Data Collection Rule Transformation Not Filtering Events in Log Analytics

Question

Why is my Data Collection Rule (DCR) transformation having no effect on filtering events in my Log Analytics workspace?

PS - Based on common issues that we have seen from customers and other sources, we are posting these questions to help the Azure community.

Answer 1

The problem arises because the transformKql parameter is missing from our Data Collection Rule (DCR). This parameter is crucial for filtering events as intended. To fix this, you need to add the transformKql parameter under the dataFlows section in your DCR.

Follow these steps to update your DCR using PowerShell:

1. Review your DCR to confirm the absence of the transformKql parameter under dataFlows.
2. If it is not present, create the transformKql parameter under the dataFlows section.
3. Use the following documentation for detailed instructions on editing DCRs and applying a DCR template: Editing Data Collection Rules

After updating your DCR with the transformKql parameter, the transformation should work as expected, and the events will be filtered accordingly in Log Analytics workspace.

Please do not forget to "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.