Log Analytics workspaces Alert Query error

Question

Good Day,

I've created an alert rule for logging sign-ins from abroad.

While creating or editing the Alert rule the Query worked without a problem.

The error occurs when the Alert fires. The Query throws this error.

// Search query has been redacted as linked storage account is configured on Log Analytics workspace '/subscriptions/[subscriptionId]/resourceGroups/Cloud_Security/providers/Microsoft.OperationalInsights/workspaces/Azure-Diagnostic-Logs'.

Does somebody know why the Query gives back that result instead of the Query mentioned above and how I can fix it?

Answer 1

Hi @Nick Borg
Welcome to the Microsoft Q&A Platform! Thank you for asking your question here. 

First make sure the alert has the appropriate permissions to access the Log Analytics workspace and any associated storage accounts. You can check this under Access Control (IAM)   in the Azure portal. 

Next, check the query to make sure it is flexible enough to handle situations where data may not be available at the expected time. You can use timing operations like bin() to simplify the query. 

If the query accesses sensitive data (such as user IP), it can be blocked. You’ll want to make sure the alert has access to that data as well. 

Double-check the alert system to make sure it points to the correct data source and uses the correct settings. If you create the query manually in the Log Analytics query editor and it doesn’t work, try changing the filters or time range until it does. 
If you have any further queries, do let us know  

---

If the answer is helpful, please click "Accept Answer" and "Upvote it"