Declare and reuse table in Log Analytics workbook

Russel Christie 41 Reputation points
2023-01-12T22:55:34.56+00:00

I am working on a large workbook that includes the same query with minor tweaks for each statistic and several large queries that look back over one to four months of data and I'm trying to improve its efficiency. Is there a way I can either:

  1. Query once for the data and save that into a variable. From that one run, reference it in multiple other queries. I tried doing this with parameters and I couldn't get it to work.
  2. Have it refresh the data once a day, so the workbook is already loaded when opening. I don't think this is possible, but I figured I'd ask.
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
959 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,090 questions
{count} votes

2 answers

Sort by: Most helpful
  1. Clive Watson 5,391 Reputation points MVP
    2023-01-24T16:48:02.8066667+00:00

    There is a way but it probably wont hold a vast amount of data - so cache wisely.

    Step 1 - build a Parameter using these highlighted settings (mine is called "cache")
    User's image

    Step 2 - Save, the parameter then enter your Query in the section highlighted (it's best to paste the query in here as it auto-runs each time you do anything)
    User's image

    Step 3 - Query as normal but using the Parameter instead of the Table Name
    User's image

    Let me know if this helps and Accept the answer please.

    0 comments No comments

  2. Clive Watson 5,391 Reputation points MVP
    2023-01-31T15:33:24.55+00:00

    Just checking to see if this was helpful, if yes, could you please Accept the answer?

    0 comments No comments