SOLVED

Export VM reporting to Log Analytics

%3CLINGO-SUB%20id%3D%22lingo-sub-1149961%22%20slang%3D%22en-US%22%3EExport%20VM%20reporting%20to%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1149961%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20Guys%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20need%20to%20export%20a%20list%20of%20machines%20that%20are%20reporting%20to%20Log%20Analytics.%3CBR%20%2F%3EI%20currently%20have%20multiple%20Log%20Analytics%20accounts%20and%20would%20like%20to%20have%20a%20list%20of%20which%20machines%20are%20responding%20to%20each%20account.%3C%2FP%3E%3CP%3EHas%20anyone%20ever%20done%20this%20or%20can%20you%20help%20me%20how%20to%20do%20it%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1149961%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1150235%22%20slang%3D%22en-US%22%3ERe%3A%20Export%20VM%20reporting%20to%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1150235%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F115965%22%20target%3D%22_blank%22%3E%40Lucas%20Chies%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20you%20say%20Accounts%20do%20you%20mean%20user%20accounts%20or%20a%20Log%20Analytic%20workspace%3F%26nbsp%3B%20%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20would%20list%20machines%20in%20a%20workspace%20-%20you'd%20need%20a%20cross%20workspace%20query%20for%20multiple%20ones%2C%20if%20that's%20the%20intent%3F%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3EHeartbeat%0A%7C%20distinct%20Computer%2C%20TenantId%0A%7C%20summarize%20by%20Computer%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1150731%22%20slang%3D%22en-US%22%3ERe%3A%20Export%20VM%20reporting%20to%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1150731%22%20slang%3D%22en-US%22%3E%3CP%3EHello%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%2C%20tks%20for%20help%20me.%3C%2FP%3E%3CP%3ESo%2C%20when%20I%20say%20Account%2C%20I'm%20referring%20to%20Log%20Analytics%20Workspace%2C%20actually%20I've%20lot%20of%20workspace%2C%20if%20can%20help%20me%20with%20multi%20workspace%2C%20I%20thank%20you%20very%20much.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1150917%22%20slang%3D%22en-US%22%3ERe%3A%20Export%20VM%20reporting%20to%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1150917%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F115965%22%20target%3D%22_blank%22%3E%40Lucas%20Chies%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Flog-query%2Fcross-workspace-query%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Flog-query%2Fcross-workspace-query%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EProviding%20you%20have%20less%20than%2010k%20servers%2C%20this%20will%20work%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3Eunion%20isfuzzy%3Dtrue%20withsource%20%3D%20Source%0A(Heartbeat%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7C%20%20distinct%20Computer%2C%20TenantId%20%7C%20%20summarize%20by%20Computer%2C%20TenantId%2C%20ws%20%3D%22Local%22)%2C%20%0A(workspace(%22test1%22).Heartbeat%20%7C%20%20distinct%20Computer%2C%20TenantId%20%7C%20%20summarize%20by%20Computer%2C%20TenantId%2C%20ws%20%3D%22Test1%22)%2C%0A(workspace(%22test2%22)%20%20%20%20%20%20%20.Heartbeat%20%7C%20%20distinct%20Computer%2C%20TenantId%20%7C%20%20summarize%20by%20Computer%2C%20TenantId%2C%20ws%20%3D%22Test2%22)%0A%7C%20summarize%20count()%20by%20Computer%2C%20ws%20%2F%2F%2C%20TenantId%0A%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3EFormatting%20is%20a%20bit%20off%2C%20it%20should%20look%20like%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20733px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F168996i6BED372C8F9D0119%2Fimage-dimensions%2F733x77%3Fv%3D1.0%22%20width%3D%22733%22%20height%3D%2277%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EJust%20add%20each%20workspace%20into%20a%20new%20line%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hello Guys,

 

I need to export a list of machines that are reporting to Log Analytics.
I currently have multiple Log Analytics accounts and would like to have a list of which machines are responding to each account.

Has anyone ever done this or can you help me how to do it?

3 Replies
best response confirmed by Lucas Chies (Occasional Contributor)
Solution

@Lucas Chies

 

When you say Accounts do you mean user accounts or a Log Analytic workspace?   

 

This would list machines in a workspace - you'd need a cross workspace query for multiple ones, if that's the intent?

Heartbeat
| distinct Computer, TenantId
| summarize by Computer

 

Hello @Clive Watson , tks for help me.

So, when I say Account, I'm referring to Log Analytics Workspace, actually I've lot of workspace, if can help me with multi workspace, I thank you very much.

 

@Lucas Chies 

 

https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/cross-workspace-query

 

Providing you have less than 10k servers, this will work 

 

union isfuzzy=true withsource = Source
(Heartbeat                              |  distinct Computer, TenantId |  summarize by Computer, TenantId, ws ="Local"), 
(workspace("test1").Heartbeat |  distinct Computer, TenantId |  summarize by Computer, TenantId, ws ="Test1"),
(workspace("test2")       .Heartbeat |  distinct Computer, TenantId |  summarize by Computer, TenantId, ws ="Test2")
| summarize count() by Computer, ws //, TenantId

Formatting is a bit off, it should look like:

clipboard_image_0.png

 

Just add each workspace into a new line