All Apps and Add-ons

Parsing fields from Azure Log Analytics KQL Grabber

edhealea
Path Finder

Has anyone successfully parsed fields from the data gathered with Azure Log Analytics KQL Grabber?
We are working on pulling Log Analytics logs from Azure using KQL Grabber which works great for doing this. We are finding because KQL sends everything to the sourcetype KQL, we can't consistently parse fields out for our different inputs we have defined within KQL.

Labels (1)
0 Karma

02sangeet
Engager

Could you please help us, giving some idea about the extraction you used to solve this issue. I am also facing the same issue here, though  we are able to fetch some data from MS Azure log analytics but data shows only header part.

0 Karma

edhealea
Path Finder

If you are only getting header information, check your query in Log Analytics first. If it works correctly there then it should work in KQL. We haven't had one not work yet.

Also, Some logs in Azure only have header info and no data.  Not sure why that is.

0 Karma

a_naoum
Path Finder

In the latest version, you have the possibility to define sourcetype per stanza. I guess this can help you. 

As workaround you can always go to inputs.conf and hardcode the sourcetype there. That's general approach regardless the addon that you are using.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!