Tables - Create Or Update
Update or Create a Log Analytics workspace table.
PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/tables/{tableName}?api-version=2022-10-01
URI Parameters
Name | In | Required | Type | Description |
---|---|---|---|---|
resource
|
path | True |
string |
The name of the resource group. The name is case insensitive. |
subscription
|
path | True |
string |
The ID of the target subscription. |
table
|
path | True |
string |
The name of the table. |
workspace
|
path | True |
string |
The name of the workspace. Regex pattern: |
api-version
|
query | True |
string |
The API version to use for this operation. |
Request Body
Name | Type | Description |
---|---|---|
properties.plan |
Instruct the system how to handle and charge the logs ingested to this table. |
|
properties.restoredLogs |
Parameters of the restore operation that initiated this table. |
|
properties.retentionInDays |
integer |
The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention. |
properties.schema |
Table schema. |
|
properties.searchResults |
Parameters of the search job that initiated this table. |
|
properties.totalRetentionInDays |
integer |
The table total retention in days, between 4 and 4383. Setting this property to -1 will default to table retention. |
Responses
Name | Type | Description |
---|---|---|
200 OK |
OK response definition. |
|
202 Accepted |
Accepted response definition (Long running operation). |
|
Other Status Codes |
Error response describing why the operation failed. |
Security
azure_auth
Azure Active Directory OAuth2 Flow
Type:
oauth2
Flow:
implicit
Authorization URL:
https://login.microsoftonline.com/common/oauth2/authorize
Scopes
Name | Description |
---|---|
user_impersonation | impersonate your user account |
Examples
TablesUpsert
Sample request
PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/oiautorest6685/providers/Microsoft.OperationalInsights/workspaces/oiautorest6685/tables/AzureNetworkFlow?api-version=2022-10-01
{
"properties": {
"schema": {
"name": "AzureNetworkFlow",
"columns": [
{
"name": "MyNewColumn",
"type": "guid"
}
]
},
"retentionInDays": 45,
"totalRetentionInDays": 70
}
}
Sample response
{
"properties": {
"schema": {
"name": "AzureNetworkFlow",
"tableSubType": "DataCollectionRuleBased",
"tableType": "Microsoft",
"columns": [
{
"isHidden": false,
"name": "MyNewColumn",
"type": "guid",
"isDefaultDisplay": false
}
],
"standardColumns": [
{
"isHidden": true,
"name": "TenantId",
"type": "guid",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "SourceSystem",
"type": "string",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "TimeGenerated",
"type": "dateTime",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "AgentID",
"type": "string",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "SourceIP",
"type": "string",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "Protocol",
"type": "string",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "SourcePort",
"type": "int",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "DestinationPort",
"type": "int",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "TcpFlags",
"type": "int",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "Packets",
"type": "int",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "Bytes",
"type": "int",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "BytesOut",
"type": "int",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "DurationInMs",
"type": "int",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "RstCount",
"type": "int",
"isDefaultDisplay": false
},
{
"isHidden": false,
"name": "MaxSampleRtt",
"type": "int",
"isDefaultDisplay": false
}
],
"solutions": [
"LogManagement"
]
},
"provisioningState": "Succeeded",
"retentionInDays": 45,
"totalRetentionInDays": 70,
"archiveRetentionInDays": 25,
"retentionInDaysAsDefault": false,
"totalRetentionInDaysAsDefault": false,
"plan": "Analytics"
},
"id": "/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/oiautorest6685/providers/Microsoft.OperationalInsights/workspaces/oiautorest6685/tables/AzureNetworkFlow",
"name": "AzureNetworkFlow"
}
azure-asyncoperation: https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/providers/Microsoft.OperaitonalInsights/locations/eastus/operationstatuses/62e4d893-d233-4005-988e-a428d9f77076?api-version=2022-10-01
Definitions
Name | Description |
---|---|
Column |
Table column. |
Column |
Column data type logical hint. |
Column |
Column data type. |
created |
The type of identity that created the resource. |
Error |
The resource management error additional info. |
Error |
The error detail. |
Error |
Error response |
Provisioning |
Table's current provisioning state. If set to 'updating', indicates a resource lock due to ongoing operation, forbidding any update to the table until the ongoing operation is concluded. |
Restored |
Restore parameters. |
Result |
Search job execution statistics. |
Schema |
Table's schema. |
Search |
Parameters of the search job that initiated this table. |
Source |
Table's creator. |
system |
Metadata pertaining to creation and last modification of the resource. |
Table |
Workspace data table definition. |
Table |
Instruct the system how to handle and charge the logs ingested to this table. |
Table |
The subtype describes what APIs can be used to interact with the table, and what features are available against it. |
Table |
Table's creator. |
Column
Table column.
