EU Hub - Report Requests by OBP/Org
traces
| where message startswith "Component: Handler, Method: HandleRequest" // Requests into the Public Api
| extend
LogTimestamp = timestamp, // Create a new property to prevent UI thinking were setting the date range in the query
TransactionId = extract(@"(\w{4})(RQ|TX|AK|RS)([M|D|N|H|W|P|A])(\d{5})(\d{5})(\d{4})(00[1-9]|0\d{2}|[1-2]\d{2}|3[0-5]\d|36[0-6])([0-9a-fA-F]{32})", 0, message),
DayOfYear = extract(@"(\w{4})(RQ|TX|AK|RS)([M|D|N|H|W|P|A])(\d{5})(\d{5})(\d{4})(00[1-9]|0\d{2}|[1-2]\d{2}|3[0-5]\d|36[0-6])([0-9a-fA-F]{32})", 7, message, typeof(int))
| where DayOfYear == dayofyear(LogTimestamp) // Only want to include transactions created on the day the log was written
| summarize count(), min(LogTimestamp) by TransactionId // Summarize to remove the duplicates caused by responses using the initating requests Transaction Id
| extend
TransactionType = extract(@"(\w{4})(RQ|TX|AK|RS)([M|D|N|H|W|P|A])(\d{5})(\d{5})(\d{4})(00[1-9]|0\d{2}|[1-2]\d{2}|3[0-5]\d|36[0-6])([0-9a-fA-F]{32})", 1, TransactionId),
OrganisationId = extract(@"(\w{4})(RQ|TX|AK|RS)([M|D|N|H|W|P|A])(\d{5})(\d{5})(\d{4})(00[1-9]|0\d{2}|[1-2]\d{2}|3[0-5]\d|36[0-6])([0-9a-fA-F]{32})", 4, TransactionId)
| where TransactionType contains "RPRQ"
| summarize count() by bin(min_LogTimestamp, 1h), OrganisationId
- The resulting data provides the volume of report requests and the Org
