OperationName is Missing From New Subscription Log Analytics

Question

We are having issues with a new Log Analytics Server setup on a new Subscription in our Azure account whereby it doesn't seem to be recording a "OperationName" value for any log entries that are created.
We have a KQL query we use to extract these logs from the Log Analytics Workspace, which starts as :

AzureActivity
| project-keep SubscriptionId, ResourceGroup, TimeGenerated, _ResourceId, OperationName, OperationNameValue, ActivityStatusValue, Caller, CallerIpAddress, CategoryValue
| where CategoryValue in ('Administrative')

In the old Subscription this produces log entries like the following : However when running this KQL in the new Subscription this instead gives entries like : I would guess that a setting has been missed somewhere to record this value, or a filter applied to exclude it, but I'm fairly sure we're using default logging settings on both Subscriptions.
Any idea why this value would not be recorded, where I can check the filtering/setup of the logging?

Answer 1

Hello,

Older deployments would have used the legacy ingestion and schema, see here (and read further up the page as well) https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell#data-structure-changes

Your new deployment uses the updated schema

source: