Querying Log Analytics So That It Returns a List of All Table Names

Question

I am using Python to call queries against my Azure Log Analytics Workspace. In order to provide maximum scalability, I would like to implement a query which returns all table names within my Log Analytics workspace. Essentially, I would like to generate a list of all the table names, so I can make calls to them later in my python script.

I have tried a few different queries. For example:

Search * | distinct $table

Instead of getting a list of tables, such as:

[
  {
    "$table": "ExampleTable"
  }
]

I get an error message:

{'error': 
    {
           'message': 'The request had some invalid properties', 'code': 'BadArgumentError', 'innererror': 
           {
               'code': 'SyntaxError', 'message': 'Syntax Error'
           }
    }
}

Any suggestions/examples would be greatly appreciated. Thank you!

UPDATE:

After once again visiting the Azure Log Analytics REST API website, I decided to spend some time messing around with the built-in API explorer tool. It was there that I was able to successfully query the example workspace for a list of tables. I was able to do this using a couple different queries:

search * | distinct $table
search * | distinct Type

While both of these queries worked perfectly within the example environment, they both still continue to fail me within my own environments. Both my python app, as well as my Azure LogicApp continue to receive syntax errors whenever I send the same query which returns perfect results in the API explorer. I continue to be boggled by this issue. Here is the site for the API Explorer for those who would like to test this: https://dev.loganalytics.io/apiexplorer/query?appId=DEMO_WORKSPACE&apiKey=DEMO_KEY

Also, to answer the obvious question: yes, I have the rest of the API connection set up correctly. I can and do make other queries successfully, both in the Python application and in the LogicApp workflow. It just seems to be this particular one that is giving me issues.

Lastly, in case it helps, this is the error message I continue to receive whenever I make the query:

{'error': {'message': 'The request had some invalid properties', 'code': 'BadArgumentError', 'innererror': {'code': 'SyntaxError', 'message': 'Syntax Error'}}}

Yoni L. Yoni L. · Accepted Answer · 2019-03-25T19:53:19

With regards to the Kusto-query-language part of the question, Search should be search (lowercase s)

Querying Log Analytics So That It Returns a List of All Table Names

4 Answers