Forum Discussion
Builtin "AD replication" search not work after upgrade
Hi.
We have OMS AD Replication Status solution, after the workspace upgrade, the solution shows generic visual information but when we want to search for more detailed info, all standard queries included break with an error like "A recognition error occurred. Token: "5". Position: 175."
One of the searchs:
ADReplicationResult | summarize arg_max(TimeGenerated, *) by SourceServer, DestinationServer, PartitionName, TenantId | where LastSyncResult != 0 and "PercentOfTSLRange == "Over 100 % TSL"" | sort by TimeGenerated desc
That piece of search code:
where LastSyncResult != 0 and "PercentOfTSLRange == "5-25 % TSL""
The error is just before the bold letters.
I've just now changed it to:
where LastSyncResult != 0 and (PercentOfTSLRange == "5-25 % TSL")
And it works, but I don't know if it is the best option, and I don't know why these "standard queries" included in the different solutions don't get correctly translated.
Thanks in advance.
Regards,
Héctor
6 Replies
- João Henrique Mortati FuzinelliBrass Contributor
Hi Héctor,
On the log search portal, we have a query conversor. Are you tried to use that to convert your old query?
- Héctor García de Llano GonzálezCopper Contributor
Hi Joao.
I've tried that conversion but it ends with an error in another position.
Solution goes to modify the query to avoid nested quotes, but, again, this is not a query created by me, it is the standard query included in OMS.
Regards,
Héctor
- Ketan GhelaniFormer Employee
We will look into the conversion issue. Are there other queries that were converted incorrectly.
Adding Dan Hadari and Noa Kuperberg