Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
1,930 questions
Need help troubleshooting externaldata operator search
Christian Lozach
1
Reputation point
Below is the search. * included for obfuscation. I uploaded a file to Azure Storage and got the shared access signature.
externaldata(rulelabel: string) [h@"https://companyname.file.core.windows.net/?sv=*************"] with (format='txt', ignoreFirstRecord=true)
| summarize count() by rulelabel
But whenever I run this I get no results and the insatiably frustrating log analytics response of:
Some aspects of the query had errors so the results are not complete
If issue persists, please open a support ticket. Request id:*************
Where do I move from this? How do I begin to troubleshoot?
Any help is appreciated, thanks!
{count} votes
-
JamesTran-MSFT 27,511 Reputation points Microsoft Employee2020-12-02T20:31:37.797+00:00 @Christian Lozach
Thank you for your post! Are you able to answer some of the questions below so I can gain a better understanding of your issue.- Can you provide the documentation that you're following?
- Are you using the SAS token to run the query/search? If so, where are you running query?
- Can you provide any screenshots of this issue so I can get a better picture of what you're trying to troubleshoot?
Any additional information would be greatly appreciated.
If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
Sign in to comment
Hi James,
Thanks for your detailed response. I have case 120120224004420 open for any information not wanting to publish on Q&A.
I am following the documentation of the externaldata operator https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/externaldata-operator?pivots=azuremonitor
I am using a SAS token and running the query on the log analytics plugin of Azure Sentinel.
I do not have any additional screenshots unfortunately, due to the error being very vague. I don't believe it to be a syntax issue as I'm sure the interpreter would be able to pass a better error if that were the case.
@Christian Lozach
Thank you for the follow up!
Since you created a support request for this issue, I'd recommend continuing to work with Luis, the Support Engineer assigned to your support request. It also looks like Luis provided some troubleshooting steps in his most recent email.
I've retagged your issue with "azure-monitor" and have reached out to our Log Analytics team to follow this issue and provide any additional insights as needed.
Thank you for your time and patience throughout this issue.