Sentinel Analytic Rule Query Cannot Resolved Table

Yang, Steven 151 Reputation points
2024-01-30T01:50:27.63+00:00

Hi-

This was a working analytic rule for couple days now, but today when I tried to edit the rule, I encountered the "Failed to resolve table expression name" error. The table exists and workspace has no problem resolving it, but analytic rule query cannot. see attached images.

----------------------------------------------------------------------------------------------------------Analytic Rule Query Cannot resolve the table

----------------------------------------------------------------------------------------------------------Log Analytic can resolve the table

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
977 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Clive Watson 5,711 Reputation points MVP
    2024-01-30T17:31:10.54+00:00

    Hello, have you tried s copy & paste of the working Table name (its does look good from the screen shots), in case there is a hidden control character?
    Also try a query with that table, something like this to rule out a recent ingestion issue:

    | where TimeGenerated > ago(2d)