How to filter Requests to public networks by the calling service

[smitty]

Using the Custom multidimensional analysis for Requests to public networks and filtering by a Request/Endpoint I'm able to view all the outbound requests from our environment.  I can create a custom metric from this as well and it works in DQL with no issues.   Problem is I can't filter this by the calling service and multiple services call the same public network.  How can I filter the calls to a public network by the calling service?

[Mizső · Accepted solution]

Hi @smitty 

I am new in DQL.

Play this one, it is not correct. This list contains those services which ones initiated a call to Requests to public networks. But the list not filtered, so it includes the initiatior service all handled calls not only the relevant calls to  Requests to public networks. 

fetch spans, from: -1d, to: now()

| filter isNotNull(endpoint.name)

| lookup [fetch dt.entity.service], sourceField: dt.entity.service, lookupField: id, fields: { caller.name = entity.name}
| lookup [fetch dt.entity.service | expand caller.id = called_by[dt.entity.service]], sourceField: dt.entity.service, lookupField: caller.id, fields: { called.name = entity.name}
| filter called.name == "Requests to public networks"

| summarize { count=count()}, by: {caller.name, called.name}

I have received this result:

I have created the opposit way also, but this does not work for Request to public networks (becaues its opaque service):

fetch spans, from: -1d, to: now()

| filter isNotNull(endpoint.name)

| lookup [fetch dt.entity.service], sourceField: dt.entity.service, lookupField: id, fields: { called.name = entity.name, id}
| lookup [fetch dt.entity.service | expand caller.id = calls[dt.entity.service]], sourceField: dt.entity.service, lookupField: caller.id, fields: { caller.name = entity.name}
| filter caller.name == "your not opaque service name"

| summarize { count=count()}, by: {caller.name, called.name, id}

I hope you or other community members can modify it and you can use it for your purposes.

Best regards,

János

[smitty]

Thanks for the DQL example.  I'm new to DQL as well and hindered by the fact we don't have the Platform Subscription license so I'm very limited in what I can do with DQL without it.  For example I can't use spans.
So, for now I'm using a work around and creating a custom metric for every environment and add rules in the Metric to do the filtering by environment and server.