OperationName is Missing From New Subscription Log Analytics

Fraser Shepherd 20 Reputation points

We are having issues with a new Log Analytics Server setup on a new Subscription in our Azure account whereby it doesn't seem to be recording a "OperationName" value for any log entries that are created.
We have a KQL query we use to extract these logs from the Log Analytics Workspace, which starts as :

| project-keep SubscriptionId, ResourceGroup, TimeGenerated, _ResourceId, OperationName, OperationNameValue, ActivityStatusValue, Caller, CallerIpAddress, CategoryValue
| where CategoryValue in ('Administrative')

In the old Subscription this produces log entries like the following : User's imageHowever when running this KQL in the new Subscription this instead gives entries like : User's image I would guess that a setting has been missed somewhere to record this value, or a filter applied to exclude it, but I'm fairly sure we're using default logging settings on both Subscriptions.
Any idea why this value would not be recorded, where I can check the filtering/setup of the logging?

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,685 questions
0 comments No comments
{count} votes

Accepted answer
  1. Clive Watson 5,066 Reputation points MVP


    Older deployments would have used the legacy ingestion and schema, see here (and read further up the page as well) https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell#data-structure-changes

    Your new deployment uses the updated schema

    source: User's image

    1 person found this answer helpful.
    0 comments No comments

0 additional answers

Sort by: Most helpful