Need help troubleshooting externaldata operator search

Christian Lozach 1

Below is the search. * included for obfuscation. I uploaded a file to Azure Storage and got the shared access signature.

externaldata(rulelabel: string) [h@"https://companyname.file.core.windows.net/?sv=*************"] with (format='txt', ignoreFirstRecord=true)
| summarize count() by rulelabel

But whenever I run this I get no results and the insatiably frustrating log analytics response of:

Some aspects of the query had errors so the results are not complete
If issue persists, please open a support ticket. Request id:*************

Where do I move from this? How do I begin to troubleshoot?

Any help is appreciated, thanks!

JamesTran-MSFT 36,366 Reputation points Microsoft Employee

2020-12-02T20:31:37.797+00:00
@Christian Lozach
Thank you for your post! Are you able to answer some of the questions below so I can gain a better understanding of your issue.

Can you provide the documentation that you're following?

Are you using the SAS token to run the query/search? If so, where are you running query?

Can you provide any screenshots of this issue so I can get a better picture of what you're trying to troubleshoot?

Any additional information would be greatly appreciated.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
Christian Lozach 1 Reputation point

2020-12-02T20:41:20.157+00:00

Hi James,

Thanks for your detailed response. I have case 120120224004420 open for any information not wanting to publish on Q&A.

I am following the documentation of the externaldata operator https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/externaldata-operator?pivots=azuremonitor

I am using a SAS token and running the query on the log analytics plugin of Azure Sentinel.

I do not have any additional screenshots unfortunately, due to the error being very vague. I don't believe it to be a syntax issue as I'm sure the interpreter would be able to pass a better error if that were the case.
JamesTran-MSFT 36,366 Reputation points Microsoft Employee

2020-12-03T21:47:38.967+00:00

@Christian Lozach
Thank you for the follow up!

Since you created a support request for this issue, I'd recommend continuing to work with Luis, the Support Engineer assigned to your support request. It also looks like Luis provided some troubleshooting steps in his most recent email.

I've retagged your issue with "azure-monitor" and have reached out to our Log Analytics team to follow this issue and provide any additional insights as needed.

Thank you for your time and patience throughout this issue.