Articles → MICROSOFT AZURE → Query The Log Analytics Workspace In Azure

Query The Log Analytics Workspace In Azure

In this article, we will query the log analytics workspace in Azure.

Steps

For querying the log analytics workspace,we will work on the following steps: -

Create a virtual machine
Create a log analytics workspace
Connect the virtual machine to the log analytics workspace
Create an agent configuration
Query log analytics workspace

So, let us start.

Create A Virtual Machine

First, create a virtual machine.

Picture showing the virtual machine created in Azure portal

Click to Enlarge

Create A Log Analytics Workspace

The second step is to create a log analytics workspace.

Picture showing the log analytics workspace created in Azure portal

Click to Enlarge

Connect The Virtual Machine To The Log Analytics Workspace

To connect the virtual machine in the log analytics workspace, go to the "Virtual machines" menu in the detail screen of the log analytics workspace.

Picture showing the virtual machines menu inside the log analytics workspace

Click to Enlarge

A screen will appear on the right-hand side.

Picture showing the virtual machine in the disconnected state

Click to Enlarge

Click on the virtual machine to connect. Another screen will appear with the "Connect" button.

Picture showing the screen to connect a virtual machine with log analytics workspace

Click to Enlarge

Click on the "Connect" button. The virtual machine is connected to the log analytics workspace.

Picture showing the virtual machine is connected to the load analytics workspace

Click to Enlarge

Create An Agent Configuration

For creating an agent configuration, click on the "Agents configuration" menu on the left-hand side.

Picture showing the agent configuration section for selecting the type of event to be logged

Click to Enlarge

A screen will appear on the right-hand side (See the image above). Click on the "+ Add windows event log" button.

Picture showing Application is selected as Log Name

Click to Enlarge

Select the "Log name" as "Application" and click on the "Apply" button.

Query Log Analytics Workspace

Before we query the log analytics workspace, login to the virtual machine and execute the following PowerShell script in Admin mode.

New-EventLog -LogName Application -Source ‘Gyansangrah’

Write-EventLog -LogName Application -EventID 2001 -EntryType Warning -Source ‘Gyansangrah’ -Message ‘How are you Gyan?’

Now, go to the "Logs" menu of the log analytics workspace and write the following query.

Event

Picture showing the events logged in log analytics workspace

Click to Enlarge

As you can see in the image above, the "Event" table contains an entry of the PowerShell script executed on the virtual machine.

How To Search A String In The Table?

For searching the string in the table, we can use the "Search" statement.

Event 
| search "manager"

Using the above query, we are searching for the word "manager" in all the columns of the search result.

Picture showing how to search a string in the result using the Search statement

Click to Enlarge

Posted By -	Karan Gupta

Posted On -	Thursday, June 9, 2022

Updated On -	Monday, June 13, 2022

Query/Feedback

Your Email Id		**

Subject		*

Query/Feedback	Characters remaining 250	**