LogAnalytics Query (LogsQueryClient in python) returns 0 rows (and all column names)

Asimananda Mohanty 1 Reputation point
2022-11-07T07:21:21.607+00:00

Here's a simple Kusto Query Language query (replaced the table name).

let endDateTime = now(); let startDateTime = ago(1d); AnyTableName | where TimeGenerated < endDateTime | where TimeGenerated >= startDateTime  

When executed in the explorer, it returns proper results. But when used in the following manner, returns 0 rows.

credential  = DefaultAzureCredential()  
  
client = LogsQueryClient(credential)  
  
query="""let endDateTime = now();  
let startDateTime = ago(1d);  
AnyTableName  
| where TimeGenerated < endDateTime   
| where TimeGenerated >= startDateTime"""  
  
print (query)  
  
os.environ['LOGS_WS_ID'] = 'XXXX'  
  
start_time=datetime(2022, 11, 4, tzinfo=timezone.utc)  
end_time=datetime(2022, 11, 5, tzinfo=timezone.utc)  
  
try:  
    response = client.query_workspace(os.environ['LOGS_WS_ID'], query, timespan=(start_time, end_time))      
    if response.status == LogsQueryStatus.PARTIAL:  
        error = response.partial_error  
        print(error.message)  
    elif response.status == LogsQueryStatus.SUCCESS:  
        print("SUCCESSSSS")  
        data = response.tables  
    for table in data:  
        df = pd.DataFrame(data=table.rows, columns=table.columns)  
        print(df)  
except HttpResponseError as err:  
    print("Well !!! This is no good")  
    print (err)  

Result >>

[0 rows x 29 columns]  

I was expecting the same result as I see in the Logs Analytics explorer, but the script returns 0 rows.

I got similar results (0 rows) when tried with " az monitor log-analytics query" I wonder if the query has to be passed in a different manner

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,038 questions
{count} votes