Is it possible to fetch subscription name from LA Rest API?

%3CLINGO-SUB%20id%3D%22lingo-sub-364045%22%20slang%3D%22en-US%22%3EIs%20it%20possible%20to%20fetch%20subscription%20name%20from%20LA%20Rest%20API%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-364045%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFrom%20our%20RP%2C%20we%20send%20resourceId%20along%20with%20other%20data%20to%20LA%20workspace%20through%20shoebox%20pipeline.%3C%2FP%3E%0A%3CP%3EI%20notice%20that%20apart%20from%20the%20data%20RP%20sends%2C%20I%20see%20other%20extra%20metadata%20fields%20like%20tenant%20id%2C%20subscription%20Id.%3CBR%20%2F%3E%3CBR%20%2F%3ESubscription%20name%20information%20is%20not%20available%20in%20AzureDiagnostics%20table.%3CBR%20%2F%3EHowever%2C%20when%20I%20checked%20the%20overview%20blade%20of%20LA%20workspace%2C%20I%20notice%20that%20subscription%20name%20is%20shown.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EI%20am%20wondering%20if%20it%20is%20possible%20to%20fetch%20subscription%20name%20using%20LA%20RestAPI%3F%20If%20not%20LA%2C%20any%20other%20Azure%20resource%20Rest%20API%20would%20provide%20that%3F%20Any%20pointers%20would%20be%20helpful.%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F86422i2489AC69034D889E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22LAinfo.JPG%22%20title%3D%22LAinfo.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-364045%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-364288%22%20slang%3D%22en-US%22%3ERe%3A%20Is%20it%20possible%20to%20fetch%20subscription%20name%20from%20LA%20Rest%20API%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-364288%22%20slang%3D%22en-US%22%3E%3CP%3ETwo%20options%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E1.%20Some%20tables%20have%20this%20data%2C%20I%20know%20if%20I%20run%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3E%2F%2FAzureNetworkAnalytics_CL%0Asearch%20%22%26lt%3B%20insert%20name%20of%20your%20subscription%20here%26gt%3B%22%0A%7C%20summarize%20by%20%24table%3C%2FPRE%3E%0A%3CP%3EI%20can%20see%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CSPAN%3E%3CSTRONG%3EAzureNetworkAnalytics_CL%3C%2FSTRONG%3E%20and%20%3CSTRONG%3EServiceDeck_CL%3C%2FSTRONG%3E%20have%20these%20records%20-%20if%20you%20have%20these%20you%20could%20join%20to%20that%20data%3F%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E2.%20Could%20you%20put%20a%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Fdatatableoperator%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Edatatable%3C%2FA%3E%20in%20your%20query%20to%20hold%20this%20info%3F%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%0A%3CPRE%3Elet%20mysub%20%3D%20datatable%20(SubscriptionId%3Astring%2C%20SubName%3Astring)%0A%5B%0A%22fakesubid-12344%22%2C%20%22Demo%20workdpace1%22%2C%0A%22fakesubid-12345%22%2C%20%22Demo%20workspace2%22%0A%5D%3B%0AAzureDiagnostics%0A%7C%20join%20(mysub)%20on%20SubscriptionId%0A%7C%20where%20SubscriptionId%20%3D%3D%22fakesubid-12345%22%0A%7C%20project%20SubName%2C%20SubscriptionId%0A%3C%2FPRE%3E%0A%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Highlighted
Microsoft

Hi,

 

From our RP, we send resourceId along with other data to LA workspace through shoebox pipeline.

I notice that apart from the data RP sends, I see other extra metadata fields like tenant id, subscription Id.

Subscription name information is not available in AzureDiagnostics table.
However, when I checked the overview blade of LA workspace, I notice that subscription name is shown.

 

I am wondering if it is possible to fetch subscription name using LA RestAPI? If not LA, any other Azure resource Rest API would provide that? Any pointers would be helpful.

 

 

LAinfo.JPG

 

1 Reply

Two options:

 

1. Some tables have this data, I know if I run 

//AzureNetworkAnalytics_CL
search "< insert name of your subscription here>"
| summarize by $table

I can see 

AzureNetworkAnalytics_CL and ServiceDeck_CL have these records - if you have these you could join to that data?
 
 
2. Could you put a datatable in your query to hold this info?
let mysub = datatable (SubscriptionId:string, SubName:string)
[
"fakesubid-12344", "Demo workdpace1",
"fakesubid-12345", "Demo workspace2"
];
AzureDiagnostics
| join (mysub) on SubscriptionId
| where SubscriptionId =="fakesubid-12345"
| project SubName, SubscriptionId