OMS和Azure Log Analytics中的查找表

Question

In Azure Log Analytics, is there anything akin to Splunk's lookup tables?( https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Lookup )

Basically, a way to map values to other values ie:

> value1 => value11 
> value2 => value22

Answer 1

Realizing this is now 4 months old, but I ran into similar issues and can maybe help someone going forward. You have to define a datatable and then join that to function as a lookup table. Sample from documentation:

    let DimTable = datatable(EventID:int, eventName:string)
  [
    4658, "The handle to an object was closed",
    4656, "A handle to an object was requested",
    4690, "An attempt was made to duplicate a handle to an object",
    4663, "An attempt was made to access an object",
    5061, "Cryptographic operation",
    5058, "Key file operation"
  ];
SecurityEvent
| join kind = inner
 DimTable on EventID
| summarize count() by eventName

Which then presents like this output

Check out the lookup tables section of this documentation: https://docs.loganalytics.io/docs/Learn/Tutorials/Joins---cross-analysis . I ended up doing most of this before I found this reference :/.

You can also make the datatable and then save that search and join the saved search instead of needing to define the table in every query.