Tables - Create Or Update

Update or Create a Log Analytics workspace table.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName}?api-version=2023-09-01

URI Parameters

Name In Required Type Description
resourceGroupName
path True

string

The name of the resource group. The name is case insensitive.

subscriptionId
path True

string

The ID of the target subscription.

tableName
path True

string

The name of the table.

Regex pattern: ^[A-Za-z0-9-_]+$

workspaceName
path True

string

The name of the workspace.

Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$

api-version
query True

string

The API version to use for this operation.

Request Body

Name Type Description
properties.plan

TablePlanEnum

Instruct the system how to handle and charge the logs ingested to this table.

properties.restoredLogs

RestoredLogs

Parameters of the restore operation that initiated this table.

properties.retentionInDays

integer

The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention.

properties.schema

Schema

Table schema.

properties.searchResults

SearchResults

Parameters of the search job that initiated this table.

properties.totalRetentionInDays

integer

The table total retention in days, between 4 and 4383. Setting this property to -1 will default to table retention.

Responses

Name Type Description
200 OK

Table

OK response definition.

202 Accepted

Accepted response definition (Long running operation).

Other Status Codes

ErrorResponse

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

TablesUpsert

Sample request

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/oiautorest6685/providers/Microsoft.OperationalInsights/workspaces/oiautorest6685/tables/AzureNetworkFlow?api-version=2023-09-01

{
  "properties": {
    "schema": {
      "name": "AzureNetworkFlow",
      "columns": [
        {
          "name": "MyNewColumn",
          "type": "guid"
        }
      ]
    },
    "retentionInDays": 45,
    "totalRetentionInDays": 70
  }
}

Sample response

{
  "properties": {
    "schema": {
      "name": "AzureNetworkFlow",
      "tableSubType": "DataCollectionRuleBased",
      "tableType": "Microsoft",
      "columns": [
        {
          "isHidden": false,
          "name": "MyNewColumn",
          "type": "guid",
          "isDefaultDisplay": false
        }
      ],
      "standardColumns": [
        {
          "isHidden": true,
          "name": "TenantId",
          "type": "guid",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "SourceSystem",
          "type": "string",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "TimeGenerated",
          "type": "dateTime",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "AgentID",
          "type": "string",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "SourceIP",
          "type": "string",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "Protocol",
          "type": "string",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "SourcePort",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "DestinationPort",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "TcpFlags",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "Packets",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "Bytes",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "BytesOut",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "DurationInMs",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "RstCount",
          "type": "int",
          "isDefaultDisplay": false
        },
        {
          "isHidden": false,
          "name": "MaxSampleRtt",
          "type": "int",
          "isDefaultDisplay": false
        }
      ],
      "solutions": [
        "LogManagement"
      ]
    },
    "provisioningState": "Succeeded",
    "retentionInDays": 45,
    "totalRetentionInDays": 70,
    "archiveRetentionInDays": 25,
    "retentionInDaysAsDefault": false,
    "totalRetentionInDaysAsDefault": false,
    "plan": "Analytics"
  },
  "id": "/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/oiautorest6685/providers/Microsoft.OperationalInsights/workspaces/oiautorest6685/tables/AzureNetworkFlow",
  "name": "AzureNetworkFlow"
}
azure-asyncoperation: https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/providers/Microsoft.OperaitonalInsights/locations/eastus/operationstatuses/62e4d893-d233-4005-988e-a428d9f77076?api-version=2023-09-01
Location: https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/oiautorest6685/providers/Microsoft.OperaitonalInsights/workspaces/oiautorest6685/tables/table1_CL/operationresults/62e4d893-d233-4005-988e-a428d9f77076?api-version=2023-09-01

Definitions

Name Description
Column

Table column.

ColumnDataTypeHintEnum

Column data type logical hint.

ColumnTypeEnum

Column data type.

createdByType

The type of identity that created the resource.

ErrorAdditionalInfo

The resource management error additional info.

ErrorDetail

The error detail.

ErrorResponse

Error response

ProvisioningStateEnum

Table's current provisioning state. If set to 'updating', indicates a resource lock due to ongoing operation, forbidding any update to the table until the ongoing operation is concluded.

RestoredLogs

Restore parameters.

ResultStatistics

Search job execution statistics.

Schema

Table's schema.

SearchResults

Parameters of the search job that initiated this table.

SourceEnum

Table's creator.

systemData

Metadata pertaining to creation and last modification of the resource.

Table

Workspace data table definition.

TablePlanEnum

Instruct the system how to handle and charge the logs ingested to this table.

TableSubTypeEnum

The subtype describes what APIs can be used to interact with the table, and what features are available against it.

TableTypeEnum

Table's creator.

Column

Table column.

Name Type Description
dataTypeHint

ColumnDataTypeHintEnum

Column data type logical hint.

description

string

Column description.

displayName

string

Column display name.

isDefaultDisplay

boolean

Is displayed by default.

isHidden

boolean

Is column hidden.

name

string

Column name.

type

ColumnTypeEnum

Column data type.

ColumnDataTypeHintEnum

Column data type logical hint.

Name Type Description
armPath

string

An Azure Resource Model (ARM) path: /subscriptions/{...}/resourceGroups/{...}/providers/Microsoft.{...}/{...}/{...}/{...}...

guid

string

A standard 128-bit GUID following the standard shape, xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

ip

string

A standard V4/V6 ip address following the standard shape, x.x.x.x/y:y:y:y:y:y:y:y

uri

string

A string that matches the pattern of a URI, for example, scheme://username:password@host:1234/this/is/a/path?k1=v1&k2=v2#fragment

ColumnTypeEnum

Column data type.

