CDN Egress in Log Analytics Canned Query Error

Question

CDN Profile/Endpoint is set to put telemetry into Log Analytics (in US-East). Visited CDN content to get some content access logged. Tried to run the "Requests per hour" canned query from the Azure Portal Log Analytics Workspace blade.

Got this error:

> 'where' operator: Failed to resolve column or scalar expression named 'isReceivedFromClient_b'
> If issue persists, please open a support ticket. Request id: nnnnnn-nnnn-nnnnnnnn

Thanks.

Answer 1

Hello,

I just tested the scenario you described in my lab and once everything is in place, I can run with success the Example (CND Profile) Query - Requests per hour, from the Log Analytics Workspace (East-US located) that is configured as a destination for the Diagnostic Logs on my CDN Profile.

Executing the same query on a Log Analytics Workspace where the required CDN Diagnostic Logs are not present, will indeed return the error you presented above.
And the failure is due to the fact that the isReceivedFromClient_b property, is present in AzureDiagnostics table only for logs with Category = AzureCdnAccessLog

So, I would suggest that you double check the configuration of the Diagnostic Logs from your CDN Profile (screen capture from my test, below), as that's what will send the AzureCdnAccessLog logs to the Log Analytics Workspace, then (after performing some activities and waiting ~5 min for the ingestion to happen) execute the query below on the specified Log Analytics Workspace to confirm that you get the AzureDiagnostics logs required by the Requests per hour query.:

AzureDiagnostics | where Category == "AzureCdnAccessLog"

BR,
George

Answer 2

Hi,
With CDN logs you have to keep in mind that the behavior of when logs are send to Log Analytics is different depending on the type. I have blogged about this here. For Akamai CDNs you might have to wait 24 hours before you see any log. It is also good idea that your query time spans across the last 2 days as the logs will be logged with the time they were generated but the ingestion is done every 24 hours. Verizon has lower time for ingestion like 2 hours.