How to schedule exports from Azure Resource Graph and LogAnalytics to a Storage account?-CodePudding

I've created a KQL query for a LogAnalytics Workspace and one for the Azure Resource Graph and now try to get the results scheduled to Synapse Analytics or Azure DataLake Storage Gen2. But from Synapse side I can only create a connection to Data Explorer cluster but not to an Log Analytics or Azure Resource Graph.

Has anybody an idea how to automatically extract the result?

BR Gerrit

CodePudding user response：

You could do a Logic App that has a Recurrence trigger. To pull the Azure Resource Graph data, you can do a POST API call using the HTTP action (I don't think there is a built-in Action for Resource Graph).

POST https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2020-04-01-preview

{
  "subscriptions": [
    "cfbbd179-59d2-4052-aa06-9270a38aa9d6"
  ],
  "query": "Resources | where type =~ 'Microsoft.Compute/virtualMachines' | summarize count() by tostring(properties.storageProfile.osDisk.osType)"
}

For the Log Analytic Query, you can use the built-in Log Analytics action to run your query.

CodePudding user response：

So what you could do is log analytics -> Azure data lake gen2 -> Azure synapse.

If you query Azure synapse for query you can use serverless sql pool to query the data stored in azure data lake gen 2.

If you want to use log analytics API there are limitations to the frequency and amount of data you can pull from the Log Analytics API. As noted in the API documentation:

Queries cannot return more than 500,000 rows Queries cannot return more than 64,000,000 bytes (~61 MiB total data) Queries cannot run longer than 10 minutes (3 minutes by default)