CODEWITHSUNDEEP
azureazure-data-explorerazure-log-analyticskql
Basti Tee
Basti Tee

Reputation: 155

Share basic Kusto query between multiple queries of a workbook

In my daily work I use Azure Log Analytics along with the Azure Monitor Workbooks. In most of these scenarios I am using some sort of parameters that users can use to drill down / limit the scope of the provided queries.

This requires my to provide these filters to my queries, e.g., something like

MyCustomLog 
| where TimeGenerated ({TimeFrame:value})
| where Server in ({Server:value})
...

The annoying part is that I do not find a way to re-use this boilerplate pattern over multiple queries, i.e., every time I add a filter or change the semantic I have to go over all the queries and update them, which is really tedious and error-prone, especially in bigger workbooks.

What I imaging is what I can do in the plain logging as well – use let and reuse it from there. Something like ...

let BasicUniverse = MyCustomLog 
| where TimeGenerated ({TimeFrame:value})
| where Server in ({Server:value});

... close to the parameter definition and then in each query reuse ...

BasicUniverse
| // Do some processing based on that

... which would be great as I only need to change the basic universe query once. Is that possible or is there a smart workaround?

Thanks in advance.

Upvotes: 3

Views: 1673

Answers (1)

Avnera
Avnera

Reputation: 7638

You can look at creating a Log Analytics workspace function and pass the relevant parameters to it.

Upvotes: 3

Related Questions