Sentinel Analytic Rule Query Cannot Resolved Table

Yang, Steven 151 Reputation points


This was a working analytic rule for couple days now, but today when I tried to edit the rule, I encountered the "Failed to resolve table expression name" error. The table exists and workspace has no problem resolving it, but analytic rule query cannot. see attached images.

----------------------------------------------------------------------------------------------------------Analytic Rule Query Cannot resolve the table

----------------------------------------------------------------------------------------------------------Log Analytic can resolve the table

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
928 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Clive Watson 5,066 Reputation points MVP

    Hello, have you tried s copy & paste of the working Table name (its does look good from the screen shots), in case there is a hidden control character?
    Also try a query with that table, something like this to rule out a recent ingestion issue:

    | where TimeGenerated > ago(2d)