Log Analytics is a fantastic tool in the Azure Portal that provides the ability to query Azure Monitor events. It provides the ability to quickly create queries using KQL (Kusto Query Language). Once you’ve created the query however you may want to run that query through automation negating the need to use the Azure Portal every time you want to get the associated report data.
In this post I detail;
- creating a Log Analytic Workspace
- enabling API Access
- querying Log Analytics using the REST API with PowerShell
- outputting data to CSV
Create a Workspace
We want to create a Workspace for our logs and queries.… [Keep reading] “Azure AD Log Analytics KQL queries via API with PowerShell”