{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.10",
  "parameters": {
    "tableName": {
      "type": "string",
      "metadata": {
        "description": "Specifies the name of the Workspace Table to create (_CL suffix will be added)."
      }
    },
    "dataCollectionRuleName": {
      "type": "string",
      "metadata": {
        "description": "Specifies the name of the Data Collection Rule to create."
      }
    },
    "workspaceName": {
      "type": "string",
      "metadata": {
        "description": "Specifies the name of the existing Log Analytics workspace in the deployment resource group."
      }
    },
    "endpointResourceName": {
      "type": "string",
      "metadata": {
        "description": "Specifies the name of the existing Data Collection Endpoint in the deployment resource group."
      }
    },
    "retentionInDays": {
      "type": "int",
      "defaultValue": 30,
      "minValue": 4,
      "maxValue": 730,
      "metadata": {
        "description": "Interactive retention of the table, in days."
      }
    },
    "totalRetentionInDays": {
      "type": "int",
      "defaultValue": 30,
      "minValue": 4,
      "maxValue": 4383,
      "metadata": {
        "description": "Total retention including archive, in days. Must be >= retentionInDays."
      }
    }
  },
  "variables": {
    "workspaceTable": "[concat(parameters('tableName'), '_CL')]",
    "streamName": "[concat('Custom-', variables('workspaceTable'))]"
  },
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces/tables",
      "apiVersion": "2025-07-01",
      "name": "[concat(parameters('workspaceName'), '/', variables('workspaceTable'))]",
      "properties": {
        "totalRetentionInDays": "[parameters('totalRetentionInDays')]",
        "plan": "Analytics",
        "schema": {
          "name": "[variables('workspaceTable')]",
          "columns": [
            {
              "name": "TimeGenerated",
              "type": "datetime"
            },
            {
              "name": "nfo_hostname",
              "type": "string"
            },
            {
              "name": "nfo_src_id",
              "type": "string"
            },
            {
              "name": "nfc_id",
              "type": "int"
            },
            {
              "name": "flow_type",
              "type": "string"
            },
            {
              "name": "exp_ip",
              "type": "string"
            },
            {
              "name": "exp_ip6",
              "type": "string"
            },
            {
              "name": "input_snmp",
              "type": "int"
            },
            {
              "name": "output_snmp",
              "type": "int"
            },
            {
              "name": "exp_name",
              "type": "string"
            },
            {
              "name": "input_if_name",
              "type": "string"
            },
            {
              "name": "input_if_alias",
              "type": "string"
            },
            {
              "name": "output_if_name",
              "type": "string"
            },
            {
              "name": "output_if_alias",
              "type": "string"
            },
            {
              "name": "protocol",
              "type": "int"
            },
            {
              "name": "src_ip",
              "type": "string"
            },
            {
              "name": "src_ip6",
              "type": "string"
            },
            {
              "name": "src_port",
              "type": "int"
            },
            {
              "name": "src_tos",
              "type": "int"
            },
            {
              "name": "src_asn",
              "type": "long"
            },
            {
              "name": "src_cc",
              "type": "string"
            },
            {
              "name": "src_region",
              "type": "string"
            },
            {
              "name": "src_city",
              "type": "string"
            },
            {
              "name": "src_lon",
              "type": "real"
            },
            {
              "name": "src_lat",
              "type": "real"
            },
            {
              "name": "src_mac",
              "type": "string"
            },
            {
              "name": "src_cloud_service",
              "type": "string"
            },
            {
              "name": "src_cloud_region",
              "type": "string"
            },
            {
              "name": "src_host",
              "type": "string"
            },
            {
              "name": "src_vlan",
              "type": "int"
            },
            {
              "name": "src_vm_name",
              "type": "string"
            },
            {
              "name": "src_vpc_name",
              "type": "string"
            },
            {
              "name": "src_subnet_name",
              "type": "string"
            },
            {
              "name": "src_tenant_name",
              "type": "string"
            },
            {
              "name": "src_bd_name",
              "type": "string"
            },
            {
              "name": "dest_ip",
              "type": "string"
            },
            {
              "name": "dest_ip6",
              "type": "string"
            },
            {
              "name": "dest_port",
              "type": "int"
            },
            {
              "name": "dest_tos",
              "type": "int"
            },
            {
              "name": "dest_asn",
              "type": "long"
            },
            {
              "name": "dest_cc",
              "type": "string"
            },
            {
              "name": "dest_region",
              "type": "string"
            },
            {
              "name": "dest_city",
              "type": "string"
            },
            {
              "name": "dest_lon",
