Forum Discussion
Sentinel Query Error: Failed to resolve table
Hey, for a couple of weeks now we can no longer query for CommonSecurityLog, just getting an error: 'order' operator: Failed to resolve table or column expression named 'CommonSecurityLog' If is...
Do you get the same error if you just double-click on "CommonSecurityLog" in the table listing and run that?
- Expand the the "Microsoft Sentinel" group in the "Tables" listing to the left of where you enter your query and see if it shows up there. Double click on it and it should just paste the name into the query where you can run it and see what happens.
Typically, if the table doesn't show up like you are showing it means there is no data in it. You can open the Log settings (gear icon in the upper right of the Logs area, NOT in the Azure header bar) and there is a setting to "Show tables with no data". You can enable that to see all the tables.GaryBusheyThanks again Gary for responding! We are actually missing the Microsoft Sentinel Group. Starting to wonder if this somehow got deleted. Enabled the "show tables with no data"
