NRT New access credential added to Application or Service Principal

Question

NRT queries cannot use joins or unions, or query more than one table.

Answer 1

That is correct, please see here for more: https://learn.microsoft.com/en-us/azure/sentinel/near-real-time-rules#considerations

Do you have a question about this?

Answer 2

@M Nurohmat

Thank you for your post!

Error Message:
NRT queries cannot use joins or unions, or query more than one table

I understand that you're trying to leverage the near-real-time (NRT) analytics rules but when creating the rule you're running into the above error. To hopefully point you in the right direction or resolve your issue I'll share my findings below.

---

Findings:

Because Near-real-time (NRT) rules are currently in PREVIEW, please keep in mind that there are still limitations currently governing the use of NRT rules.

Because you can create NRT rules the same way you create regular scheduled-query analytics rules - When it comes to your template deployment, you should be able to identify if it's an NRT rule or a scheduled query rule through the Query scheduling and alert threshold. For more info.

• Unlike regular scheduled rules that run on a built-in five-minute delay to account for ingestion time lag, NRT rules run on just a two-minute delay.

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.