Get listing of logs

[Dean Gross]

It is easy to see all of the logs in Sentinel/Log Analytics workspace, but how can we easily export a listing of those logs? not the data, just the log names

[#2 · Accepted solution]

Did you just want the table names? If so -

union withsource= table *
| distinct table

And if you are interested in the busiest tables

union withsource= table *
| summarize count()by table

[#3]

@m_zorich @Dean Gross 

One other method is to use the Usage Table.  

Usage is an aggregated Table that knows about all the other Tables, so you can query that for better performance (runs in less than half the time on my data).
This is not a big issue for a simple query like these examples, but can help if this ends up being frequent or the query more complex.

Usage
| summarize count() by DataType

[#4]

Thanks, in my small workspace, the Usage query took 0.7 secs for 34 records and the Union took 1.3 secs

[#5]

Wouldn't you need to take into account the Quantity field to really determine which ones were busy or do you just care about the number of hits rather than how much data each table ingested?

[#6]

The ask was for just the Tables, but if you need to judge 'busy' - you could use quantity and or count. Usage is good for this as its quick but you do lack some detail...for most cases it's normally fine. For more complex KQL it's a trade between perf and detail