CODEWITHSUNDEEP
azureazure-log-analyticsazure-data-explorerkql
Peter
Peter

Reputation: 3857

Query multiple tables in Azure Log Analytics

I am looking at Azure log analytics for a web app, and I have multiple out-of-the-box "tables" containing data: traces, requests, exceptions, etc.

Can I construct a query that runs on data from multiple tables? I don't want to join data from different sources, I just want to concatenate/interleave it, so I can look for e.g. "all traces and exceptions that contain the string 'SQL'".

Notionally, something like:

traces, exceptions
| where * contains "SQL"
| order by timestamp desc
| limit 100

Is this possible?

Upvotes: 9

Views: 17420

Answers (2)

Carlos Garcia
Carlos Garcia

Reputation: 2970

you can use union. Something I found very useful is to union all tables with union *. For example:

union *
| where * contains "SQL"

This way you will search in all tables for any column that contains SQL

If you want specific tables (for example traces and exceptions):

traces 
| union exceptions
| where * contains "SQL"

[Edit] There is also a newer command, with the same result (no benefits or cons with the previous one)

search in (table1, table2, table3) "SQL"
| where timestamp > ago(6h)

Upvotes: 12

Matthias Güntert
Matthias Güntert

Reputation: 4640

You might also want to consider the search operator

search in (exceptions, traces) "SQL"
| order by timestamp desc 
| take 100

https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/searchoperator?pivots=azuredataexplorer

Upvotes: 0

Related Questions