Unable to run query in log analytics workspace

Question

Unable to run query in log analytics workspace

Ananya Sarkar 311

Hi,

I was trying to run some queries to fetch some logs in my log analytics workspace. I am simply trying with queries like "perf" or a query to get the heartbeat of a VM, and its showing the below errors respectively:

'' operator: Failed to resolve table or column or scalar expression named 'perf'
If issue persists, please open a support ticket. Request id: 10e17745-157d-4117-a2b1-5458b9011242

'where' operator: Failed to resolve column or scalar expression named 'computer'
If issue persists, please open a support ticket. Request id: 03d26615-3fa1-4e09-b049-33d16136a0ca

Plz let me know how to resolve this issue.

Answer 1

tbgangav-MSFT 8,066

Hi @Ananya Sarkar ,

Table or data type names are currently case sensitive so you would have to give it as 'Perf' and 'Heartbeat' but not as 'perf' and 'heartbeat'.

One other way to validate before you run the query is, if the table name doesn't get resolved then it shows with red underline.

Below are the screenshots which illustrate the same:

Below are the screenshots which illustrate the right way to query:

Let me know if this doesn't resolve your issue.

Ananya Sarkar 311 Reputation points

2020-11-25T17:48:43.5+00:00

Thanks so much tbgangav-MSFT, when I am using "Perf" or "Heartbeat", it is not showing the error now.

Well, I am trying to create some use cases for generating logs. Can you plz provide some specific queries which I can use to setup accordingly for my VM or Firewall and filter down the results? Any documentation of the use cases along with testing setup will be really helpful.
tbgangav-MSFT 8,066 Reputation points

2020-11-26T03:31:04.97+00:00

Hi @Ananya Sarkar ,

Glad to know that it worked!

Sure! This public repo serves the Azure Monitor community. It contains log queries, workbooks, and alerts, shared to help Azure Monitor users make the most of it.

Here you can select an Azure service so that you can check kusto queries related to that Azure service.

For example, if you want to check kusto queries related to VM and Firewall then check this and this pages respectively.
Ananya Sarkar 311 Reputation points

2020-11-26T14:34:34.873+00:00

Thank you so much @tbgangav-MSFT , This is really helpful, will refer this as of now.
However will get back, if i have any further queries.

I have connected my VM as a data source for my log analytics workspace. I have shut down my VM but when I am trying to query this AzureActivity inside the log analytics workspace, it is not showing any result. However with same query it is returning result when the scope is Azure monitor -> log.
Plz let me know what is wrong here, any additional setup is required?

The query i used was :
// Shut down Virtual Machines
AzureActivity
| where OperationName == "Deallocate Virtual Machine" and ActivityStatus == "Succeeded"

Answer 2

tbgangav-MSFT 8,066

Hi @Ananya Sarkar ,

Glad to know that it was helpful!!

It returns results from Logs tile of Azure Monitor because Azure Monitor gets Azure Activity logs by default. For more information, please refer this Azure document.

To view AzureActivity table logs from your Log Analytics Workspace (aka LAW), you would have to enable collection of Azure Activity Logs by your LAW as shown in below screenshot.

Below screenshot illustrates how it looks when we query from Azure Monitor:

Below screenshot illustrates how it looks when we query from LAW before we have enabled collection of Azure Activity Logs:

Below screenshot illustrates how it looks when we query from LAW after we have enabled collection of Azure Activity Logs:

Ananya Sarkar 311 Reputation points

2020-11-27T14:18:17.457+00:00

Thank you so much @tbgangav-MSFT , it is working now with this setup.
tbgangav-MSFT 8,066 Reputation points

2020-11-27T16:13:58.833+00:00

Hi @Ananya Sarkar ,

Glad to know that now it is working for you! :)

Unable to run query in log analytics workspace

2 answers

Activity