Get started
Quickstart
Five steps. Steps 1 and 2 exist because they are where this goes wrong.
1. Confirm you can read the workspace
You need Log Analytics Reader on the workspace your API Management instance
sends diagnostics to. Nothing in this kit needs write access to anything.
2. Run the preflight query first
Download 00-preflight.kql,
paste it into Log Analytics, and run it. It reports, for each of the two
required tables: READY, PRESENT BUT EMPTY, PRESENT WITHOUT TOKEN DATA,
or NOT PRESENT.
Do this before anything else. A workspace that has never received the LLM diagnostic category does not hold an empty table — it holds no table, so every later query fails to resolve rather than returning zero rows. That reads as a broken kit and is not one. See Prerequisites for how to switch the category on.
3. Import the workbook
Download workbook.json.
In the Azure portal: Monitor → Workbooks → New → Advanced Editor (the
</> icon), replace the contents with the file, then Apply and Save.
Pick your workspace and a time range in the parameter row at the top. Thirty days is the default: long enough for weekday and weekend shape to appear, short enough to sit inside common retention.
4. Work down the page
The tiles run in a deliberate order — baseline, then concentration, then the three findings. Each states what it measured, not what you should do.
5. Read the results correctly
Two conventions run through every number. Read Reading the results before you quote any figure to anyone, in particular the usage-coverage column — it tells you what share of requests the totals actually rest on.
Running without the workbook
Every query is also a standalone file that runs unchanged when pasted straight into Log Analytics. Each declares its own 30-day window at the top, which you can edit:
let _startTime = ago(30d);
let _endTime = now();
The workbook runs the same query bodies with the time range supplied by its parameter instead. The workbook is generated from these files, so the two cannot disagree.
Handing it to an assistant
The kit ships AGENT-INSTRUCTIONS.md, written as an operator procedure
rather than a chat prompt: detect the environment, verify the data is there,
reveal what can be established, name what is missing, and act only on what
you approved. It is explicitly forbidden from changing routing, altering
endpoints, collecting prompts, or uploading anything.