Name | Type | Description |
---|---|---|
dataTypeHint |
Column data type logical hint. |
|
description |
string |
Column description. |
displayName |
string |
Column display name. |
isDefaultDisplay |
boolean |
Is displayed by default. |
isHidden |
boolean |
Is column hidden. |
name |
string |
Column name. |
type |
Column data type. |
ColumnDataTypeHintEnum
Column data type logical hint.
Name | Type | Description |
---|---|---|
armPath |
string |
An Azure Resource Model (ARM) path: /subscriptions/{...}/resourceGroups/{...}/providers/Microsoft.{...}/{...}/{...}/{...}... |
guid |
string |
A standard 128-bit GUID following the standard shape, xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx |
ip |
string |
A standard V4/V6 ip address following the standard shape, x.x.x.x/y:y:y:y:y:y:y:y |
uri |
string |
A string that matches the pattern of a URI, for example, scheme://username:password@host:1234/this/is/a/path?k1=v1&k2=v2#fragment |
ColumnTypeEnum
Column data type.
Name | Type | Description |
---|---|---|
boolean |
string |
|
dateTime |
string |
|
dynamic |
string |
|
guid |
string |
|
int |
string |
|
long |
string |
|
real |
string |
|
string |
string |
createdByType
The type of identity that created the resource.
Name | Type | Description |
---|---|---|
Application |
string |
|
Key |
string |
|
ManagedIdentity |
string |
|
User |
string |
ErrorAdditionalInfo
The resource management error additional info.
Name | Type | Description |
---|---|---|
info |
object |
The additional info. |
type |
string |
The additional info type. |
ErrorDetail
The error detail.
Name | Type | Description |
---|---|---|
additionalInfo |
The error additional info. |
|
code |
string |
The error code. |
details |
The error details. |
|
message |
string |
The error message. |
target |
string |
The error target. |
ErrorResponse
Error response
Name | Type | Description |
---|---|---|
error |
The error object. |
ProvisioningStateEnum
Table's current provisioning state. If set to 'updating', indicates a resource lock due to ongoing operation, forbidding any update to the table until the ongoing operation is concluded.
Name | Type | Description |
---|---|---|
Deleting |
string |
Table state is deleting. |
InProgress |
string |
Table schema is stable and without changes, table data is being updated. |
Succeeded |
string |
Table state is stable and without changes, table is unlocked and open for new updates. |
Updating |
string |
Table schema is still being built and updated, table is currently locked for any changes till the procedure is done. |
RestoredLogs
Restore parameters.
Name | Type | Description |
---|---|---|
azureAsyncOperationId |
string |
Search results table async operation id. |
endRestoreTime |
string |
The timestamp to end the restore by (UTC). |
sourceTable |
string |
The table to restore data from. |
startRestoreTime |
string |
The timestamp to start the restore from (UTC). |
ResultStatistics
Search job execution statistics.
Name | Type | Description |
---|---|---|
ingestedRecords |
integer |
The number of rows that were returned by the search job. |
progress |
number |
Search job completion percentage. |
scannedGb |
number |
Search job: Amount of scanned data. |
Schema
Table's schema.
