Quick addendum here. At 16:10 I talk about using the Flow Log Resource ID (TargetResourceID in the table schema) to pull out the VNet information. I also call out that we do not have SrcVNet and DestVNet in the same schema. This is true, but there is another way to get this VNet data. It still relies on having Flow Logs enabled on all spokes. In the fields SrcSubnet and DestSubnet we expose the VNet as part of the output. You can parse that out and summarise based on it. Example below: NTANetAnalytics | where SubType == 'FlowLog' and FaSchemaVersion == '3' and FlowStartTime > ago(12d) | extend DestVNet = tostring(split(DestSubnet, "/")[1]) | summarize TotalBytes=sum(BytesSrcToDest) by DestVNet This will give you traffic volume based on the VNet level rather than Subnet level.
Brilliant video. Will give this a try.
Another great video! Thanks Adam.
Such great content. thank you
Quick addendum here. At 16:10 I talk about using the Flow Log Resource ID (TargetResourceID in the table schema) to pull out the VNet information. I also call out that we do not have SrcVNet and DestVNet in the same schema. This is true, but there is another way to get this VNet data. It still relies on having Flow Logs enabled on all spokes. In the fields SrcSubnet and DestSubnet we expose the VNet as part of the output. You can parse that out and summarise based on it. Example below:
NTANetAnalytics
| where SubType == 'FlowLog' and FaSchemaVersion == '3' and FlowStartTime > ago(12d)
| extend DestVNet = tostring(split(DestSubnet, "/")[1])
| summarize TotalBytes=sum(BytesSrcToDest) by DestVNet
This will give you traffic volume based on the VNet level rather than Subnet level.
Excellent video, can you show how we can build Dashboard for express route traffic collector?
@@sreesree.b I have no plans to do this, the logic is very similar.