Declare and reuse table in Log Analytics workbook

Anonymous
2023-01-12T22:55:34.56+00:00

I am working on a large workbook that includes the same query with minor tweaks for each statistic and several large queries that look back over one to four months of data and I'm trying to improve its efficiency. Is there a way I can either:

  1. Query once for the data and save that into a variable. From that one run, reference it in multiple other queries. I tried doing this with parameters and I couldn't get it to work.
  2. Have it refresh the data once a day, so the workbook is already loaded when opening. I don't think this is possible, but I figured I'd ask.
Microsoft Security Microsoft Entra Microsoft Entra ID
Microsoft Security Microsoft Sentinel
{count} votes

2 answers

Sort by: Most helpful
  1. Clive Watson 7,866 Reputation points MVP Volunteer Moderator
    2023-01-24T16:48:02.8066667+00:00

    There is a way but it probably wont hold a vast amount of data - so cache wisely.

    Step 1 - build a Parameter using these highlighted settings (mine is called "cache")
    User's image

    Step 2 - Save, the parameter then enter your Query in the section highlighted (it's best to paste the query in here as it auto-runs each time you do anything)
    User's image

    Step 3 - Query as normal but using the Parameter instead of the Table Name
    User's image

    Let me know if this helps and Accept the answer please.

    0 comments No comments

  2. Clive Watson 7,866 Reputation points MVP Volunteer Moderator
    2023-01-31T15:33:24.55+00:00

    Just checking to see if this was helpful, if yes, could you please Accept the answer?

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.