Name Type Description
boolean

string

dateTime

string

dynamic

string

guid

string

int

string

long

string

real

string

string

string

createdByType

The type of identity that created the resource.

Name Type Description
Application

string

Key

string

ManagedIdentity

string

User

string

ErrorAdditionalInfo

The resource management error additional info.

Name Type Description
info

object

The additional info.

type

string

The additional info type.

ErrorDetail

The error detail.

Name Type Description
additionalInfo

ErrorAdditionalInfo[]

The error additional info.

code

string

The error code.

details

ErrorDetail[]

The error details.

message

string

The error message.

target

string

The error target.

ErrorResponse

Error response

Name Type Description
error

ErrorDetail

The error object.

ProvisioningStateEnum

Table's current provisioning state. If set to 'updating', indicates a resource lock due to ongoing operation, forbidding any update to the table until the ongoing operation is concluded.

Name Type Description
Deleting

string

Table state is deleting.

InProgress

string

Table schema is stable and without changes, table data is being updated.

Succeeded

string

Table state is stable and without changes, table is unlocked and open for new updates.

Updating

string

Table schema is still being built and updated, table is currently locked for any changes till the procedure is done.

RestoredLogs

Restore parameters.

Name Type Description
azureAsyncOperationId

string

Search results table async operation id.

endRestoreTime

string

The timestamp to end the restore by (UTC).

sourceTable

string

The table to restore data from.

startRestoreTime

string

The timestamp to start the restore from (UTC).

ResultStatistics

Search job execution statistics.

Name Type Description
ingestedRecords

integer

The number of rows that were returned by the search job.

progress

number

Search job completion percentage.

scannedGb

number

Search job: Amount of scanned data.

Schema

Table's schema.

Name Type Description
categories

string[]

Table category.

columns

Column[]

A list of table custom columns.

description

string

Table description.

displayName

string

Table display name.

labels

string[]

Table labels.

name

string

Table name.

solutions

string[]

List of solutions the table is affiliated with

source

SourceEnum

Table's creator.

standardColumns

Column[]

A list of table standard columns.

tableSubType

TableSubTypeEnum

The subtype describes what APIs can be used to interact with the table, and what features are available against it.

tableType

TableTypeEnum

Table's creator.

SearchResults

Parameters of the search job that initiated this table.

Name Type Description
azureAsyncOperationId

string

Search results table async operation id.

description

string

Search job Description.

endSearchTime

string

The timestamp to end the search by (UTC)

limit

integer

Limit the search job to return up to specified number of rows.

query

string

Search job query.

sourceTable

string

The table used in the search job.

startSearchTime

string

The timestamp to start the search from (UTC)

SourceEnum

Table's creator.

Name Type Description
customer

string

Tables created by the owner of the Workspace, and only found in this Workspace.

microsoft

string

Tables provisioned by the system, as collected via Diagnostic Settings, the Agents, or any other standard data collection means.

systemData

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt

string

The timestamp of resource creation (UTC).

createdBy

string

The identity that created the resource.

createdByType

createdByType

The type of identity that created the resource.

lastModifiedAt

string

The timestamp of resource last modification (UTC)

lastModifiedBy

string

The identity that last modified the resource.

lastModifiedByType

createdByType

The type of identity that last modified the resource.

Table

Workspace data table definition.

Name Type Description
id

string

Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}

name

string

The name of the resource

properties.archiveRetentionInDays

integer

The table data archive retention in days. Calculated as (totalRetentionInDays-retentionInDays)

properties.lastPlanModifiedDate

string

The timestamp that table plan was last modified (UTC).

properties.plan

TablePlanEnum

Instruct the system how to handle and charge the logs ingested to this table.

properties.provisioningState

ProvisioningStateEnum

Table's current provisioning state. If set to 'updating', indicates a resource lock due to ongoing operation, forbidding any update to the table until the ongoing operation is concluded.

properties.restoredLogs

RestoredLogs

Parameters of the restore operation that initiated this table.

properties.resultStatistics

ResultStatistics

Search job execution statistics.

properties.retentionInDays

integer

The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention.

properties.retentionInDaysAsDefault

boolean

True - Value originates from workspace retention in days, False - Customer specific.

properties.schema

Schema

Table schema.

properties.searchResults

SearchResults

Parameters of the search job that initiated this table.

properties.totalRetentionInDays

integer

The table total retention in days, between 4 and 4383. Setting this property to -1 will default to table retention.

properties.totalRetentionInDaysAsDefault

boolean

True - Value originates from retention in days, False - Customer specific.

systemData

systemData

Metadata pertaining to creation and last modification of the resource.

type

string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

TablePlanEnum

Instruct the system how to handle and charge the logs ingested to this table.

Name Type Description
Analytics

string

Logs that allow monitoring and analytics.

Basic

string

Logs that are adjusted to support high volume low value verbose logs.

TableSubTypeEnum

The subtype describes what APIs can be used to interact with the table, and what features are available against it.

Name Type Description
Any

string

The default subtype with which built-in tables are created.

Classic

string

Indicates a table created through the Data Collector API or with the custom logs feature of the MMA agent, or any table against which Custom Fields were created.

DataCollectionRuleBased

string

A table eligible to have data sent into it via any of the means supported by Data Collection Rules: the Data Collection Endpoint API, ingestion-time transformations, or any other mechanism provided by Data Collection Rules

TableTypeEnum

Table's creator.

Name Type Description
CustomLog

string

Custom log table.

Microsoft

string

Standard data collected by Azure Monitor.

RestoredLogs

string

Restored data.

SearchResults

string

Data collected by a search job.