Forum Discussion

Lucas Chies's avatar
Lucas Chies
Copper Contributor
Feb 04, 2020

Export VM reporting to Log Analytics

Hello Guys,

 

I need to export a list of machines that are reporting to Log Analytics.
I currently have multiple Log Analytics accounts and would like to have a list of which machines are responding to each account.

Has anyone ever done this or can you help me how to do it?

  • Lucas Chies

     

    When you say Accounts do you mean user accounts or a Log Analytic workspace?   

     

    This would list machines in a workspace - you'd need a cross workspace query for multiple ones, if that's the intent?

    Heartbeat
    | distinct Computer, TenantId
    | summarize by Computer

     

  • Lucas Chies

     

    When you say Accounts do you mean user accounts or a Log Analytic workspace?   

     

    This would list machines in a workspace - you'd need a cross workspace query for multiple ones, if that's the intent?

    Heartbeat
    | distinct Computer, TenantId
    | summarize by Computer

     

    • Lucas Chies's avatar
      Lucas Chies
      Copper Contributor

      Hello CliveWatson , tks for help me.

      So, when I say Account, I'm referring to Log Analytics Workspace, actually I've lot of workspace, if can help me with multi workspace, I thank you very much.

       

      • CliveWatson's avatar
        CliveWatson
        Icon for Microsoft rankMicrosoft

        Lucas Chies 

         

        https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/cross-workspace-query

         

        Providing you have less than 10k servers, this will work 

         

        union isfuzzy=true withsource = Source
        (Heartbeat                              |  distinct Computer, TenantId |  summarize by Computer, TenantId, ws ="Local"), 
        (workspace("test1").Heartbeat |  distinct Computer, TenantId |  summarize by Computer, TenantId, ws ="Test1"),
        (workspace("test2")       .Heartbeat |  distinct Computer, TenantId |  summarize by Computer, TenantId, ws ="Test2")
        | summarize count() by Computer, ws //, TenantId
        

        Formatting is a bit off, it should look like:

         

        Just add each workspace into a new line 

         

Resources