CODEWITHSUNDEEP
azure
itye1970
itye1970

Reputation: 1985

The query didn't return the TimeGenerated column. Please edit the query and include the TimeGenerated column

In Log Analytics in Azure , i select a predefined query for VM Heartbeat, I run the query ok in the editor but when I go to create the alert i keep getting "The query didn't return the TimeGenerated column. Please edit the query and include the TimeGenerated column."

Its odd becasue it works in the editor and its a predefined query i used from MS? what is the problem here?

    // Not reporting VMs 
    // VMs that have not reported a heartbeat in the last 5 minutes. 
    // To create an alert for this query, click '+ New alert rule'
    Heartbeat 
    | where TimeGenerated > ago(24h)
    | summarize LastCall = max(TimeGenerated) by Computer, _ResourceId
    | where LastCall < ago(5m)

Upvotes: 2

Views: 468

Answers (1)

Chibbies
Chibbies

Reputation: 11

Rename LastCall to TimeGenerated and you should be good to go:

Heartbeat 
| where TimeGenerated > ago(24h)
| summarize TimeGenerated = max(TimeGenerated) by Computer, _ResourceId
| where TimeGenerated < ago(5m)

Upvotes: 1

Related Questions