Home

Which column has my data in Azure Log Analytics?

%3CLINGO-SUB%20id%3D%22lingo-sub-220093%22%20slang%3D%22en-US%22%3EWhich%20column%20has%20my%20data%20in%20Azure%20Log%20Analytics%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-220093%22%20slang%3D%22en-US%22%3E%3CP%3EHello.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20part%20of%20a%20support%20team%20for%20an%20application%20that's%20being%20moved%20over%20to%20the%20Azure%20Platform.%3C%2FP%3E%3CP%3EI'm%20trying%20out%20various%20queries%20to%20see%20what%20data%20is%20available%20in%20which%20location.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ee.g.%20If%20I%20want%20to%20see%20where%20any%20%22404%22%20errors%20show%20up%2C%20I%20write%20the%20following%20query%3C%2FP%3E%3CBLOCKQUOTE%3E%3CP%3Esearch%20in%20(*)%20%22404%22%20%7C%20summarize%20count()%20by%20%24table%3C%2FP%3E%3C%2FBLOCKQUOTE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20gives%20me%20the%20table%20names%20which%20have%20%22404%22%20along%20with%20the%20number%20of%20entries%20with%20that%20data.%3C%2FP%3E%3CBLOCKQUOTE%3E%3CP%3EAzureMetrics%20400%3C%2FP%3E%3CP%3EAzureDiagnostics%2037%2C548%3C%2FP%3E%3C%2FBLOCKQUOTE%3E%3CP%3EIs%20there%20a%20way%20in%20which%20I%20can%20locate%20the%20column%20which%20has%20the%20above%20data%2C%20after%20I've%20identified%20the%20table%3F%3C%2FP%3E%3CP%3Ee.g%20the%20above%20query%20shows%20that%20AzureDiagnostics%20has%20~37K%20rows%20which%20have%20404.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20query%20do%20I%20write%20to%20locate%20which%20column(s)%20have%20the%20data%20of%20interest%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20help%20is%20appreciated.%20Thank%20you!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-220093%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EApplication%20Insights%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-220142%22%20slang%3D%22en-US%22%3ERe%3A%20Which%20column%20has%20my%20data%20in%20Azure%20Log%20Analytics%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-220142%22%20slang%3D%22en-US%22%3E%3CP%3EOrion%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20the%20reply.%3C%2FP%3E%3CP%3EBut%20that%20gives%20all%20the%20columns%20in%20the%20given%20table.%3C%2FP%3E%3CP%3EI%20was%20looking%20to%20find%20out%20which%20column%20had%20the%20data%20(in%20my%20case%20the%20text%20%22404%22)%20of%20interest.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-220140%22%20slang%3D%22en-US%22%3ERe%3A%20Which%20column%20has%20my%20data%20in%20Azure%20Log%20Analytics%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-220140%22%20slang%3D%22en-US%22%3E%3CP%3EWhen%20creating%20a%20new%20query%2C%20try%20using%20the%20%22Analytics%22%20portal%20(selected%20with%20the%20button%20at%20the%20top%20of%20a%20query%20window).%20The%20black%20bar%20on%20the%20left%20had%20the%20entire%20schema.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20this%20helps!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Ashok Ganapathi
New Contributor

Hello.

 

I'm part of a support team for an application that's being moved over to the Azure Platform.

I'm trying out various queries to see what data is available in which location.

 

e.g. If I want to see where any "404" errors show up, I write the following query

search in (*) "404" | summarize count() by $table

 

This gives me the table names which have "404" along with the number of entries with that data.

AzureMetrics 400

AzureDiagnostics 37,548

Is there a way in which I can locate the column which has the above data, after I've identified the table?

e.g the above query shows that AzureDiagnostics has ~37K rows which have 404.

 

What query do I write to locate which column(s) have the data of interest?

 

Any help is appreciated. Thank you!

2 Replies

When creating a new query, try using the "Analytics" portal (selected with the button at the top of a query window). The black bar on the left had the entire schema.

 

Hope this helps!

 

Orion,

 

Thanks for the reply.

But that gives all the columns in the given table.

I was looking to find out which column had the data (in my case the text "404") of interest.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
38 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies