Forum Discussion
Analytic Rule Auditing with KQL
I'm looking to audit enabled analytic rules and perform transformations on the data using KQL and I'm wondering if this is possible? I know that the API can be used to list the enabled analytic r...
- You can but you'd need to ingest the data from the api, into a custom table - then you can use KQL on it. You can probably also use a Playbook to read the api, transform the data and export to your app in a single operation as well.
Note: If you do ingest it, you probably only need to to this once a day (or maybe less), so it's very low volume/cost.
I also showed the Workbook method in "Workspace Usage" --> Regular Checks --> Weekly --> Rules
You can but you'd need to ingest the data from the api, into a custom table - then you can use KQL on it. You can probably also use a Playbook to read the api, transform the data and export to your app in a single operation as well.
Note: If you do ingest it, you probably only need to to this once a day (or maybe less), so it's very low volume/cost.
I also showed the Workbook method in "Workspace Usage" --> Regular Checks --> Weekly --> Rules
Note: If you do ingest it, you probably only need to to this once a day (or maybe less), so it's very low volume/cost.
I also showed the Workbook method in "Workspace Usage" --> Regular Checks --> Weekly --> Rules
Thanks Clive, much appreciated.