I have a basic azure alert where it looks at the windows logs of a VM, and determines whether it should fire an alert upon detecting a specific event ID Event | where EventID == "500" | summarize arg_max(TimeGenerated, *)…
I want to find a way to ingest data from one database to another (same cluster), based on when the source table gets updated. We have an update query that is able to see across databases , however when I…
I am trying to create an alert rule in Application Insights based on a Kusto query. If the resultset is empty, I want to fire the alert. If I set the alert logic to: operater = Equal To and the…
I have a dataset with date values and and its corresponding status values. I want to generate missing date values by one hour along with its status values. Is it possible to do in kusto. I have tried generating it…
I am running an KQL Query in Azure Resource Graph Explorer: resources | where type == 'microsoft.network/virtualwans' and tags.CompanyTag =~ 'Company' | extend WANname = tostring(name) | extend VPNsite = tostring(properties.vpnSites) And the output of this is {"id":"/subscriptions/companysubscriptionid/resourceGroups/companyresourcegroupname/providers/Microsoft.Network/vpnSites/NAMEOFTHEWAN"}] I only…
I'm working in Kusto Query Language and I would like to display not everything from the selected string. My string is 'Execution fail against sql server. Please contact SQL Server team if you need further support. Sql error number: 50000.…
I have the following json contained in a particular field in the traces.customDimensions: When I parse this Json to extract a particular value I always get an empty column, for example: traces | order by timestamp desc | project CurrentContext…
In our Azure environment we have resources that contain tags that haven't been consistently named with regard to the use of upper and lowercase. Say we have a tag Projectteam. In our environment we would have all kinds of variants…
Need to find each API Max hour usage in a given day in Azure App insight using query. For example API A has total hit between 1 PM to 2PM is 10, 2 PM to 3 PM is 20 and…
Does anyone know a way to force a child table to update from the source table? it would be a one off command to run when the child table is created, then we have an auto update policy in place.…