Share via

Microsoft.OperationalInsights workspaces/tables 2023-09-01

Bicep resource definition

The workspaces/tables resource type can be deployed with operations that target:

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.OperationalInsights/workspaces/tables resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.OperationalInsights/workspaces/tables@2023-09-01' = {
  parent: resourceSymbolicName
  name: 'string'
  properties: {
    plan: 'string'
    restoredLogs: {
      endRestoreTime: 'string'
      sourceTable: 'string'
      startRestoreTime: 'string'
    }
    retentionInDays: int
    schema: {
      columns: [
        {
          dataTypeHint: 'string'
          description: 'string'
          displayName: 'string'
          name: 'string'
          type: 'string'
        }
      ]
      description: 'string'
      displayName: 'string'
      name: 'string'
    }
    searchResults: {
      description: 'string'
      endSearchTime: 'string'
      limit: int
      query: 'string'
      startSearchTime: 'string'
    }
    totalRetentionInDays: int
  }
}

Property Values

Microsoft.OperationalInsights/workspaces/tables

Name Description Value
name The resource name string

Constraints:
Min length = 4
Max length = 63
Pattern = ^[A-Za-z0-9-_]+$ (required)
parent In Bicep, you can specify the parent resource for a child resource. You only need to add this property when the child resource is declared outside of the parent resource.

For more information, see Child resource outside parent resource.		 Symbolic name for resource of type: workspaces
properties Table's properties. TableProperties

Column

Name Description Value
dataTypeHint Column data type logical hint. 'armPath'
'guid'
'ip'
'uri'
description Column description. string
displayName Column display name. string
name Column name. string
type Column data type. 'boolean'
'dateTime'
'dynamic'
'guid'
'int'
'long'
'real'
'string'

RestoredLogs

Name Description Value
endRestoreTime The timestamp to end the restore by (UTC). string
sourceTable The table to restore data from. string
startRestoreTime The timestamp to start the restore from (UTC). string

Schema

Name Description Value
columns A list of table custom columns. Column[]
description Table description. string
displayName Table display name. string
name Table name. string

SearchResults

Name Description Value
description Search job Description. string
endSearchTime The timestamp to end the search by (UTC) string
limit Limit the search job to return up to specified number of rows. int
query Search job query. string
startSearchTime The timestamp to start the search from (UTC) string

TableProperties

Name Description Value
plan Instruct the system how to handle and charge the logs ingested to this table. 'Analytics'
'Basic'
restoredLogs Parameters of the restore operation that initiated this table. RestoredLogs
retentionInDays The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention. int

Constraints:
Min value = 4
Max value = 730
schema Table schema. Schema
searchResults Parameters of the search job that initiated this table. SearchResults
totalRetentionInDays The table total retention in days, between 4 and 4383. Setting this property to -1 will default to table retention. int

Constraints:
Min value = 4
Max value = 4383

ARM template resource definition

The workspaces/tables resource type can be deployed with operations that target:

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.OperationalInsights/workspaces/tables resource, add the following JSON to your template.

{
  "type": "Microsoft.OperationalInsights/workspaces/tables",
  "apiVersion": "2023-09-01",
  "name": "string",
  "properties": {
    "plan": "string",
    "restoredLogs": {
      "endRestoreTime": "string",
      "sourceTable": "string",
      "startRestoreTime": "string"
    },
    "retentionInDays": "int",
    "schema": {
      "columns": [
        {
          "dataTypeHint": "string",
          "description": "string",
          "displayName": "string",
          "name": "string",
          "type": "string"
        }
      ],
      "description": "string",
      "displayName": "string",
      "name": "string"
    },
    "searchResults": {
      "description": "string",
      "endSearchTime": "string",
      "limit": "int",
      "query": "string",
      "startSearchTime": "string"
    },
    "totalRetentionInDays": "int"
  }
}

Property Values

Microsoft.OperationalInsights/workspaces/tables

Name Description Value
apiVersion The api version '2023-09-01'
name The resource name string

Constraints:
Min length = 4
Max length = 63
Pattern = ^[A-Za-z0-9-_]+$ (required)
properties Table's properties. TableProperties
type The resource type 'Microsoft.OperationalInsights/workspaces/tables'

