log details for Trigger run

%3CLINGO-SUB%20id%3D%22lingo-sub-1333603%22%20slang%3D%22en-US%22%3Elog%20details%20for%20Trigger%20run%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1333603%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EThe%20below%20query%20is%20working%20in%20Workbooks.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3Ewhen%20I%20am%20modifying%20the%20line%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%7C%20where%20TriggerName%20%3D%3D%20%22%7BTriggerName%7D%22%20to%20below%3C%2FP%3E%0A%3CP%3E%7C%20where%20TriggerName%20%3D%3D%20TriggerName%2C%20then%20also%20it%20is%20failing.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3Eerror%20msg%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E'join'%20operator%3A%20Failed%20to%20resolve%20table%20or%20column%20or%20scalar%20expression%20named%20'datat2'%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7C%20where%20TriggerName%20%3D%3D%20%22%7BTriggerName%7D%22%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EKQL%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Elet%20datat%20%3D%20ADFTriggerRun%3CBR%20%2F%3E%7C%20extend%20TriggerId%20%3D%20tostring(TriggerId)%3CBR%20%2F%3E%7C%20where%20TriggerName%20%3D%3D%20%22%7BTriggerName%7D%22%3CBR%20%2F%3E%7C%20where%20ResourceId%20contains%20%22ADF02%22%3B%3C%2FP%3E%0A%3CP%3Elet%20datat2%20%3D%20datat%3CBR%20%2F%3E%7C%20join%20kind%20%3D%20inner%3CBR%20%2F%3E(%3CBR%20%2F%3Edatat%3CBR%20%2F%3E%7C%20summarize%20LastTriggerTime%20%3D%20max(TimeGenerated)%20by%20TriggerName%3CBR%20%2F%3E)%20on%20TriggerName%2C%20%24left.TimeGenerated%20%3D%3D%20%24right.LastTriggerTime%3B%3C%2FP%3E%0A%3CP%3Elet%20masterpipeline%20%3D%20ADFPipelineRun%3CBR%20%2F%3E%7C%20extend%20TriggerId%20%3D%20tostring(parse_json(SystemParameters).TriggerId%20)%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20ago(2d)%3CBR%20%2F%3E%7C%20where%20ResourceId%20contains%20%22ADF02%22%3CBR%20%2F%3E%7C%20join%20kind%20%3D%20inner%20(datat2)%20on%20TriggerId%3B%3CBR%20%2F%3Emasterpipeline%3CBR%20%2F%3E%7C%20project%20TriggerName%20%3D%20%22%7BTriggerName%7D%22%2COperationName%2C%20TimeGenerated%2CStatus%2C%3CBR%20%2F%3EDuration%20%3D%20datetime_diff(%22Minute%22%2CEnd%2CStart)%2CStart%2CEnd%2CParameters%2CSystemParameters%2CCorrelationId%2CAnnotations%3CBR%20%2F%3E%7C%20order%20by%20TimeGenerated%20desc%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1333603%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1336020%22%20slang%3D%22en-US%22%3ERe%3A%20log%20details%20for%20Trigger%20run%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1336020%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F630180%22%20target%3D%22_blank%22%3E%40srikanth3300%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%22%7BTriggerName%7D%22%26nbsp%3B%20-%20or%20anything%20within%20%7B%20%7D%20is%20%3CU%3Eunique%3C%2FU%3E%20to%20a%20Workbook%20and%20has%20to%20be%20replaced%20in%20a%20Log%20Analytics%20query.%26nbsp%3B%20So%20if%20the%20workbook%20parameter%20TriggerName%20has%20a%20string%26nbsp%3Bvalue%20of%20%22this%20is%20a%20trigger%22%2C%20the%20KQL%20would%20be.%26nbsp%3B%20%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%7C%20where%20TriggerName%20%3D%3D%20%22This%20is%20a%20trigger%22%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EA%20workbook%2C%20knows%20that%20the%20query%20language%20you%20are%20using%20is%20KQL%20-%20either%20Log%20Analytics%20or%20Azure%20resource%20Graph.%26nbsp%3B%20However%20if%20you%20take%20the%20query%20from%20a%20Workbook%20and%20run%20it%20in%20the%20Log%20Analytics%20console%20you%20have%20to%20adapt%20it.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EMake%20sense%3F%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Microsoft

The below query is working in Workbooks.

 

when I am modifying the line  | where TriggerName == "{TriggerName}" to below

| where TriggerName == TriggerName, then also it is failing.

 

error msg:

'join' operator: Failed to resolve table or column or scalar expression named 'datat2'

 

| where TriggerName == "{TriggerName}"

 

KQL

 

let datat = ADFTriggerRun
| extend TriggerId = tostring(TriggerId)
| where TriggerName == "{TriggerName}"
| where ResourceId contains "ADF02";

let datat2 = datat
| join kind = inner
(
datat
| summarize LastTriggerTime = max(TimeGenerated) by TriggerName
) on TriggerName, $left.TimeGenerated == $right.LastTriggerTime;

let masterpipeline = ADFPipelineRun
| extend TriggerId = tostring(parse_json(SystemParameters).TriggerId )
| where TimeGenerated > ago(2d)
| where ResourceId contains "ADF02"
| join kind = inner (datat2) on TriggerId;
masterpipeline
| project TriggerName = "{TriggerName}",OperationName, TimeGenerated,Status,
Duration = datetime_diff("Minute",End,Start),Start,End,Parameters,SystemParameters,CorrelationId,Annotations
| order by TimeGenerated desc;

1 Reply
Highlighted

@srikanth3300 

 

"{TriggerName}"  - or anything within { } is unique to a Workbook and has to be replaced in a Log Analytics query.  So if the workbook parameter TriggerName has a string value of "this is a trigger", the KQL would be.   

 

| where TriggerName == "This is a trigger"

 

 

 

A workbook, knows that the query language you are using is KQL - either Log Analytics or Azure resource Graph.  However if you take the query from a Workbook and run it in the Log Analytics console you have to adapt it.

 

Make sense?