Can we update existing records of custom log table in log analytics workspace?

Rushit Ajudiya 146 Reputation points
2022-03-11T13:27:12.52+00:00

Hello,

We configured Azure Sentinel and ingested data into a custom log table in log analytics workspace. Now we want to update existing records in the log table. We have tried to use the replace_string() function of KQL to update some data in record but didn't get the required result. So, now we have a question that is it possible to update an existing record of a custom log table in a log analytics workspace or are custom log tables immutable that we can't change the existing record and can only add a new record into it?

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,867 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,002 questions
0 comments No comments
{count} votes

Accepted answer
  1. Andrew Blumhardt 9,581 Reputation points Microsoft Employee
    2022-03-11T13:50:29.04+00:00

    Data in the workspace is largely immutable. The records cannot be modified. There is a purge API intended for clearing spillage of PII or sensitive data. Comparable to events in the Windows event viewer. You can only add new records.

    Watchlists for static data and it supports record updates. It is also possible to read in data from external sources like blob files and SQL databases. Reading static files from an Azure file share was the primary method for static lookup lists before Watchlists were introduced.

    When working with workspace data the records are always in motion. New records arrive and old records expire constantly. One method for "updating" data in the workspace is to simply write in the updated record as a new entry. Then setup your queries or workbooks to only return the last record using an arg max summary. That way you always see the most recent record.

    2 people found this answer helpful.
    0 comments No comments

0 additional answers

Sort by: Most helpful