Log Analytics

Welcome to the "Azure Log Analytics ":https://azure.microsoft.com/en-us/services/log-analytics/ Feedback page. We appreciate your feedback and look forward to hearing from you. Use this site for new ideas and bug reports or to request help.
NOTE – Log Analytics is now a part of Operations Management Suite. Learn more at http://microsoft.com/OMS

How can we improve Azure Log Analytics ?

You've used all your votes and won't be able to post a new idea, but you can still search and comment on existing ideas.

There are two ways to get more votes:

  • When an admin closes an idea you've voted on, you'll get your votes back from that idea.
  • You can remove your votes from an open idea you support.
  • To see ideas you have already voted on, select the "My feedback" filter and select "My open ideas".
(thinking…)

Enter your idea and we'll search to see if someone has already suggested it.

If a similar idea already exists, you can support and comment on it.

If it doesn't exist, you can post your idea so others can support it.

Enter your idea and we'll search to see if someone has already suggested it.

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Ability to have different time duration on tiles on main dashboard

    For the main OMS dashboard, we need the ability for each individual tile to have its own "time duration" for graphs & charts. We have some tiles that need to show the last 24 hours, and some that need to show the last 7 days

    1 vote
    Vote
    Sign in
    Check!
    (thinking…)
    Reset
    or sign in with
    • facebook
    • google
      Password icon
      I agree to the terms of service
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  My Dashboard  ·  Flag idea as inappropriate…  ·  Admin →
    • Office 365 Analytics - populate UserSharedWith parameter

      The O365 pack gets logs of file sharing operations, and the user who shared, but the UserSharedWith is always blank. This is accessible in O365 audit logs

      26 votes
      Vote
      Sign in
      Check!
      (thinking…)
      Reset
      or sign in with
      • facebook
      • google
        Password icon
        I agree to the terms of service
        Signed in as (Sign out)
        You have left! (?) (thinking…)
      • Extend Keyword

        Extend the OMS Extend keyword to permit mapping of a field value such as Windows EventID to a business friendly term. Example:

        Type=SecurityEvent EventID IN {4728,4729} | Extend if(EventID=4728,"ADD","REMOVE")

        1 vote
        Vote
        Sign in
        Check!
        (thinking…)
        Reset
        or sign in with
        • facebook
        • google
          Password icon
          I agree to the terms of service
          Signed in as (Sign out)
          You have left! (?) (thinking…)
        • Custom Fields to more CL

          Please, enable capability to apply a single custom field to more CL. Or, capability to create a Sub-CL

          24 votes
          Vote
          Sign in
          Check!
          (thinking…)
          Reset
          or sign in with
          • facebook
          • google
            Password icon
            I agree to the terms of service
            Signed in as (Sign out)
            You have left! (?) (thinking…)
            0 comments  ·  Flag idea as inappropriate…  ·  Admin →
          • Custom fileds with delimiters

            Need to create custom fields by standard delimiters (i.e. | , ;)

            24 votes
            Vote
            Sign in
            Check!
            (thinking…)
            Reset
            or sign in with
            • facebook
            • google
              Password icon
              I agree to the terms of service
              Signed in as (Sign out)
              You have left! (?) (thinking…)
              0 comments  ·  Flag idea as inappropriate…  ·  Admin →
            • 1 vote
              Vote
              Sign in
              Check!
              (thinking…)
              Reset
              or sign in with
              • facebook
              • google
                Password icon
                I agree to the terms of service
                Signed in as (Sign out)
                You have left! (?) (thinking…)
                0 comments  ·  Flag idea as inappropriate…  ·  Admin →
              • Network Monitoring API or Powershell Cmdlet for adding/removing nodes to be monitored

                Hello,
                Is it possible to use OMS - NPM with some kind of API or Poweshell Cmdlet.

                I have the following example that I need to solve:

                We create VMs and then sometimes they are turned off as they no longer needed for whatever reason. I do not want to still monitor network traffic to this node/VM on Azure.

