Query exported data from Azure Monitor in Azure Data Explorer

Exporting data from Azure Monitor to an Azure Storage account enables low-cost retention and the ability to reallocate logs to different regions. Use Azure Data Explorer to query data that was exported from your Log Analytics workspaces. After configuration, supported tables that are sent from your workspaces to a storage account will be available as a data source for Azure Data Explorer.

The process flow is to:

  1. Export data from the Log Analytics workspace to the storage account.
  2. Create an external table in your Azure Data Explorer cluster and mapping for the data types.
  3. Query data from Azure Data Explorer.

Diagram that shows Azure Data Explorer exported data querying flow.

Send data to Azure Storage

Azure Monitor logs can be exported to a storage account by using any of the following options:


You can use an existing Azure Data Explorer cluster or create a new dedicated cluster with the needed configurations.

Create an external table in Azure Data Explorer

An external table in Azure Data Explorer is a schema entity that refers to data stored outside of your cluster, such as in Azure Blob Storage or Azure Data Lake Store Gen2. Similar to tables, an external table has a defined schema. However, unlike tables, the data is stored and managed externally, separate from your cluster.

To access your exported Azure Monitor data, follow these steps to create an external table:

  1. Use the getschema operator from Log Analytics to get the schema of the exported table. This information includes the table's columns and their data types.

    Screenshot that shows a Log Analytics table schema.

  2. Create an external table using the Azure Data Explorer web UI wizard. In the schema tab, the tool attempts to automatically detect a schema. Make sure that the detected schema matches the schema from the previous step. If there are any discrepancies, adjust the schema by selecting the arrow on a column and accessing the menu.

    Screenshot of schema adjustment menu.

Query the exported data from Azure Data Explorer

Query the exported data from Azure Data Explorer with the external_table function, as shown in the following example:

external_table("HBTest","map") | take 10000

Screenshot that shows the Query Log Analytics exported data.