KQL AzureDiagnostics ResultDescription

Riyas 1 Reputation point
2022-11-24T09:47:02.187+00:00

Hello All,

I am trying to find a solution to cut short the resultdescription table from 'AzureDiagnostics' provider results.
Below is the query I use to get details of the automation runbooks which resulted in error

AzureDiagnostics
| where ResourceProvider=="MICROSOFT.AUTOMATION" and Category=="JobStreams" and StreamType_s=="Error"

One of the table is 'ResultDescription' which shows the output of error.

Example error message:
Set-AzStorageFileContents : The term 'Set-AzStorageFileContents' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.At line:39 char:1+ Set-AzStorageFileContents -Context $ctx -Sharename $fileShare.name -S ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (Set-AzStorageFileContents:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException

aaa : The term 'aaa' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.At line:1 char:1+ aaa+ ~~~ + CategoryInfo : ObjectNotFound: (aaa:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException

In case1, first three lines are enough,
In case2, first 2 lines are enough

I have built solution to trigger a runbook whenever azure monitor fires an error alert. However, the resultdescription carries whole ps script and error messages , so the output email is not human friendly.

The reason for going with KQL is to find the results in a compact way rather than Azure Monitor data.

I tried trim, split functions but nothing seem to work. Could you please provide your valuable suggestions or alternative solutions, If any.

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,986 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Clive Watson 5,951 Reputation points MVP
    2022-11-24T22:47:19.927+00:00

    Can you rely on there being 3 sentences and 2 in the results?

    You could build on this?

    AzureDiagnostics
    | where isnotempty(ResultDescription)
    | extend rd_ = split( ResultDescription, '.')
    | project rd_[0], rd_[1], rd_[2]
    | limit 10