Forum Discussion
Solved
Get listing of logs
It is easy to see all of the logs in Sentinel/Log Analytics workspace, but how can we easily export a listing of those logs? not the data, just the log names
- Did you just want the table names? If so -
union withsource= table *
| distinct table
And if you are interested in the busiest tables
union withsource= table *
| summarize count()by table
One other method is to use the Usage Table.
Usage is an aggregated Table that knows about all the other Tables, so you can query that for better performance (runs in less than half the time on my data).
This is not a big issue for a simple query like these examples, but can help if this ends up being frequent or the query more complex.
Usage
| summarize count() by DataType
Thanks, in my small workspace, the Usage query took 0.7 secs for 34 records and the Union took 1.3 secs