Share via

Log Analytics Query Column Does Not Exist Yet

James Ferrari 261 Reputation points Microsoft Employee
2023-10-19T08:33:48.5833333+00:00

Hello,

I am setting up a query on Log Analytics to be used with an Azure Alert.

My problem is that the column is only created once a certain activity happens on the resource, so the query works if the event has already happened, however, if I am creating new resources, the query fails because it cannot find the column.

So this is my query:

AzureDiagnostics  
| where OperationName contains "SecretNearExpiry"  
| extend eventGridEventProperties_data_ObjectName_s


The column eventGridEventProperties_data_ObjectName_s only gets created once an expired secret has occurred, so if this event has not occured, I am presented with:

'extend' operator: Failed to resolve scalar expression named 'eventGridEventProperties_data_ObjectName_s' Request id: 89b5e121-1b11-44b3-95a9-b38bf1125326

How can I make this query ignore the missing column, because I can only deploy my alert at the minute if there is already a expiry secret? I need some sort of if statement to only extend if the column exists.

Azure Synapse Analytics
Azure Synapse Analytics

An Azure analytics service that brings together data integration, enterprise data warehousing, and big data analytics. Previously known as Azure SQL Data Warehouse.


Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.