              "type": "real"
            },
            {
              "name": "dest_lat",
              "type": "real"
            },
            {
              "name": "dest_vm_name",
              "type": "string"
            },
            {
              "name": "dest_vpc_name",
              "type": "string"
            },
            {
              "name": "dest_subnet_name",
              "type": "string"
            },
            {
              "name": "dest_tenant_name",
              "type": "string"
            },
            {
              "name": "dest_bd_name",
              "type": "string"
            },
            {
              "name": "dest_cloud_service",
              "type": "string"
            },
            {
              "name": "dest_cloud_region",
              "type": "string"
            },
            {
              "name": "dest_mac",
              "type": "string"
            },
            {
              "name": "dest_vlan",
              "type": "int"
            },
            {
              "name": "dest_host",
              "type": "string"
            },
            {
              "name": "tcp_flag",
              "type": "string"
            },
            {
              "name": "packets_in",
              "type": "long"
            },
            {
              "name": "bytes_in",
              "type": "long"
            },
            {
              "name": "packets_out",
              "type": "long"
            },
            {
              "name": "bytes_out",
              "type": "long"
            },
            {
              "name": "flow_count",
              "type": "long"
            },
            {
              "name": "action",
              "type": "string"
            },
            {
              "name": "state",
              "type": "string"
            },
            {
              "name": "latency",
              "type": "long"
            },
            {
              "name": "duration",
              "type": "long"
            },
            {
              "name": "direction",
              "type": "string"
            },
            {
              "name": "idp",
              "type": "string"
            },
            {
              "name": "username",
              "type": "string"
            },
            {
              "name": "user_count",
              "type": "int"
            },
            {
              "name": "app_id",
              "type": "string"
            },
            {
              "name": "app_name",
              "type": "string"
            },
            {
              "name": "app_desc",
              "type": "string"
            },
            {
              "name": "app_engine_id",
              "type": "string"
            },
            {
              "name": "threat_list_name",
              "type": "string"
            },
            {
              "name": "reputation",
              "type": "string"
            },
            {
              "name": "aws_vpc_id",
              "type": "string"
            },
            {
              "name": "aws_vpc_name",
              "type": "string"
            },
            {
              "name": "aws_interface_id",
              "type": "string"
            },
            {
              "name": "aws_account_id",
              "type": "string"
            },
            {
              "name": "gcp_reporter",
              "type": "string"
            },
            {
              "name": "gcp_exp",
              "type": "string"
            },
            {
              "name": "gcp_subnet_id",
              "type": "string"
            },
            {
              "name": "src_vm_ip_pub",
              "type": "string"
            },
            {
              "name": "aws_src_inst_id",
              "type": "string"
            },
            {
              "name": "gcp_src_project_id",
              "type": "string"
            },
            {
              "name": "gcp_src_vm_zone",
              "type": "string"
            },
            {
              "name": "azure_src_subs_id",
              "type": "string"
            },
            {
              "name": "azure_src_subs_name",
              "type": "string"
            },
            {
              "name": "azure_src_nsg_name",
              "type": "string"
            },
            {
              "name": "azure_src_vnet_name",
              "type": "string"
            },
            {
              "name": "azure_src_res_grp_name",
              "type": "string"
            },
            {
              "name": "oci_src_vcn_name",
              "type": "string"
            },
            {
              "name": "oci_src_compartment_name",
              "type": "string"
            },
            {
              "name": "oci_src_tenancy_name",
              "type": "string"
            },
            {
              "name": "dest_vm_ip_pub",
              "type": "string"
            },
            {
              "name": "aws_dest_inst_id",
              "type": "string"
            },
            {
              "name": "gcp_dest_project_id",
              "type": "string"
            },
            {
              "name": "gcp_dest_vm_zone",
              "type": "string"
            },
            {
              "name": "azure_dest_subs_id",
              "type": "string"
            },
            {
              "name": "azure_dest_subs_name",
              "type": "string"
            },
            {
              "name": "azure_dest_nsg_name",
              "type": "string"
            },
            {
              "name": "azure_dest_vnet_name",
              "type": "string"
            },
            {
              "name": "azure_dest_res_grp_name",
              "type": "string"
            },
            {
              "name": "oci_dest_vcn_name",
              "type": "string"
            },
            {
