log details for Trigger run

Microsoft

The below query is working in Workbooks.

 

when I am modifying the line  | where TriggerName == "{TriggerName}" to below

| where TriggerName == TriggerName, then also it is failing.

 

error msg:

'join' operator: Failed to resolve table or column or scalar expression named 'datat2'

 

| where TriggerName == "{TriggerName}"

 

KQL

 

let datat = ADFTriggerRun
| extend TriggerId = tostring(TriggerId)
| where TriggerName == "{TriggerName}"
| where ResourceId contains "ADF02";

let datat2 = datat
| join kind = inner
(
datat
| summarize LastTriggerTime = max(TimeGenerated) by TriggerName
) on TriggerName, $left.TimeGenerated == $right.LastTriggerTime;

let masterpipeline = ADFPipelineRun
| extend TriggerId = tostring(parse_json(SystemParameters).TriggerId )
| where TimeGenerated > ago(2d)
| where ResourceId contains "ADF02"
| join kind = inner (datat2) on TriggerId;
masterpipeline
| project TriggerName = "{TriggerName}",OperationName, TimeGenerated,Status,
Duration = datetime_diff("Minute",End,Start),Start,End,Parameters,SystemParameters,CorrelationId,Annotations
| order by TimeGenerated desc;

1 Reply

@srikanth3300 

 

"{TriggerName}"  - or anything within { } is unique to a Workbook and has to be replaced in a Log Analytics query.  So if the workbook parameter TriggerName has a string value of "this is a trigger", the KQL would be.   

 

| where TriggerName == "This is a trigger"

 

 

 

A workbook, knows that the query language you are using is KQL - either Log Analytics or Azure resource Graph.  However if you take the query from a Workbook and run it in the Log Analytics console you have to adapt it.

 

Make sense?