Querying log‐analytics with LokqlDx

Lokqldx can issue KQL queries to Azure Log Analytics resources and render the results locally using the .loganalytics command

.set tenantid 1eb4...

.loganalytics $tenantid:$workspace
SigninLogs
| where ResultType != 0
| summarize FailedAttempts = count() by UserPrincipalName
| render columnchart

command format

.loganalytics requires a workspace id and can accept an optional tenant id

Rendering

Although the LogAnalytics API does not accept the render operator, LokqlDx will process the render clause, remove it from the query before submission, and then use the visualization state to render locally.