              "name": "oci_dest_compartment_name",
              "type": "string"
            },
            {
              "name": "oci_dest_tenancy_name",
              "type": "string"
            },
            {
              "name": "flow_start_time",
              "type": "long"
            },
            {
              "name": "flow_end_time",
              "type": "long"
            },
            {
              "name": "t_int",
              "type": "long"
            },
            {
              "name": "agent_ver",
              "type": "string"
            },
            {
              "name": "flow_start",
              "type": "long"
            },
            {
              "name": "flow_end",
              "type": "long"
            },
            {
              "name": "flow_start_ms",
              "type": "long"
            },
            {
              "name": "flow_end_ms",
              "type": "long"
            },
            {
              "name": "dns_suffix",
              "type": "string"
            },
            {
              "name": "user",
              "type": "string"
            },
            {
              "name": "user_acc_type",
              "type": "int"
            },
            {
              "name": "account",
              "type": "string"
            },
            {
              "name": "process_id",
              "type": "long"
            },
            {
              "name": "process",
              "type": "string"
            },
            {
              "name": "process_path",
              "type": "string"
            },
            {
              "name": "process_args",
              "type": "string"
            },
            {
              "name": "p_account",
              "type": "string"
            },
            {
              "name": "p_process",
              "type": "string"
            },
            {
              "name": "p_process_path",
              "type": "string"
            },
            {
              "name": "p_process_args",
              "type": "string"
            },
            {
              "name": "if_index",
              "type": "int"
            },
            {
              "name": "if_type",
              "type": "string"
            },
            {
              "name": "if_name",
              "type": "string"
            },
            {
              "name": "if_mac",
              "type": "string"
            },
            {
              "name": "ep_os_name",
              "type": "string"
            },
            {
              "name": "ep_os_ver",
              "type": "string"
            },
            {
              "name": "ep_os_ed",
              "type": "string"
            },
            {
              "name": "ep_sys_man",
              "type": "string"
            },
            {
              "name": "ep_sys_type",
              "type": "string"
            },
            {
              "name": "percent_of_total",
              "type": "real"
            },
            {
              "name": "site",
              "type": "string"
            },
            {
              "name": "device_type",
              "type": "string"
            },
            {
              "name": "post_nat_src_ip",
              "type": "string"
            },
            {
              "name": "post_nat_src_port",
              "type": "int"
            },
            {
              "name": "post_nat_dest_ip",
              "type": "string"
            },
            {
              "name": "post_nat_dest_port",
              "type": "int"
            },
            {
              "name": "src_cloud_provider",
              "type": "string"
            },
            {
              "name": "dest_cloud_provider",
              "type": "string"
            },
            {
              "name": "netscaler_client_retrans_count",
              "type": "int"
            },
            {
              "name": "netscaler_server_retrans_count",
              "type": "int"
            },
            {
              "name": "netscaler_client_rtt",
              "type": "int"
            },
            {
              "name": "netscaler_server_rtt",
              "type": "int"
            }
          ]
        },
        "retentionInDays": "[parameters('retentionInDays')]"
      }
    },
    {
      "type": "Microsoft.Insights/dataCollectionRules",
      "apiVersion": "2024-03-11",
      "name": "[parameters('dataCollectionRuleName')]",
      "location": "[resourceGroup().location]",
      "dependsOn": [
        "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), variables('workspaceTable'))]"
      ],
      "properties": {
        "dataCollectionEndpointId": "[resourceId('Microsoft.Insights/dataCollectionEndpoints', parameters('endpointResourceName'))]",
        "streamDeclarations": {
          "[variables('streamName')]": {
            "columns": [
              {
                "name": "time",
                "type": "datetime"
              },
              {
                "name": "nfo_hostname",
                "type": "string"
              },
              {
                "name": "nfo_src_id",
                "type": "string"
              },
              {
                "name": "nfc_id",
                "type": "dynamic"
              },
              {
                "name": "flow_type",
                "type": "string"
              },
              {
                "name": "exp_ip",
                "type": "string"
              },
              {
                "name": "exp_ip6",
                "type": "string"
              },
              {
                "name": "input_snmp",
                "type": "dynamic"
              },
              {
                "name": "output_snmp",
                "type": "dynamic"
              },
              {
                "name": "exp_name",
                "type": "string"
              },
              {