                Currently we have to use the NPM UI configuration to select the node and click the checkbox for 'Use for monitoring` which is open to human error for when we forgot to disable this and more likely we forget to re-enable…

                6 votes
                Vote
                Sign in
                Check!
                (thinking…)
                Reset
                or sign in with
                • facebook
                • google
                  Password icon
                  I agree to the terms of service
                  Signed in as (Sign out)
                  You have left! (?) (thinking…)
                  0 comments  ·  Network Monitoring  ·  Flag idea as inappropriate…  ·  Admin →
                • operationalinsights

                  Get-AzureRmOperationalInsightsSearchResults change or bug?
                  There seems to have been a (undocumented?) change in the format of the output from the Get-AzureRmOperationalInsightsSearchResults cmdlet in the AzureRM.OperationalInsights PowerShell module between versions 2.3.0 and 3.1.0.
                  Piping the output into ConvertFrom-json now fails.
                  Details attached.

                  4 votes
                  Vote
                  Sign in
                  Check!
                  (thinking…)
                  Reset
                  or sign in with
                  • facebook
                  • google
                    Password icon
                    I agree to the terms of service
                    Signed in as (Sign out)
                    You have left! (?) (thinking…)
                  • Reduce the complexity of the Data Collection API authorization header

                    Log Analytics' Data Collection API has by far the most confusing and complex authorization method that we've seen so far in the Azure world.

                    It seems strange to us that writing to a log with the Data Collector API requires a more complex authorization process than writing to our CosmosDB data stores that are the backbone of our app.

                    After a week we still haven't been able to get a node.js server writing a single log entry. DocumentDB took us less than 30 minutes.

                    3 votes
                    Vote
                    Sign in
                    Check!
                    (thinking…)
                    Reset
                    or sign in with
                    • facebook
                    • google
                      Password icon
                      I agree to the terms of service
                      Signed in as (Sign out)
                      You have left! (?) (thinking…)
                      0 comments  ·  Extensibility / Partner scenarios  ·  Flag idea as inappropriate…  ·  Admin →
                    • Multi tenant support for OMS App

                      Add support to add multiple tenants in the OMS app. So I can get push alerts from my customers.

                      4 votes
                      Vote
                      Sign in
                      Check!
                      (thinking…)
                      Reset
                      or sign in with
                      • facebook
                      • google
                        Password icon
                        I agree to the terms of service
                        Signed in as (Sign out)
                        You have left! (?) (thinking…)
                        0 comments  ·  Mobile App  ·  Flag idea as inappropriate…  ·  Admin →
                      • Allow dynamic thresholds in custom views

                        The thresholds that can be defined for tiles in the custom views need to have the option to specify the time range it applies to.

                        Currently the threshold is a static value, that may make sense when the time range is set to say 6 hours. But if the time range is changed then that threshold may no longer be valid. The option to set the threshold at x per y hours and have it dynamically adjust based on the time range would be useful.

                        3 votes
                        Vote
                        Sign in
                        Check!
                        (thinking…)
                        Reset
                        or sign in with
                        • facebook
                        • google
                          Password icon
                          I agree to the terms of service
                          Signed in as (Sign out)
                          You have left! (?) (thinking…)
                        • driver updates incorrectly reporting

                          I have several windows systems and VMs that are misreporting driver updates required. I have run Windows Update, scanned for updates from driver manufactures tool kits, and I have even gone to device manager and attempted to search for and manual install latest drivers (that I already had installed.) Some of the drivers are old as the component is a few years old (like processors from 2013 with last driver update in 2015).

                          Is there a way to clear the cache, or flag it as ignore so that it does not pop until a new driver actually becomes available (which…

                          1 vote
                          Vote
                          Sign in
                          Check!
                          (thinking…)
                          Reset
                          or sign in with
                          • facebook
                          • google
                            Password icon
                            I agree to the terms of service
                            Signed in as (Sign out)
                            You have left! (?) (thinking…)
                            0 comments  ·  System Update Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →
                          • OMS title bar should be shorter

                            I found myself editing the height for the HTML bar to get more central space.

                            Why do we need all that empty space for just a few icons on top?