Column

Name Description Value
dataTypeHint Column data type logical hint. 'armPath'
'guid'
'ip'
'uri'
description Column description. string
displayName Column display name. string
name Column name. string
type Column data type. 'boolean'
'dateTime'
'dynamic'
'guid'
'int'
'long'
'real'
'string'

RestoredLogs

Name Description Value
endRestoreTime The timestamp to end the restore by (UTC). string
sourceTable The table to restore data from. string
startRestoreTime The timestamp to start the restore from (UTC). string

Schema

Name Description Value
columns A list of table custom columns. Column[]
description Table description. string
displayName Table display name. string
name Table name. string

SearchResults

Name Description Value
description Search job Description. string
endSearchTime The timestamp to end the search by (UTC) string
limit Limit the search job to return up to specified number of rows. int
query Search job query. string
startSearchTime The timestamp to start the search from (UTC) string

TableProperties

Name Description Value
plan Instruct the system how to handle and charge the logs ingested to this table. 'Analytics'
'Basic'
restoredLogs Parameters of the restore operation that initiated this table. RestoredLogs
retentionInDays The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention. int

Constraints:
Min value = 4
Max value = 730
schema Table schema. Schema
searchResults Parameters of the search job that initiated this table. SearchResults
totalRetentionInDays The table total retention in days, between 4 and 4383. Setting this property to -1 will default to table retention. int

Constraints:
Min value = 4
Max value = 4383

Usage Examples

Terraform (AzAPI provider) resource definition

The workspaces/tables resource type can be deployed with operations that target:

  • Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.OperationalInsights/workspaces/tables resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.OperationalInsights/workspaces/tables@2023-09-01"
  name = "string"
  parent_id = "string"
  body = {
    properties = {
      plan = "string"
      restoredLogs = {
        endRestoreTime = "string"
        sourceTable = "string"
        startRestoreTime = "string"
      }
      retentionInDays = int
      schema = {
        columns = [
          {
            dataTypeHint = "string"
            description = "string"
            displayName = "string"
            name = "string"
            type = "string"
          }
        ]
        description = "string"
        displayName = "string"
        name = "string"
      }
      searchResults = {
        description = "string"
        endSearchTime = "string"
        limit = int
        query = "string"
        startSearchTime = "string"
      }
      totalRetentionInDays = int
    }
  }
}

Property Values

Microsoft.OperationalInsights/workspaces/tables

Name Description Value
name The resource name string

Constraints:
Min length = 4
Max length = 63
Pattern = ^[A-Za-z0-9-_]+$ (required)
parent_id The ID of the resource that is the parent for this resource. ID for resource of type: workspaces
properties Table's properties. TableProperties
type The resource type "Microsoft.OperationalInsights/workspaces/tables@2023-09-01"

Column

Name Description Value
dataTypeHint Column data type logical hint. 'armPath'
'guid'
'ip'
'uri'
description Column description. string
displayName Column display name. string
name Column name. string
type Column data type. 'boolean'
'dateTime'
'dynamic'
'guid'
'int'
'long'
'real'
'string'

RestoredLogs

Name Description Value
endRestoreTime The timestamp to end the restore by (UTC). string
sourceTable The table to restore data from. string
startRestoreTime The timestamp to start the restore from (UTC). string

Schema

Name Description Value
columns A list of table custom columns. Column[]
description Table description. string
displayName Table display name. string
name Table name. string

SearchResults

Name Description Value
description Search job Description. string
endSearchTime The timestamp to end the search by (UTC) string
limit Limit the search job to return up to specified number of rows. int
query Search job query. string
startSearchTime The timestamp to start the search from (UTC) string

TableProperties

Name Description Value
plan Instruct the system how to handle and charge the logs ingested to this table. 'Analytics'
'Basic'
restoredLogs Parameters of the restore operation that initiated this table. RestoredLogs
retentionInDays The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention. int

Constraints:
Min value = 4
Max value = 730
schema Table schema. Schema
searchResults Parameters of the search job that initiated this table. SearchResults
totalRetentionInDays The table total retention in days, between 4 and 4383. Setting this property to -1 will default to table retention. int

Constraints:
Min value = 4
Max value = 4383