Can we update existing records of custom log table in log analytics workspace?

Question

Hello,

We configured Azure Sentinel and ingested data into a custom log table in log analytics workspace. Now we want to update existing records in the log table. We have tried to use the replace_string() function of KQL to update some data in record but didn't get the required result. So, now we have a question that is it possible to update an existing record of a custom log table in a log analytics workspace or are custom log tables immutable that we can't change the existing record and can only add a new record into it?

Answer 1

Data in the workspace is largely immutable. The records cannot be modified. There is a purge API intended for clearing spillage of PII or sensitive data. Comparable to events in the Windows event viewer. You can only add new records.

Watchlists for static data and it supports record updates. It is also possible to read in data from external sources like blob files and SQL databases. Reading static files from an Azure file share was the primary method for static lookup lists before Watchlists were introduced.

When working with workspace data the records are always in motion. New records arrive and old records expire constantly. One method for "updating" data in the workspace is to simply write in the updated record as a new entry. Then setup your queries or workbooks to only return the last record using an arg max summary. That way you always see the most recent record.