Hi, assuming this does work when you manually run it, have you:
- Tried it in the Results simulation, did that work?
- Added in a specific time check in the KQL? e.g.
| where TimeGenerated >= ago(1d)
- Check the Query Scheduling settings, are they set too short to see the data? Go back to step 2, if 1d works, make sure these settings are at 1day rather than n minutes.