KQL AzureDiagnostics ResultDescription

Question

Hello All,

I am trying to find a solution to cut short the resultdescription table from 'AzureDiagnostics' provider results.
Below is the query I use to get details of the automation runbooks which resulted in error

AzureDiagnostics
| where ResourceProvider=="MICROSOFT.AUTOMATION" and Category=="JobStreams" and StreamType_s=="Error"

One of the table is 'ResultDescription' which shows the output of error.

Example error message:
Set-AzStorageFileContents : The term 'Set-AzStorageFileContents' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.At line:39 char:1+ Set-AzStorageFileContents -Context $ctx -Sharename $fileShare.name -S ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (Set-AzStorageFileContents:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException

aaa : The term 'aaa' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.At line:1 char:1+ aaa+ ~~~ + CategoryInfo : ObjectNotFound: (aaa:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException

In case1, first three lines are enough,
In case2, first 2 lines are enough

I have built solution to trigger a runbook whenever azure monitor fires an error alert. However, the resultdescription carries whole ps script and error messages , so the output email is not human friendly.

The reason for going with KQL is to find the results in a compact way rather than Azure Monitor data.

I tried trim, split functions but nothing seem to work. Could you please provide your valuable suggestions or alternative solutions, If any.

Answer 1

Can you rely on there being 3 sentences and 2 in the results?

You could build on this?

AzureDiagnostics
| where isnotempty(ResultDescription)
| extend rd_ = split( ResultDescription, '.')
| project rd_[0], rd_[1], rd_[2]
| limit 10