Name | Type | Description |
---|---|---|
categories |
string[] |
Table category. |
columns |
Column[] |
A list of table custom columns. |
description |
string |
Table description. |
displayName |
string |
Table display name. |
labels |
string[] |
Table labels. |
name |
string |
Table name. |
solutions |
string[] |
List of solutions the table is affiliated with |
source |
Table's creator. |
|
standardColumns |
Column[] |
A list of table standard columns. |
tableSubType |
The subtype describes what APIs can be used to interact with the table, and what features are available against it. |
|
tableType |
Table's creator. |
SearchResults
Parameters of the search job that initiated this table.
Name | Type | Description |
---|---|---|
azureAsyncOperationId |
string |
Search results table async operation id. |
description |
string |
Search job Description. |
endSearchTime |
string |
The timestamp to end the search by (UTC) |
limit |
integer |
Limit the search job to return up to specified number of rows. |
query |
string |
Search job query. |
sourceTable |
string |
The table used in the search job. |
startSearchTime |
string |
The timestamp to start the search from (UTC) |
SourceEnum
Table's creator.
Name | Type | Description |
---|---|---|
customer |
string |
Tables created by the owner of the Workspace, and only found in this Workspace. |
microsoft |
string |
Tables provisioned by the system, as collected via Diagnostic Settings, the Agents, or any other standard data collection means. |
systemData
Metadata pertaining to creation and last modification of the resource.
Name | Type | Description |
---|---|---|
createdAt |
string |
The timestamp of resource creation (UTC). |
createdBy |
string |
The identity that created the resource. |
createdByType |
The type of identity that created the resource. |
|
lastModifiedAt |
string |
The timestamp of resource last modification (UTC) |
lastModifiedBy |
string |
The identity that last modified the resource. |
lastModifiedByType |
The type of identity that last modified the resource. |
Table
Workspace data table definition.
Name | Type | Description |
---|---|---|
id |
string |
Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName} |
name |
string |
The name of the resource |
properties.archiveRetentionInDays |
integer |
The table data archive retention in days. Calculated as (totalRetentionInDays-retentionInDays) |
properties.lastPlanModifiedDate |
string |
The timestamp that table plan was last modified (UTC). |
properties.plan |
Instruct the system how to handle and charge the logs ingested to this table. |
|
properties.provisioningState |
Table's current provisioning state. If set to 'updating', indicates a resource lock due to ongoing operation, forbidding any update to the table until the ongoing operation is concluded. |
|
properties.restoredLogs |
Parameters of the restore operation that initiated this table. |
|
properties.resultStatistics |
Search job execution statistics. |
|
properties.retentionInDays |
integer |
The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention. |
properties.retentionInDaysAsDefault |
boolean |
True - Value originates from workspace retention in days, False - Customer specific. |
properties.schema |
Table schema. |
|
properties.searchResults |
Parameters of the search job that initiated this table. |
|
properties.totalRetentionInDays |
integer |
The table total retention in days, between 4 and 4383. Setting this property to -1 will default to table retention. |
properties.totalRetentionInDaysAsDefault |
boolean |
True - Value originates from retention in days, False - Customer specific. |
systemData |
Metadata pertaining to creation and last modification of the resource. |
|
type |
string |
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts" |
TablePlanEnum
Instruct the system how to handle and charge the logs ingested to this table.
Name | Type | Description |
---|---|---|
Analytics |
string |
Logs that allow monitoring and analytics. |
Basic |
string |
Logs that are adjusted to support high volume low value verbose logs. |
TableSubTypeEnum
The subtype describes what APIs can be used to interact with the table, and what features are available against it.
Name | Type | Description |
---|---|---|
Any |
string |
The default subtype with which built-in tables are created. |
Classic |
string |
Indicates a table created through the Data Collector API or with the custom logs feature of the MMA agent, or any table against which Custom Fields were created. |
DataCollectionRuleBased |
string |
A table eligible to have data sent into it via any of the means supported by Data Collection Rules: the Data Collection Endpoint API, ingestion-time transformations, or any other mechanism provided by Data Collection Rules |
TableTypeEnum
Table's creator.
Name | Type | Description |
---|---|---|
CustomLog |
string |
Custom log table. |
Microsoft |
string |
Standard data collected by Azure Monitor. |
RestoredLogs |
string |
Restored data. |
SearchResults |
string |
Data collected by a search job. |