I all you need to do is remove the command break " ;" off the end of the query.
Kind regards
Alistair
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hello,
I am getting this error when I am using this query in log analytics.
This is my query. The query runs fine when I use in log analytics. But when I create the rule, I get this error.
> let _serviceName = "my-service";
let _namespace = "prod";
let containerList = KubePodInventory
| where ServiceName == tolower(_serviceName)
| summarize max(TimeGenerated) by ContainerID
| summarize ContainerID=make_list(ContainerID, 200000);
ContainerLog
| where ContainerID in (containerList)
| where LogEntry contains "processing"
| where TimeGenerated > ago(2h)
| order by TimeGenerated desc
| project TimeGenerated, LogEntry;
I want to send an alert to email/teams channel when there are no logs in the past two hours.
I all you need to do is remove the command break " ;" off the end of the query.
Kind regards
Alistair