Permissions required to update LogAnalytics AzureDiagnostics table output

%3CLINGO-SUB%20id%3D%22lingo-sub-1475141%22%20slang%3D%22en-US%22%3EPermissions%20required%20to%20update%20LogAnalytics%20AzureDiagnostics%20table%20output%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1475141%22%20slang%3D%22en-US%22%3E%3CP%3EGood%20afternoon%2C%3C%2FP%3E%3CP%3EJust%20starting%20to%20get%20my%20feet%20wet%20on%20loganalytics%20queries%26nbsp%3B%20I%20can%20run%20this%20query%3A%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EAzureDiagnostics%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20LogicalServerName_s%20%3C%2FSPAN%3E%3CSPAN%3Econtains%3C%2FSPAN%3E%20%3CSPAN%3E'server1'%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20Resource%20%3C%2FSPAN%3E%3CSPAN%3Econtains%3C%2FSPAN%3E%20%3CSPAN%3E'database1'%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20Category%20%3C%2FSPAN%3E%3CSPAN%3Econtains%3C%2FSPAN%3E%20%3CSPAN%3E'Errors'%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EAnd%20I%20get%20some%20good%20valuable%20data.%26nbsp%3B%20There%20are%20a%20bunch%20of%20default%20columns%20that%20are%20output.%20However%20there%20is%20also%20the%20'columns%20filter'%20option%20where%20I%20can%20choose%20more%20%2F%20less%20columns%20in%20my%20result%20set%20from%20Azurediagnostics.%26nbsp%3B%20But%20I%20can't%20save%20my%20selections.%26nbsp%3B%20It%20always%20resets%20to%20the%20default%20column%20values%20when%20I%20rerun%20the%20query.%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3ECan%20you%20provide%20the%20permissions%20I%20require%20to%20update%20this%20option%3F%26nbsp%3B%20Thank%20you%20for%20your%20time.%20You%20have%20been%20very%20helpful%20so%20far.%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1475141%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1476415%22%20slang%3D%22en-US%22%3ERe%3A%20Permissions%20required%20to%20update%20LogAnalytics%20AzureDiagnostics%20table%20output%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1476415%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F699803%22%20target%3D%22_blank%22%3E%40MarkSteben%3C%2FA%3E%26nbsp%3BUse%20project%20to%20choose%20the%20columns%20you%20want%2C%20for%20instance%3A%3C%2FP%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3EAzureDiagnostics%0A%7C%20where%20LogicalServerName_s%20contains%26nbsp%3Band%26nbsp%3Bserver1'%26nbsp%3Band%26nbsp%3BResource%26nbsp%3Bcontains%26nbsp%3B'database1'%26nbsp%3Band%26nbsp%3BCategory%26nbsp%3Bcontains%26nbsp%3B'Errors'%0A%7C%20project%20TimeGenerated%2C%20Resource%2C%20OperationName%2C%20LogicalServerName_s%2C%20DatabaseName_s%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eor%20project-away%20removes%20columns%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1477727%22%20slang%3D%22en-US%22%3ERe%3A%20Permissions%20required%20to%20update%20LogAnalytics%20AzureDiagnostics%20table%20output%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1477727%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F452208%22%20target%3D%22_blank%22%3E%40JK_UK%3C%2FA%3E%26nbsp%3B%20%26nbsp%3BThank%20you%20for%20your%20help!!%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Good afternoon,

Just starting to get my feet wet on loganalytics queries  I can run this query:

AzureDiagnostics
| where LogicalServerName_s contains 'server1' and Resource contains 'database1' and Category contains 'Errors'
And I get some good valuable data.  There are a bunch of default columns that are output. However there is also the 'columns filter' option where I can choose more / less columns in my result set from Azurediagnostics.  But I can't save my selections.  It always resets to the default column values when I rerun the query.
 
Can you provide the permissions I require to update this option?  Thank you for your time. You have been very helpful so far.
2 Replies

 

@MarkSteben Use project to choose the columns you want, for instance:

 

 

AzureDiagnostics
| where LogicalServerName_s contains and server1' and Resource contains 'database1' and Category contains 'Errors'
| project TimeGenerated, Resource, OperationName, LogicalServerName_s, DatabaseName_s

 

or project-away removes columns