SOLVED
Home

Issue with log analytics query

%3CLINGO-SUB%20id%3D%22lingo-sub-453055%22%20slang%3D%22en-US%22%3EIssue%20with%20log%20analytics%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-453055%22%20slang%3D%22en-US%22%3E%3CP%3EI%20need%20to%20write%20a%20log%20analytics%20query%20that%20can%20find%20storage%20account%20with%26nbsp%3B%3CSPAN%3EsupportsHttpsTrafficOnly%3C%2FSPAN%3E%20as%20false.%26nbsp%3B%3C%2FP%3E%3CP%3EBelow%20is%20the%20query%20that%20I%20have%20formed%20%2C%20but%20it%20is%20giving%20error%3A%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3E%3CFONT%20face%3D%22Consolas%22%3EAzureActivity%20%3C%2FFONT%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20OperationName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22Create%2FUpdate%20Storage%20Account%22%3C%2FSPAN%3E%20%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%20face%3D%22Consolas%22%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20Properties%20%3C%2FSPAN%3E%3CSPAN%3Ematches%3C%2FSPAN%3E%20%3CSPAN%3Eregex%3C%2FSPAN%3E%20%3CSPAN%3E%22%22%22supportsHttpsTrafficOnly%22%3C%2FSPAN%3E%3CSPAN%3E%3A%3C%2FSPAN%3E%3CSPAN%3Etrue%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3CSPAN%3E%22%22%3C%2FSPAN%3E%20%3C%2FFONT%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CBR%20%2F%3EError%20message%3A%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EQuery%20could%20not%20be%20parsed%20at%20'%3A'%20on%20line%20%5B3%2C61%5D%20Token%3A%20%3A%20Line%3A%203%20Position%3A%2061%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3ECan%20someone%20please%20help%20on%20this%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-453055%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-454425%22%20slang%3D%22en-US%22%3ERe%3A%20Issue%20with%20log%20analytics%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-454425%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F321154%22%20target%3D%22_blank%22%3E%40Shubham150391%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%0A%3CPRE%3EAzureActivity%0A%7C%20where%20OperationName%20%3D%3D%20%22Create%2FUpdate%20Storage%20Account%22%0A%7C%20where%20Properties%20has%20'%22supportsHttpsTrafficOnly%5C%5C%22%3Atrue'%0A%7C%20project%20Properties%20%3C%2FPRE%3E%0AThat%20text%20has%20a%20%22%5C%22%20control%20char%2C%20so%20you%20need%20two%20%22%5C%5C%22.%26nbsp%3B%20Would%20as%20%3CSTRONG%3Ewhere%3C%2FSTRONG%3E%20work%20for%20you%3F%26nbsp%3B%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F108817i6A8CACA8ADE53CBB%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Annotation%202019-04-15%20144226.jpg%22%20title%3D%22Annotation%202019-04-15%20144226.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Shubham150391
Frequent Visitor

I need to write a log analytics query that can find storage account with supportsHttpsTrafficOnly as false. 

Below is the query that I have formed , but it is giving error:

AzureActivity
| where OperationName == "Create/Update Storage Account"
| where Properties matches regex """supportsHttpsTrafficOnly":true,""

Error message:
Query could not be parsed at ':' on line [3,61] Token: : Line: 3 Position: 61
 
Can someone please help on this
1 Reply
Highlighted
Solution

@Shubham150391 

 

AzureActivity
| where OperationName == "Create/Update Storage Account"
| where Properties has '"supportsHttpsTrafficOnly\\":true'
| project Properties 
That text has a "\" control char, so you need two "\\".  Would as where work for you? 
Annotation 2019-04-15 144226.jpg
 
 
Related Conversations
flashing a white screen while open new tab
cntvertex in Discussions on
14 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
23 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
28 Replies