                "name": "input_if_name",
                "type": "string"
              },
              {
                "name": "input_if_alias",
                "type": "string"
              },
              {
                "name": "output_if_name",
                "type": "string"
              },
              {
                "name": "output_if_alias",
                "type": "string"
              },
              {
                "name": "protocol",
                "type": "dynamic"
              },
              {
                "name": "src_ip",
                "type": "string"
              },
              {
                "name": "src_ip6",
                "type": "string"
              },
              {
                "name": "src_port",
                "type": "dynamic"
              },
              {
                "name": "src_tos",
                "type": "dynamic"
              },
              {
                "name": "src_asn",
                "type": "dynamic"
              },
              {
                "name": "src_cc",
                "type": "string"
              },
              {
                "name": "src_region",
                "type": "string"
              },
              {
                "name": "src_city",
                "type": "string"
              },
              {
                "name": "src_lon",
                "type": "dynamic"
              },
              {
                "name": "src_lat",
                "type": "dynamic"
              },
              {
                "name": "src_mac",
                "type": "string"
              },
              {
                "name": "src_cloud_service",
                "type": "string"
              },
              {
                "name": "src_cloud_region",
                "type": "string"
              },
              {
                "name": "src_host",
                "type": "string"
              },
              {
                "name": "src_vlan",
                "type": "dynamic"
              },
              {
                "name": "src_vm_name",
                "type": "string"
              },
              {
                "name": "src_vpc_name",
                "type": "string"
              },
              {
                "name": "src_subnet_name",
                "type": "string"
              },
              {
                "name": "src_tenant_name",
                "type": "string"
              },
              {
                "name": "src_bd_name",
                "type": "string"
              },
              {
                "name": "dest_ip",
                "type": "string"
              },
              {
                "name": "dest_ip6",
                "type": "string"
              },
              {
                "name": "dest_port",
                "type": "dynamic"
              },
              {
                "name": "dest_tos",
                "type": "dynamic"
              },
              {
                "name": "dest_asn",
                "type": "dynamic"
              },
              {
                "name": "dest_cc",
                "type": "string"
              },
              {
                "name": "dest_region",
                "type": "string"
              },
              {
                "name": "dest_city",
                "type": "string"
              },
              {
                "name": "dest_lon",
                "type": "dynamic"
              },
              {
                "name": "dest_lat",
                "type": "dynamic"
              },
              {
                "name": "dest_vm_name",
                "type": "string"
              },
              {
                "name": "dest_vpc_name",
                "type": "string"
              },
              {
                "name": "dest_subnet_name",
                "type": "string"
              },
              {
                "name": "dest_tenant_name",
                "type": "string"
              },
              {
                "name": "dest_bd_name",
                "type": "string"
              },
              {
                "name": "dest_cloud_service",
                "type": "string"
              },
              {
                "name": "dest_cloud_region",
                "type": "string"
              },
              {
                "name": "dest_mac",
                "type": "string"
              },
              {
                "name": "dest_vlan",
                "type": "dynamic"
              },
              {
                "name": "dest_host",
                "type": "string"
              },
              {
                "name": "tcp_flag",
                "type": "string"
              },
              {
                "name": "packets_in",
                "type": "dynamic"
              },
              {
                "name": "bytes_in",
                "type": "dynamic"
              },
              {
                "name": "packets_out",
                "type": "dynamic"
              },
              {
                "name": "bytes_out",
                "type": "dynamic"
              },
              {
                "name": "flow_count",
                "type": "dynamic"
              },
              {
                "name": "action",
                "type": "string"
              },
              {
                "name": "state",
                "type": "string"
              },
              {
                "name": "latency",
                "type": "dynamic"
              },
              {
                "name": "duration",
                "type": "dynamic"
              },
              {
                "name": "direction",
                "type": "string"
              },
              {
                "name": "idp",
                "type": "string"
              },
              {
                "name": "username",
                "type": "string"
