SOLVED
Home

Issue with log analytics query

%3CLINGO-SUB%20id%3D%22lingo-sub-453055%22%20slang%3D%22en-US%22%3EIssue%20with%20log%20analytics%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-453055%22%20slang%3D%22en-US%22%3E%3CP%3EI%20need%20to%20write%20a%20log%20analytics%20query%20that%20can%20find%20storage%20account%20with%26nbsp%3B%3CSPAN%3EsupportsHttpsTrafficOnly%3C%2FSPAN%3E%20as%20false.%26nbsp%3B%3C%2FP%3E%3CP%3EBelow%20is%20the%20query%20that%20I%20have%20formed%20%2C%20but%20it%20is%20giving%20error%3A%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3E%3CFONT%20face%3D%22Consolas%22%3EAzureActivity%20%3C%2FFONT%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20OperationName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22Create%2FUpdate%20Storage%20Account%22%3C%2FSPAN%3E%20%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20Properties%20%3C%2FSPAN%3E%3CSPAN%3Ematches%3C%2FSPAN%3E%20%3CSPAN%3Eregex%3C%2FSPAN%3E%20%3CSPAN%3E%22%22%22supportsHttpsTrafficOnly%22%3C%2FSPAN%3E%3CSPAN%3E%3A%3C%2FSPAN%3E%3CSPAN%3Etrue%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3CSPAN%3E%22%22%3C%2FSPAN%3E%20%3C%2FFONT%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CBR%20%2F%3EError%20message%3A%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EQuery%20could%20not%20be%20parsed%20at%20'%3A'%20on%20line%20%5B3%2C61%5D%20Token%3A%20%3A%20Line%3A%203%20Position%3A%2061%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3ECan%20someone%20please%20help%20on%20this%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-453055%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-454425%22%20slang%3D%22en-US%22%3ERe%3A%20Issue%20with%20log%20analytics%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-454425%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F321154%22%20target%3D%22_blank%22%3E%40Shubham150391%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%0A%3CPRE%3EAzureActivity%0A%7C%20where%20OperationName%20%3D%3D%20%22Create%2FUpdate%20Storage%20Account%22%0A%7C%20where%20Properties%20has%20'%22supportsHttpsTrafficOnly%5C%5C%22%3Atrue'%0A%7C%20project%20Properties%20%3C%2FPRE%3E%0AThat%20text%20has%20a%20%22%5C%22%20control%20char%2C%20so%20you%20need%20two%20%22%5C%5C%22.%26nbsp%3B%20Would%20as%20%3CSTRONG%3Ewhere%3C%2FSTRONG%3E%20work%20for%20you%3F%26nbsp%3B%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108817i6A8CACA8ADE53CBB%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Annotation%202019-04-15%20144226.jpg%22%20title%3D%22Annotation%202019-04-15%20144226.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Shubham150391
Frequent Visitor

I need to write a log analytics query that can find storage account with supportsHttpsTrafficOnly as false. 

Below is the query that I have formed , but it is giving error:

AzureActivity
| where OperationName == "Create/Update Storage Account"
| where Properties matches regex """supportsHttpsTrafficOnly":true,""

Error message:
Query could not be parsed at ':' on line [3,61] Token: : Line: 3 Position: 61
 
Can someone please help on this
1 Reply
Highlighted
Solution

@Shubham150391 

 

AzureActivity
| where OperationName == "Create/Update Storage Account"
| where Properties has '"supportsHttpsTrafficOnly\\":true'
| project Properties 
That text has a "\" control char, so you need two "\\".  Would as where work for you? 
Annotation 2019-04-15 144226.jpg
 
 
Related Conversations
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
flashing a white screen while open new tab
cntvertex in Discussions on
13 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
22 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
28 Replies
Edge insider Dev bypasses IE mode website list
HotCakeX in Enterprise on
4 Replies