Azure LogAnalytics Workspaces datasources
Has anyone created a custom Azure LogAnalytics Workspaces datasource?
I have a query written in Azure workbooks but not sure how to translate it to a Log Analytics Workspace Query in a Azure LogAnalytics Workspaces datasource.
This is the query in workbooks...
W3CIISLog
| where Computer contains "server1"
or Computer contains "server2"
or Computer contains "server3"
or Computer contains "server4"
| summarize Code_Totals = count() by bin(TimeGenerated, 5m), scStatus
| render barchart
Stephen Cavernelis
Posted 2 years ago·Last reply 2 years ago
3 comments
Chris Red
·2 years agoIf it's not been installed it will be in the "Exchange" module section, an EventSource (E) called "Azure Site Recovery".
Stephen Cavernelis
OP2 years agoThanks, but I can't even find Azure Site Recovery eventsource in my portal...
Chris Red
·2 years agoNot at DataSource, but you could look at the "Azure Site Recovery" official EventSource. This uses the "Azure Log Analytics Workspaces" collection method, which has a kusto query configured.
I asked support about whether it was possible to use that collection method for our own custom EventSources. They said it wasn't supported. I played around with returning different fields, but with it being undocumented and support being evasive i gave up.
Maybe it is the same situation with the DataSource, it has the option to configure a query, but no information on how it is supposed to work.