              },
              {
                "name": "user_count",
                "type": "dynamic"
              },
              {
                "name": "app_id",
                "type": "string"
              },
              {
                "name": "app_name",
                "type": "string"
              },
              {
                "name": "app_desc",
                "type": "string"
              },
              {
                "name": "app_engine_id",
                "type": "string"
              },
              {
                "name": "threat_list_name",
                "type": "string"
              },
              {
                "name": "reputation",
                "type": "string"
              },
              {
                "name": "aws_vpc_id",
                "type": "string"
              },
              {
                "name": "aws_vpc_name",
                "type": "string"
              },
              {
                "name": "aws_interface_id",
                "type": "string"
              },
              {
                "name": "aws_account_id",
                "type": "string"
              },
              {
                "name": "gcp_reporter",
                "type": "string"
              },
              {
                "name": "gcp_exp",
                "type": "string"
              },
              {
                "name": "gcp_subnet_id",
                "type": "string"
              },
              {
                "name": "src_vm_ip_pub",
                "type": "string"
              },
              {
                "name": "aws_src_inst_id",
                "type": "string"
              },
              {
                "name": "gcp_src_project_id",
                "type": "string"
              },
              {
                "name": "gcp_src_vm_zone",
                "type": "string"
              },
              {
                "name": "azure_src_subs_id",
                "type": "string"
              },
              {
                "name": "azure_src_subs_name",
                "type": "string"
              },
              {
                "name": "azure_src_nsg_name",
                "type": "string"
              },
              {
                "name": "azure_src_vnet_name",
                "type": "string"
              },
              {
                "name": "azure_src_res_grp_name",
                "type": "string"
              },
              {
                "name": "oci_src_vcn_name",
                "type": "string"
              },
              {
                "name": "oci_src_compartment_name",
                "type": "string"
              },
              {
                "name": "oci_src_tenancy_name",
                "type": "string"
              },
              {
                "name": "dest_vm_ip_pub",
                "type": "string"
              },
              {
                "name": "aws_dest_inst_id",
                "type": "string"
              },
              {
                "name": "gcp_dest_project_id",
                "type": "string"
              },
              {
                "name": "gcp_dest_vm_zone",
                "type": "string"
              },
              {
                "name": "azure_dest_subs_id",
                "type": "string"
              },
              {
                "name": "azure_dest_subs_name",
                "type": "string"
              },
              {
                "name": "azure_dest_nsg_name",
                "type": "string"
              },
              {
                "name": "azure_dest_vnet_name",
                "type": "string"
              },
              {
                "name": "azure_dest_res_grp_name",
                "type": "string"
              },
              {
                "name": "oci_dest_vcn_name",
                "type": "string"
              },
              {
                "name": "oci_dest_compartment_name",
                "type": "string"
              },
              {
                "name": "oci_dest_tenancy_name",
                "type": "string"
              },
              {
                "name": "flow_start_time",
                "type": "dynamic"
              },
              {
                "name": "flow_end_time",
                "type": "dynamic"
              },
              {
                "name": "t_int",
                "type": "dynamic"
              },
              {
                "name": "agent_ver",
                "type": "string"
              },
              {
                "name": "flow_start",
                "type": "dynamic"
              },
              {
                "name": "flow_end",
                "type": "dynamic"
              },
              {
                "name": "flow_start_ms",
                "type": "dynamic"
              },
              {
                "name": "flow_end_ms",
                "type": "dynamic"
              },
              {
                "name": "dns_suffix",
                "type": "string"
              },
              {
                "name": "user",
                "type": "string"
              },
              {
                "name": "user_acc_type",
                "type": "dynamic"
              },
              {
                "name": "account",
                "type": "string"
              },
              {
                "name": "process_id",
                "type": "dynamic"
              },
              {
                "name": "process",
                "type": "string"
              },
              {
                "name": "process_path",
                "type": "string"
              },
              {
                "name": "process_args",
                "type": "string"
              },
              {
                "name": "p_account",
                "type": "string"
              },
              {
                "name": "p_process",
