log analytics API returning empty Table collection

I'm using Client Credentials to query Office 365 Audit data stored in Log Analytics. The AppID principal has Log Analytics Reader permissions to both the Log Analytics workspace and the Office 365 Au...

azure monitor

Powershell and Rest API

Paul Hunt - Cimares
Jul 04, 2019
After much bashing of the head against the desk, it would seem that not all the queries that work in the Log Analytics web engine work through the API. My previous errors were being masked by the JSON not converting properly and being left out of the body. Fiddler ftw!

If I use "search Operation == 'desired op'" and pass it into the body of the POST then that works ok and results are returned.

niukk

Copper Contributor

Nov 15, 2019

Paul Hunt - Cimares I got the same, trying simple query 'Heartbeat| limit 50' which gets me empty table. How do I pass "search Operation == 'desired op'" into the body ? Thnx

ktvasanhotmailcom

Copper Contributor

Dec 02, 2021

I had same problem, Instead of posting query as json just append the query string in the url
like:

url = "https://api.loganalytics.io/v1/workspaces/"+ workspace_id + "/query?query=AzureActivity | summarize count() by Category"

Forum Discussion

log analytics API returning empty Table collection

Resources