![log transformation xlstat log transformation xlstat](https://i.pinimg.com/originals/87/1a/d1/871ad1d5b4d239ef99bd0107a04d0151.gif)
The Subscription and Resource group will already be populated for the workspace. If you create transformations for other tables in the same workspace, they will be stored in this same DCR. Since this is the first transformation in the workspace, you need to create a workspace transformation DCR. Locate the LAQueryLogs table and select Create transformation. Now that the table's created, you can create the transformation for it.įrom the Log Analytics workspaces menu in the Azure portal, select Tables (preview). These queries don't need to return data to be added to the audit log. Select Logs and then run some queries to populate LAQueryLogs with some data. Select the Audit category and then click Save to save the diagnostic setting and close the diagnostic setting page. Provide a name for the diagnostic setting and select the workspace so that the auditing data is stored in the same workspace.
![log transformation xlstat log transformation xlstat](https://i.stack.imgur.com/PMFM0.jpg)
It's just to generate the sample data that we'll be working with.įrom the Log Analytics workspaces menu in the Azure portal, select Diagnostic settings and then Add diagnostic setting. This is not required for all ingestion time transformations. You need to enable query auditing for your workspace to create the LAQueryLogs table that you'll be working with. Creates an ingestion-time transformation and adds it to the DCR.Creates a WorkspaceTransforms data collection rule (DCR) and links it to the workspace if a default DCR isn't already linked to the workspace.Updates the table schema with any additional columns from the query.The following actions are performed for you when you complete this wizard: This tutorial will use the Azure portal which provides a wizard to walk you through the process of creating an ingestion-time transformation. You can use this same basic process to create a transformation for any supported table in a Log Analytics workspace. The LAQueryLogs table is created when you enable log query auditing in a workspace. You'll also remove the contents of a column while parsing the column data to store a piece of data in a custom column. In this tutorial, you'll reduce the storage requirement for the LAQueryLogs table by filtering out certain records. The table can't be linked to the workspace transformation DCR.Permissions to create data collection rule (DCR) objects in the workspace.Log Analytics workspace where you have at least contributor rights.To complete this tutorial, you need the following: Write a log query for a workspace transformation.Configure workspace transformation for a table in a Log Analytics workspace.