Benna Su, Thank you for posting this question on Microsoft Q&A.
I reviewed the settings as shared in the question and it seems correct. Here are some additional things that you may consider for troubleshooting it
- Ensure that you have enabled the Activity Log forwarding to Log Analytics workspace - Send to Log Analytics workspace
- Run the query in the Log Analytics Log and check if you are getting the desired result.
- If you get the desired results from the logs, use the "View result and edit query in the Logs" as shown below to ensure that the log based alert rule is being created for the correct LA workspace where the activity log is getting forwarded to:
- Finally, check the "Alerts" view to ensure that the alert is not getting filtered out based on the criteras set (alert was filed but got hidden due to filter)
Hope this helps.
If the answer did not help, please add more context/follow-up question for it, and we will help you out. Else, if the answer helped, please click Accept answer so that it can help others in the community looking for help on similar topics.