Queries for the StorageCacheWarningEvents table

Active warning events

Retrieves a list of warning events that have not cleared.

StorageCacheWarningEvents
| where State == "Active"
| project TimeGenerated, CorrelationId, Description, _ResourceId, State
| join kind=leftanti (StorageCacheWarningEvents
    | where State == "Cleared"
        | project TimeGenerated, CorrelationId, Description, _ResourceId, State)
    on CorrelationId
| project TimeGenerated, CorrelationId, Description, _ResourceId, State
| take 100