Query Execution Statistics
Log Analytics Query Statistics
Query
LAQueryLogs
| summarize UnqiueQueryCount = dcount(QueryText), TotalQueriesExecuted = count() by AADEmail
| sort by AADEmailAbout this query
Query Execution Statistics
Query Information
Description
List the query execution statistics for your Log Analytics Workspace, this returns the UnqiueQueryCount and the TotalQueriesExecuted for each Azure Active Directory User. To audit the query executions the Azure Diagnostics settings for the Log Analytics Workspace need to be set, see references on how this can be implemented.
References
Sentinel
Explanation
This query is designed to provide statistics about the execution of queries in your Log Analytics Workspace. Specifically, it gives you two key pieces of information for each user associated with an Azure Active Directory (AAD) email:
-
UnqiueQueryCount: This is the count of distinct queries executed by the user. It tells you how many different queries the user has run.
-
TotalQueriesExecuted: This is the total number of queries executed by the user, including repeated executions of the same query.
The results are sorted by the user's AAD email address. To gather this data, you need to have Azure Diagnostics settings configured for your Log Analytics Workspace.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators