Forum Discussion

Stephen_C's avatar
Stephen_C
Icon for Neophyte rankNeophyte
4 months ago

Azure LogAnalytics Workspaces datasources

Has anyone created a custom Azure LogAnalytics Workspaces datasource?

I have a query written in Azure workbooks but not sure how to translate it to a Log Analytics Workspace Query in a Azure LogAnalytics Workspaces datasource.

This is the query in workbooks...

W3CIISLog
| where Computer contains "server1"
    or Computer contains "server2"
    or Computer contains "server3"
    or Computer contains "server4"
| summarize Code_Totals = count() by bin(TimeGenerated, 5m), scStatus
| render barchart 

  • chrisred's avatar
    chrisred
    Icon for Neophyte rankNeophyte
    4 months ago

    Not at DataSource, but you could look at the "Azure Site Recovery" official EventSource. This uses the "Azure Log Analytics Workspaces" collection method, which has a kusto query configured.

    I asked support about whether it was possible to use that collection method for our own custom EventSources. They said it wasn't supported. I played around with returning different fields, but with it being undocumented and support being evasive i gave up.

    Maybe it is the same situation with the DataSource, it has the option to configure a query, but no information on how it is supposed to work.

  • Stephen_C's avatar
    Stephen_C
    Icon for Neophyte rankNeophyte
    4 months ago

    Thanks, but I can't even find Azure Site Recovery eventsource in my portal...

  • chrisred's avatar
    chrisred
    Icon for Neophyte rankNeophyte
    4 months ago

    If it's not been installed it will be in the "Exchange" module section, an EventSource (E) called "Azure Site Recovery".