Forum Discussion
cryptoSHA
May 11, 2022Copper Contributor
get a table of all tables across x number of log analytics workspaces
Hi, I have ~20 Log Analytics workspaces and would like to create a query that would basically return my a table that would look like this: 'workspace_name' |'tables' ------------------------...
Clive_Watson
May 12, 2022Bronze Contributor
You need a Cross Workspace Query, please read Query across resources with Azure Monitor - Azure Monitor | Microsoft Docs
The Usage table is optimised to gather this data, and its cross workspace friendly - One example is:
workspace("yourWorkspaceName").Usage
| where TimeGenerated > ago(1d)
| summarize SizeMB = sum(Quantity), SizeGB = sum(Quantity)/1000 by DataType, IsBillable
You can extend this and use Pivot mode to display the results
union
(Usage
| where TimeGenerated > ago(1d)
| summarize SizeMB = sum(Quantity), SizeGB = sum(Quantity)/1000 by DataType, IsBillable, workspaceName='local'
),
(
workspace("nnnnn").Usage
| where TimeGenerated > ago(1d)
| summarize SizeMB = sum(Quantity), SizeGB = sum(Quantity)/1000 by DataType, IsBillable, workspaceName='fake'
)
If you know about Azure Workbooks, that has a feature where you can run a Query against any selected Workspace. An example if you want to go and look at the process, but its will only show data if you have Sentinel Azure-Sentinel/SentinelCentral.json at master · Azure/Azure-Sentinel (github.com)