DCR Transformation Not Affecting Data Ingested via Azure Monitor Agent

Question

Why is my DCR transformation at the table level in Log Analytics workspace not affecting the data ingested via the Azure Monitor Agent into the Common Security Log table?

PS - Based on common issues that we have seen from customers and other sources, we are posting these questions to help the Azure community.

Answer 1

When you apply a Data Collection Rule (DCR) transformation at the table level within your Log Analytics workspace, this method does not impact logs collected via the Azure Monitor Agent (AMA). This table-level transformation method supports logs collected through other methods such as Diagnostic Settings or the legacy Microsoft Monitoring Agent (MMA) or OMS agent. To correctly apply transformations to data being ingested via the Azure Monitor Agent, you need to modify the DCR at the DCR level.

Here are the steps to resolve this issue: 1. Go to the Data Collection Rule (DCR) that is configured to ingest the security logs. 2. Modify the DCR to apply the required transformation directly within the DCR.

Here is a video tutorial to guide through this process: YouTube Video Tutorial.

For further details, refer to the following resources: - Azure Monitor Logs Ingestion Time Transformations

Please do not forget to "Accept the answer" and "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.