Home

Which column has my data in Azure Log Analytics?

%3CLINGO-SUB%20id%3D%22lingo-sub-220093%22%20slang%3D%22en-US%22%3EWhich%20column%20has%20my%20data%20in%20Azure%20Log%20Analytics%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-220093%22%20slang%3D%22en-US%22%3E%3CP%3EHello.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20part%20of%20a%20support%20team%20for%20an%20application%20that's%20being%20moved%20over%20to%20the%20Azure%20Platform.%3C%2FP%3E%3CP%3EI'm%20trying%20out%20various%20queries%20to%20see%20what%20data%20is%20available%20in%20which%20location.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ee.g.%20If%20I%20want%20to%20see%20where%20any%20%22404%22%20errors%20show%20up%2C%20I%20write%20the%20following%20query%3C%2FP%3E%3CBLOCKQUOTE%3E%3CP%3Esearch%20in%20(*)%20%22404%22%20%7C%20summarize%20count()%20by%20%24table%3C%2FP%3E%3C%2FBLOCKQUOTE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20gives%20me%20the%20table%20names%20which%20have%20%22404%22%20along%20with%20the%20number%20of%20entries%20with%20that%20data.%3C%2FP%3E%3CBLOCKQUOTE%3E%3CP%3EAzureMetrics%20400%3C%2FP%3E%3CP%3EAzureDiagnostics%2037%2C548%3C%2FP%3E%3C%2FBLOCKQUOTE%3E%3CP%3EIs%20there%20a%20way%20in%20which%20I%20can%20locate%20the%20column%20which%20has%20the%20above%20data%2C%20after%20I've%20identified%20the%20table%3F%3C%2FP%3E%3CP%3Ee.g%20the%20above%20query%20shows%20that%20AzureDiagnostics%20has%20~37K%20rows%20which%20have%20404.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20query%20do%20I%20write%20to%20locate%20which%20column(s)%20have%20the%20data%20of%20interest%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20help%20is%20appreciated.%20Thank%20you!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-220093%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EApplication%20Insights%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-220142%22%20slang%3D%22en-US%22%3ERe%3A%20Which%20column%20has%20my%20data%20in%20Azure%20Log%20Analytics%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-220142%22%20slang%3D%22en-US%22%3E%3CP%3EOrion%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20the%20reply.%3C%2FP%3E%3CP%3EBut%20that%20gives%20all%20the%20columns%20in%20the%20given%20table.%3C%2FP%3E%3CP%3EI%20was%20looking%20to%20find%20out%20which%20column%20had%20the%20data%20(in%20my%20case%20the%20text%20%22404%22)%20of%20interest.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-220140%22%20slang%3D%22en-US%22%3ERe%3A%20Which%20column%20has%20my%20data%20in%20Azure%20Log%20Analytics%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-220140%22%20slang%3D%22en-US%22%3E%3CP%3EWhen%20creating%20a%20new%20query%2C%20try%20using%20the%20%22Analytics%22%20portal%20(selected%20with%20the%20button%20at%20the%20top%20of%20a%20query%20window).%20The%20black%20bar%20on%20the%20left%20had%20the%20entire%20schema.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20this%20helps!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Ashok Ganapathi
New Contributor

Hello.

 

I'm part of a support team for an application that's being moved over to the Azure Platform.

I'm trying out various queries to see what data is available in which location.

 

e.g. If I want to see where any "404" errors show up, I write the following query

search in (*) "404" | summarize count() by $table

 

This gives me the table names which have "404" along with the number of entries with that data.

AzureMetrics 400

AzureDiagnostics 37,548

Is there a way in which I can locate the column which has the above data, after I've identified the table?

e.g the above query shows that AzureDiagnostics has ~37K rows which have 404.

 

What query do I write to locate which column(s) have the data of interest?

 

Any help is appreciated. Thank you!

2 Replies

When creating a new query, try using the "Analytics" portal (selected with the button at the top of a query window). The black bar on the left had the entire schema.

 

Hope this helps!

 

Orion,

 

Thanks for the reply.

But that gives all the columns in the given table.

I was looking to find out which column had the data (in my case the text "404") of interest.