Why I'm missing events on my Log Analytics Query?

Vinny Paluch 31

![On query below , I can only see data from hours 3 up 8.. all data for other timeframes are missing. The data is being generated by Azure SQL log analytics configuration where I can't see anything missing. Any ideas? Thanks a lot!

Vinny Paluch 31 Reputation points

2021-01-19T18:08:12.683+00:00

This is the query..
Martin Cairney 2,256 Reputation points

2021-01-19T22:03:42.277+00:00

Have you also checked in the Storage Account to see if the data is being extracted or if this is ONLY a Log Analytics issue?
Vinny Paluch 31 Reputation points

2021-01-20T12:51:36.907+00:00

Hi Martin,

Looking at Azure storage I found I have data for only as few hours as well.
I spoke to the DBA, he said the databases are downscaled after 6PM to a P1 DTU and then scaledUP to P4s after 4AM.
According to him, there's should be no activity during those off hours period..
I don't think that explains why we have no data.. we should have Zeroes.. but not missing data.
Also, don't explain why I have data for 03AM to 08AM Kusto but on Azure Storage I have 04AM up to 08PM.. doesn't make sense to me.
Thanks
HarithaMaddi-MSFT 10,136 Reputation points

2021-01-21T05:46:36.46+00:00

Hi @Vinny Paluch ,

Welcome to Microsoft Q&A Platform. Thanks for posting the query.

Can you please share log analytics workspace id as that would help our team to access logs for further investigation. If it is confidential to share in forum, please send the information to AzCommunity[at]microsoft[dot]com with subject: "Attn:Haritha - missing events on my Log Analytics Query" and we can assist you further.

Looking forward for your response!
HarithaMaddi-MSFT 10,136 Reputation points

2021-01-25T09:16:37.457+00:00

Hi @Vinny Paluch ,

I am waiting to hear update from product team. I will get back to you as soon as I hear from them.
HarithaMaddi-MSFT 10,136 Reputation points

2021-01-28T05:40:27.837+00:00

Hi @Vinny Paluch ,

I am still waiting for the update from product team. Meanwhile, if you found a solution, please share it with the community as it is beneficial for all of us.

Appreciate your patience!
HarithaMaddi-MSFT 10,136 Reputation points

2021-02-01T08:07:40.21+00:00

Hi @Vinny Paluch ,

As this issue requires deeper investigation, it is recommended to open a support ticket if you have an active support plan else let us know and we will assist you in raising a one-time free request.

Looking forward for your response!
Vinny Paluch 31 Reputation points

2021-02-01T16:35:46.253+00:00

Ok.. will do it. Thanks

1 answer

Vinny Paluch 31 Reputation points

2021-02-03T16:14:37.52+00:00

According to Microsoft Support, data is being truncated as we reach the daily cap limit for the free tier.
They suggest we move to a “Pay as you go” tier, to be able to collect data and report on it.

The following Kusto query is able to show if data collection is being truncated.

Operation
| where TimeGenerated > ago(1d)
| where OperationCategory == "Data Collection Status" and OperationStatus == "Warning"
| project Detail, TimeGenerated
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Why I'm missing events on my Log Analytics Query?

1 answer

Your answer