Forum Discussion
Query could not be parsed at 'SecurityEvent' on line.....
We upgraded to the standard tier, but this still isn't working.
I can query events, but if I use any queries that involve SecurityEvent it doesn't work. Basically I'm trying to follow this:
https://pixelrobots.co.uk/2019/07/query-active-directory-security-events-using-azure-log-analytics-on-the-cheap/
That error is saying that the SecurityEvent table doesn't (yet) exist - there could be a delay, so please try again today. You need to confirm in ASC that you are sending the data to the correct Log Analytics workspace, either a named one (like below) or a default one (there maybe a few)?
2 Replies
That error is saying that the SecurityEvent table doesn't (yet) exist - there could be a delay, so please try again today. You need to confirm in ASC that you are sending the data to the correct Log Analytics workspace, either a named one (like below) or a default one (there maybe a few)?
CliveWatson thanks, it magically started working the next day. Then stopped working after I added a few more servers for a period of time, and started all working again sometime after.
All good now.
