need a query to find specific error messages for device calender issue for Surface Hub

%3CLINGO-SUB%20id%3D%22lingo-sub-502539%22%20slang%3D%22en-US%22%3Eneed%20a%20query%20to%20find%20specific%20error%20messages%20for%20device%20calender%20issue%20for%20Surface%20Hub%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-502539%22%20slang%3D%22en-US%22%3E%3CP%3EFor%20example%2C%20if%20I%20need%20to%20find%20email.o365%20error.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-502539%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-505384%22%20slang%3D%22en-US%22%3ERe%3A%20need%20a%20query%20to%20find%20specific%20error%20messages%20for%20device%20calender%20issue%20for%20Surface%20Hub%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-505384%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F330294%22%20target%3D%22_blank%22%3E%40Kunal_tejpal%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHello%2C%20can%20you%20provide%20some%20more%20info%20to%20enable%20us%20to%20help%20you%20please%3F%26nbsp%3B%20If%20you%20have%20started%20looking%20at%20this%2C%20do%20you%20have%20part%20of%20a%20query%20that%20you%20can%20share%2C%20do%20you%20know%20what%20dataset%20(table)%20you%20are%20looking%20in%3F%26nbsp%3B%20Also%20do%20you%20have%20the%20specific%20error%20you%20mention%3F%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIs%20this%20for%20an%20Alert%20or%20do%20you%20need%20to%20just%20display%20when%20the%20error%20is%20found%3F%26nbsp%3B%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIs%20it%20shown%20in%3C%2FP%3E%0A%3CPRE%3EDeviceCalendar%0A%7C%20limit%2050%3C%2FPRE%3E%0A%3CP%3EI%20no%20longer%20have%20the%20Solution%20in%20my%20workspace%2C%20but%20the%20schema%20shows%3A%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20290px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F111193i807B92FD2E1BDABB%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Annotation%202019-04-30%20192356.jpg%22%20title%3D%22Annotation%202019-04-30%20192356.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMaybe%20this%20will%20show%20the%20errors%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EDeviceCalendar%0A%7C%20summarize%20count()%20by%20EventId%2C%20EventName%3C%2FPRE%3E%0A%3CP%3E%3CBR%20%2F%3EThanks%20Clive%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

For example, if I need to find email.o365 error.

1 Reply
Highlighted

@Kunal_tejpal 

 

Hello, can you provide some more info to enable us to help you please?  If you have started looking at this, do you have part of a query that you can share, do you know what dataset (table) you are looking in?  Also do you have the specific error you mention? 

Is this for an Alert or do you need to just display when the error is found?  

 

Is it shown in

DeviceCalendar
| limit 50

I no longer have the Solution in my workspace, but the schema shows: 

Annotation 2019-04-30 192356.jpg

 

Maybe this will show the errors?

 

DeviceCalendar
| summarize count() by EventId, EventName


Thanks Clive