Azure Site Recovery Log Analytics Query

AzureSiteRecoveryLogAnalytics.ps1

# Replication Provider Name
# Azure to Azure = A2A
# VMware to Azure = InMageAzureV2

# List All VMware to Azure Replication Jobs and the Max RPO value in the last 3 days

AzureDiagnostics
| where replicationProviderName_s == "InMageAzureV2"
| where TimeGenerated > ago(72h)
| where isnotempty(name_s) and isnotnull(name_s)
| summarize maxvalue = max(rpoInSeconds_d) by name_s
| project name_s , maxvalue 

# RPO Trend for a specific VMware to Azure Replication Job

AzureDiagnostics
| where replicationProviderName_s == "InMageAzureV2"
| where TimeGenerated > ago(72h)
| where isnotempty(name_s) and isnotnull(name_s)
| where name_s == "ContosoVM123"
| project TimeGenerated, name_s , RPO_in_seconds = rpoInSeconds_d
| render timechart

# Plot of table of all protected instances with their test failover status

AzureDiagnostics
| where replicationProviderName_s == "InMageAzureV2"
| where isnotempty(name_s) and isnotnull(name_s)
| where isnotempty(failoverHealth_s) and isnotnull(failoverHealth_s)
| summarize hint.strategy=partitioned arg_max(TimeGenerated, *) by name_s
| project VirtualMachine = name_s , VaultName = Resource , TestFailoverStatus = failoverHealth_s

# Plot a pie chart with a breakup of protected instances by their test failover health

AzureDiagnostics
| where replicationProviderName_s == "InMageAzureV2"
| where isnotempty(name_s) and isnotnull(name_s)
| where isnotempty(failoverHealth_s) and isnotnull(failoverHealth_s)
| summarize hint.strategy=partitioned arg_max(TimeGenerated, *) by name_s
| project name_s , Resource, failoverHealth_s
| summarize count() by failoverHealth_s
| render piechart

# Plot a bar chart with a breakup of protected instances by RPO. The data will be split into three RPO buckets – “<15 mins RPO”, “15-30 mins RPO” and “>30 mins RPO”

AzureDiagnostics
| where replicationProviderName_s == "InMageAzureV2"
| where isnotempty(name_s) and isnotnull(name_s)
| extend RPO = case(rpoInSeconds_d <= 900, "<15Min",rpoInSeconds_d <= 1800, "15-30Min",">30Min")
| summarize hint.strategy=partitioned arg_max(TimeGenerated, *) by name_s
| project name_s , RPO
| summarize Count = count() by RPO
| render barchart

# Plot a pie chart to get the breakup of protected instances by the mobility agent version

AzureDiagnostics
| where replicationProviderName_s == "InMageAzureV2"
| where isnotempty(name_s) and isnotnull(name_s)
| summarize hint.strategy=partitioned arg_max(TimeGenerated, *) by name_s
| project name_s , agentVersion_s
| summarize count() by agentVersion_s
| render piechart

# Plot a pie chart to get the breakup of the current replication health (Normal, Warning, Critical) of all protected instances

AzureDiagnostics
| where replicationProviderName_s == "InMageAzureV2"
| where isnotempty(name_s) and isnotnull(name_s)
| summarize hint.strategy=partitioned arg_max(TimeGenerated, *) by name_s
| project name_s , replicationHealth_s
| summarize count() by replicationHealth_s
| render piechart

I got the below error after using your first code:

'where' operator: Failed to resolve column or scalar expression named 'replicationProviderName_s' |