                            3 votes
                            Vote
                            Sign in
                            Check!
                            (thinking…)
                            Reset
                            or sign in with
                            • facebook
                            • google
                              Password icon
                              I agree to the terms of service
                              Signed in as (Sign out)
                              You have left! (?) (thinking…)
                              0 comments  ·  Browser Support  ·  Flag idea as inappropriate…  ·  Admin →
                            • Recursive Tracking for Custom Windows Registry Keys

                              Request for the ability to recursively track user-added registry keys

                              4 votes
                              Vote
                              Sign in
                              Check!
                              (thinking…)
                              Reset
                              or sign in with
                              • facebook
                              • google
                                Password icon
                                I agree to the terms of service
                                Signed in as (Sign out)
                                You have left! (?) (thinking…)
                                0 comments  ·  Capacity Management Solution  ·  Flag idea as inappropriate…  ·  Admin →
                              • Unable to configure modules

                                I am unable to configure the 2 modules of Protection & Recovery in OMS. I can install the modules just fine but when I go to configure them it won't allow me to connect to my existing recovery vault. The modules want me to create a new vault - which is unnecessary as one exists.

                                There I no error generated.

                                Thoughts???

                                1 vote
                                Vote
                                Sign in
                                Check!
                                (thinking…)
                                Reset
                                or sign in with
                                • facebook
                                • google
                                  Password icon
                                  I agree to the terms of service
                                  Signed in as (Sign out)
                                  You have left! (?) (thinking…)
                                  0 comments  ·  Flag idea as inappropriate…  ·  Admin →
                                • Need ability to exclude time frame for alerts

                                  We would like the ability to exclude time frames from alert management as there could be system downtimes due to maintenance that are throwing alerts that are false positive. Either allow the ability to exclude date/time ranges or globally disable alerts when doing system maintenance and planned downtime

                                  1 vote
                                  Vote
                                  Sign in
                                  Check!
                                  (thinking…)
                                  Reset
                                  or sign in with
                                  • facebook
                                  • google
                                    Password icon
                                    I agree to the terms of service
                                    Signed in as (Sign out)
                                    You have left! (?) (thinking…)
                                    0 comments  ·  Alert Management Solution  ·  Flag idea as inappropriate…  ·  Admin →
                                  • MaliciousIP 127.0.0.1

                                    I get a lot of alerts saying that 127.0.0.1 is a MaliciousIP, is this a bug?

                                    7 votes
                                    Vote
                                    Sign in
                                    Check!
                                    (thinking…)
                                    Reset
                                    or sign in with
                                    • facebook
                                    • google
                                      Password icon
                                      I agree to the terms of service
                                      Signed in as (Sign out)
                                      You have left! (?) (thinking…)
                                      0 comments  ·  Security and Audit Solution  ·  Flag idea as inappropriate…  ·  Admin →
                                    • Sharepoint Online uptime percentage

                                      We would like to be able to monitor a notify when users are unable to read or write any portion of a SharePoint Online site collection for which they have appropriate permissions.

                                      1 vote
                                      Vote
                                      Sign in
                                      Check!
                                      (thinking…)
                                      Reset
                                      or sign in with
                                      • facebook
                                      • google
                                        Password icon
                                        I agree to the terms of service
                                        Signed in as (Sign out)
                                        You have left! (?) (thinking…)
                                        0 comments  ·  Flag idea as inappropriate…  ·  Admin →
                                      • Get-​Azure​Rm​Operational​Insights​Search​Results Limits to 5000 results how would I get 20000

                                        How do export more than 5000 results, as Get-​Azure​Rm​Operational​Insights​Search​Results limits to 5000. We are looking to export 20000.

                                        5 votes
                                        Vote
                                        Sign in
                                        Check!
                                        (thinking…)
                                        Reset
                                        or sign in with
                                        • facebook
                                        • google
                                          Password icon
                                          I agree to the terms of service
                                          Signed in as (Sign out)
                                          You have left! (?) (thinking…)
                                          1 comment  ·  Extensibility  ·  Flag idea as inappropriate…  ·  Admin →
                                        • schedule patching

                                          Dynamically re-evaluate computer group membership of existing update schedules.
                                          Currently, when creating a recurring update schedule, the computer group query is only evaluated once.
                                          It should be re-evaluated at least after each run, or ideally once a day.

                                          3 votes
                                          Vote
                                          Sign in
                                          Check!
                                          (thinking…)
                                          Reset
                                          or sign in with
                                          • facebook
                                          • google
                                            Password icon
                                            I agree to the terms of service
                                            Signed in as (Sign out)
                                            You have left! (?) (thinking…)
                                            0 comments  ·  System Update Assessment Solution  ·  Flag idea as inappropriate…  ·  Admin →
                                          ← Previous 1 3 4 5 35 36
                                          • Don't see your idea?

                                          Feedback and Knowledge Base