\\")\\r\\n| order by TimeGenerated desc\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"MetricValue\",\"formatOptions\":{\"palette\":\"redBright\"},\"formatter\":8},{\"columnMatch\":\"IncomingRequests\",\"formatOptions\":{\"palette\":\"blue\"},\"formatter\":9},{\"columnMatch\":\"AvgPerf\",\"formatOptions\":{\"palette\":\"redBright\"},\"formatter\":8}]},\"chartSettings\":{\"xAxis\":\"TimeGenerated\"}},\"name\":\"Anomalies - Outliers\"}]},\"conditionalVisibility\":{\"comparison\":\"isEqualTo\",\"parameterName\":\"selectedTab\",\"value\":\"Anomalies\"},\"name\":\"group - Anomalies\"}],\"isLocked\":false,\"fallbackResourceIds\":[\"Azure Monitor\"]}",
          "version": "1.0",
          "sourceId": "[parameters('workbookSourceId')]",
          "category": "[parameters('workbookType')]"
        }
      }
    ],
    "outputs": {
      "workbookId": {
        "type": "string",
        "value": "[resourceId( 'microsoft.insights/workbooks', parameters('workbookId'))]"
      }
    },
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#"
  }