#Azure sentinel log analytics how to#

Select the Columns dropdown to change the list of columns. Click to the left of a row to expand its values. The results view displays query results in a table organized by columns and rows. You can also add a render command to your query. To display the results as a chart, select Chart in the results window. By default, the results are displayed as a table. The results of a query appear in the results window. To run the current query, select the Run button or select Shift+Enter. The current query is the one with the cursor positioned anywhere in it. A query can't include any blank lines, so you can separate multiple queries in a window with one or more blank lines. Select + at the top of the window to open another tab.Ī single window can include multiple queries. IntelliSense is used for KQL commands and color coding enhances readability. The query window is where you edit your query. Select one or more values, and then select Apply & Run to add a where command to the query and run it again. After you run a query, columns appear with different values from the results. Double-click a query to add it to the query window or hover over it for other options.Ĭreates filter options based on the results of a query. Select Group by to change the grouping of the queries. This list is the same one that appears when you open Log Analytics. List of example queries that you can open in the query window. Double-click a table or column name to add it to the query. Hover over a table name to display a dialog with a description of the table and options to view its documentation and preview its data. Select Group by to change the grouping of the tables. Lists the tables that are part of the selected scope. The sidebar on the left lists tables in the workspace, sample queries, and filter options for the current query. Open Query Explorer, which provides access to saved queries in the workspace. Open the example queries dialog that appears when you first open Log Analytics. Pin the results of the query to an Azure dashboard or add them to an Azure workbook.Īrrange the selected text for readability. Save the query to Query Explorer for the workspace.Ĭopy a link to the query, the query text, or the query results to the clipboard.Įxport the results of the query to a CSV file or the query to Power Query Formula Language format for use with Power BI. See Log query scope and time range in Azure Monitor Log Analytics. This action is overridden if you include a time filter in the query. Select the time range for the data available to the query. You can also select Shift+Enter to run a query. Run the selected query in the query window. This could be all the data in a Log Analytics workspace or data for a particular resource across multiple workspaces. Specifies the scope of data used for the query.

The top bar has controls for working with a query in the query window. The following image identifies four Log Analytics components. Select Queries at the top of the screen to get them back. If you want to start with an empty script and write it yourself, close the example queries.

#Azure sentinel log analytics how to#

Browsing through example queries is a good way to learn how to write your own queries. You can also load one to the editor and modify it as required. You might find one that does exactly what you need. Browse or search for queries that match your requirements.

When you start Log Analytics, a dialog appears that contains example queries. For more information, see Log query scope and time range in Azure Monitor Log Analytics. If you select Logs from another type of resource, your data will be limited to log data for that resource. If you start Log Analytics from the Azure Monitor menu or the Log Analytics workspaces menu, you'll have access to all the records in a workspace. But the menu you use to start Log Analytics determines the data that's available. No matter where you start Log Analytics, the tool is the same. You'll also see this option on the menu for most Azure resources. To start Log Analytics in the Azure portal, on the Azure Monitor menu select Logs. If you want to jump right into a tutorial, see Log Analytics tutorial. This article describes Log Analytics and its features.