Unable to run query in log analytics workspace

Ananya Sarkar 311 Reputation points
2020-11-25T11:06:47.793+00:00

Hi,

I was trying to run some queries to fetch some logs in my log analytics workspace. I am simply trying with queries like "perf" or a query to get the heartbeat of a VM, and its showing the below errors respectively:

'' operator: Failed to resolve table or column or scalar expression named 'perf'
If issue persists, please open a support ticket. Request id: 10e17745-157d-4117-a2b1-5458b9011242

'where' operator: Failed to resolve column or scalar expression named 'computer'
If issue persists, please open a support ticket. Request id: 03d26615-3fa1-4e09-b049-33d16136a0ca

Plz let me know how to resolve this issue.

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,826 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. tbgangav-MSFT 10,386 Reputation points
    2020-11-25T16:06:22.253+00:00

    Hi @Ananya Sarkar ,

    Table or data type names are currently case sensitive so you would have to give it as 'Perf' and 'Heartbeat' but not as 'perf' and 'heartbeat'.

    One other way to validate before you run the query is, if the table name doesn't get resolved then it shows with red underline.

    Below are the screenshots which illustrate the same:

    42659-image.png

    42549-image.png

    Below are the screenshots which illustrate the right way to query:

    42660-image.png

    42747-image.png

    Let me know if this doesn't resolve your issue.

  2. tbgangav-MSFT 10,386 Reputation points
    2020-11-26T20:12:28.973+00:00

    Hi @Ananya Sarkar ,

    Glad to know that it was helpful!!

    It returns results from Logs tile of Azure Monitor because Azure Monitor gets Azure Activity logs by default. For more information, please refer this Azure document.

    To view AzureActivity table logs from your Log Analytics Workspace (aka LAW), you would have to enable collection of Azure Activity Logs by your LAW as shown in below screenshot.

    43059-image.png

    Below screenshot illustrates how it looks when we query from Azure Monitor:

    43038-image.png

    Below screenshot illustrates how it looks when we query from LAW before we have enabled collection of Azure Activity Logs:

    43104-image.png

    Below screenshot illustrates how it looks when we query from LAW after we have enabled collection of Azure Activity Logs:

    43162-image.png