capabilities.work

Resolve Workspace by Resource Group and Run KQL

A 3-step recipe with Azure Log Analytics. We can help you get access.

Recipe · 3 steps

Resolve Workspace by Resource Group and Run KQL

with Azure Log Analytics

List resource-group workspaces, resolve one, and execute a KQL query.

  1. List the Log Analytics workspaces within the resource group so the target workspace can be confirmed before resolving it.
  2. Read the management record for the chosen workspace to obtain its customer (workspace) ID.
  3. Execute the KQL query against the resolved workspace and return the tabular results.
What you'll need to have ready
  • subscriptionId: The ID of the target Azure subscription.
  • resourceGroupName: The resource group whose workspaces are listed.
  • workspaceName: The management name of the Log Analytics workspace to resolve.
  • workspaceId: The customer (workspace) GUID used by the query endpoint.
  • query: The KQL query to execute against the workspace.
  • timespan: Optional ISO 8601 duration limiting the query window (e.g. P7D).
  • managementApiVersion: The management API version to use.
For your developer

Arazzo workflow azure-log-analytics:resolve-workspace-and-run-kql, 3 operations: listWorkspacesByResourceGroup → getWorkspace → postQuery. Specs on APIs.io.

More recipes with Azure Log Analytics

Audit and Clean Up a Saved SearchCreate Workspace and Baseline Custom TableCross-Workspace QueryDiscover and Query WorkspaceIngest Logs and VerifyBrowse Saved Searches and Run OneInspect Table Schema then QueryValidate then Save a KQL QueryProvision Custom Table then Ingest and VerifyQuery Workspace by Name (GET)