                "type": "string"
              },
              {
                "name": "p_process_path",
                "type": "string"
              },
              {
                "name": "p_process_args",
                "type": "string"
              },
              {
                "name": "if_index",
                "type": "dynamic"
              },
              {
                "name": "if_type",
                "type": "string"
              },
              {
                "name": "if_name",
                "type": "string"
              },
              {
                "name": "if_mac",
                "type": "string"
              },
              {
                "name": "ep_os_name",
                "type": "string"
              },
              {
                "name": "ep_os_ver",
                "type": "string"
              },
              {
                "name": "ep_os_ed",
                "type": "string"
              },
              {
                "name": "ep_sys_man",
                "type": "string"
              },
              {
                "name": "ep_sys_type",
                "type": "string"
              },
              {
                "name": "percent_of_total",
                "type": "dynamic"
              },
              {
                "name": "site",
                "type": "string"
              },
              {
                "name": "device_type",
                "type": "string"
              },
              {
                "name": "post_nat_src_ip",
                "type": "string"
              },
              {
                "name": "post_nat_src_port",
                "type": "dynamic"
              },
              {
                "name": "post_nat_dest_ip",
                "type": "string"
              },
              {
                "name": "post_nat_dest_port",
                "type": "dynamic"
              },
              {
                "name": "src_cloud_provider",
                "type": "string"
              },
              {
                "name": "dest_cloud_provider",
                "type": "string"
              },
              {
                "name": "netscaler_client_retrans_count",
                "type": "dynamic"
              },
              {
                "name": "netscaler_server_retrans_count",
                "type": "dynamic"
              },
              {
                "name": "netscaler_client_rtt",
                "type": "dynamic"
              },
              {
                "name": "netscaler_server_rtt",
                "type": "dynamic"
              }
            ]
          }
        },
        "destinations": {
          "logAnalytics": [
            {
              "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]",
              "name": "destWorkspace"
            }
          ]
        },
        "dataFlows": [
          {
            "streams": [
              "[variables('streamName')]"
            ],
            "destinations": [
              "destWorkspace"
            ],
            "transformKql": "source\n| extend TimeGenerated = todatetime([\"time\"])\n| extend nfc_id = toint(tostring(nfc_id)), input_snmp = toint(tostring(input_snmp)), output_snmp = toint(tostring(output_snmp)), protocol = toint(tostring(protocol)), src_port = toint(tostring(src_port)), src_tos = toint(tostring(src_tos)), src_asn = tolong(tostring(src_asn)), src_lon = toreal(tostring(src_lon)), src_lat = toreal(tostring(src_lat)), src_vlan = toint(tostring(src_vlan)), dest_port = toint(tostring(dest_port)), dest_tos = toint(tostring(dest_tos)), dest_asn = tolong(tostring(dest_asn)), dest_lon = toreal(tostring(dest_lon)), dest_lat = toreal(tostring(dest_lat)), dest_vlan = toint(tostring(dest_vlan)), packets_in = tolong(tostring(packets_in)), bytes_in = tolong(tostring(bytes_in)), packets_out = tolong(tostring(packets_out)), bytes_out = tolong(tostring(bytes_out)), flow_count = tolong(tostring(flow_count)), latency = tolong(tostring(latency)), duration = tolong(tostring(duration)), user_count = toint(tostring(user_count)), flow_start_time = tolong(tostring(flow_start_time)), flow_end_time = tolong(tostring(flow_end_time)), t_int = tolong(tostring(t_int)), flow_start = tolong(tostring(flow_start)), flow_end = tolong(tostring(flow_end)), flow_start_ms = tolong(tostring(flow_start_ms)), flow_end_ms = tolong(tostring(flow_end_ms)), user_acc_type = toint(tostring(user_acc_type)), process_id = tolong(tostring(process_id)), if_index = toint(tostring(if_index)), percent_of_total = toreal(tostring(percent_of_total)), post_nat_src_port = toint(tostring(post_nat_src_port)), post_nat_dest_port = toint(tostring(post_nat_dest_port)), netscaler_client_retrans_count = toint(tostring(netscaler_client_retrans_count)), netscaler_server_retrans_count = toint(tostring(netscaler_server_retrans_count)), netscaler_client_rtt = toint(tostring(netscaler_client_rtt)), netscaler_server_rtt = toint(tostring(netscaler_server_rtt))\n| project-away [\"time\"]\n",
            "outputStream": "[variables('streamName')]"
          }
        ],
        "description": "NFO custom Logs Ingestion API rule deployed by netflow-dcr-template 1.0.0.10."
      }
    }
  ],
  "outputs": {
    "workspaceTableId": {
      "type": "string",
      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), variables('workspaceTable'))]"
    },
    "dataCollectionRuleId": {
      "type": "string",
      "value": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName'))]"
    },
    "dataCollectionRuleImmutableId": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName')), '2024-03-11').immutableId]"
    },
    "logsIngestionEndpoint": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.Insights/dataCollectionEndpoints', parameters('endpointResourceName')), '2024-03-11').logsIngestion.endpoint]"
    },
    "streamName": {
      "type": "string",
      "value": "[variables('streamName')]"
    }
  }
}