KQL Search

Query Details

HomeAI ToolsDevice Query

Log Analytics Query Statistics

Query

# Query Execution Statistics

## Query Information

#### Description
List the query execution statistics for your Log Analytics Workspace, this returns the *UnqiueQueryCount* and the *TotalQueriesExecuted* for each Azure Active Directory User. 
To audit the query executions the Azure Diagnostics settings for the Log Analytics Workspace need to be set, see references on how this can be implemented.

#### References
- https://learn.microsoft.com/en-us/azure/azure-monitor/logs/query-audit

## Sentinel
```KQL
LAQueryLogs
| summarize UnqiueQueryCount = dcount(QueryText), TotalQueriesExecuted = count() by AADEmail
| sort by AADEmail
```

Explanation

This query shows the number of unique queries and total queries executed by each Azure Active Directory User in your Log Analytics Workspace. To use this query, make sure Azure Diagnostics settings are enabled.

Details

Bert-Jan Pals profile picture

Bert-Jan Pals

Released: March 29, 2024

Tables

LAQueryLogs

Keywords

LaQueryLogs,UnqiueQueryCount,TotalQueriesExecuted,AADEmail

Operators

summarizedcountcountbysort

Actions