Home

Builtin "AD replication" search not work after upgrade

Héctor García de Llano González
New Contributor

Hi.

 

We have OMS AD Replication Status solution, after the workspace upgrade, the solution shows generic visual information but when we want to search for more detailed info, all standard queries included break with an error like "A recognition error occurred. Token: "5". Position: 175."

One of the searchs:

ADReplicationResult | summarize arg_max(TimeGenerated, *) by  SourceServer, DestinationServer, PartitionName, TenantId  | where LastSyncResult != 0 and "PercentOfTSLRange == "Over 100 % TSL"" | sort by TimeGenerated desc

 

That piece of search code:

where LastSyncResult != 0 and "PercentOfTSLRange == "5-25 % TSL""

The error is just before the bold letters.

 

I've just now changed it to:

where LastSyncResult != 0 and (PercentOfTSLRange == "5-25 % TSL")

 

And it works, but I don't know if it is the best option, and I don't know why these "standard queries" included in the different solutions don't get correctly translated.

 

Thanks in advance.

Regards,

Héctor

 

6 Replies

Hi Héctor,

 

On the log search portal, we have a query conversor. Are you tried to use that to convert your old query?

 

image.png

Hi Joao.

 

I've tried that conversion but it ends with an error in another position.

Solution goes to modify the query to avoid nested quotes, but, again, this is not a query created by me, it is the standard query included in OMS.

 

Regards,

Héctor

We will look into the conversion issue.  Are there other queries that were converted incorrectly.

Adding @Dan Hadari and @Noa Kuperberg

Hi.

 

It happens with about 50% of all queries inside AD Replication Status Solution. I mean, when I click on AD Replication Status, it shows me 4 blocks (Source servers..., Destination servers..., Replication error types and Tomstone Lifetime):

- If I click directly on the lower part of those blocks (i.e., on one of the servers in the list), then there is always an error in the query, I need to modify the query to quit nested  quotes.

- If I click on the upper part of those blocks (i.e., on the graphic of Tombstone Lifetime) and then click on one item of the list that it shows, there is no error, the query is OK.

 

I hope this info will give you an idea to solve the conversion when you migrate this solution on another clients.

 

Regards,

Héctor

 

Hi,

Just to update that we've notified the AD Replication Status Solution owner of the problem and hope for a quick fix on this.

 

Regards,

Noa

A fix for the issue is being deployed.
Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies