CODEWITHSUNDEEP
azurekqlazure-log-analyticsazure-monitoring
user3732793
user3732793

Reputation: 1979

where' operator: Failed to resolve table or column expression named 'ConfigurationChange'

pretty sure that did work yesterday

ConfigurationChange
| where SvcPreviousState  == "Running"
| where SvcState == "Stopped"
| order by TimeGenerated

today I get in my Analytics Workspace

where' operator: Failed to resolve table or column expression named 'ConfigurationChange'

As far I can see nothing as changed in the Analytics or VM configuration which should fill the results.

On Resource Group Layer it works fine

Any idea why that is not in the listed query tables of the analytics workspace anymore ?

Upvotes: 0

Views: 12071

Answers (1)

John Gardner
John Gardner

Reputation: 25146

If you query logs at the resource group level, the query will scan across ALL workspaces that contain any data for that resource group, and would effectively union all of the tables across all of the workspaces. so if any workspace has that table, the query would succeed.

If you target a specific workspace, that table might not exist? You'd need to verify that the workspace you're targeting does indeed have that table.

From the docs for that table, it appears that table belongs to change tracking solution, which maybe only has been turned on in specific subscriptions or areas?

in your specific case, you'd create a fake datatable that has ALL the columns you would reference in the query as the MissingTable:

let MissingTable = datatable(SvcPreviousState: string, SvcState: string, TimeGenerated: datetime) [];
union isfuzzy=true MissingTable,ConfigurationChange
| where SvcPreviousState  == "Running"
| where SvcState == "Stopped"
| order by TimeGenerated

and then do a fuzzy union using that fake table and the real one (for me, does not exist. in workbooks in edit mode, you'll get a success with warning:

success with warning

if you stop editing and run the query, you'll just get the standard no results message (using any custom no rows message settings) :

no results

if the table exists and has rows, you'd get rows instead.

Upvotes: 1

Related Questions