Cannot query Azure load balancer diagnostic logs in log analytics

[Sebastian Maas]

Good morning,

I have setup diagnostic logs for my standard public load-balancer to go into log analytics:

The log analytics workspace is setup to use resource-level and workspace permissions, I am contributor on both. I can also see, that the tables are created:

Now when I want to query the logs, I receive the following error:

I don't know what I'm missing here honestly, would appreciate any advice. Thank you very much!

[#2 · Accepted solution]

@Sebastian Maas,

the reason might simply be the LB not having yet generated logs. Log are generated only if alerts are raised or health probe status change. See docs details below.

You can also run this query to see if your LB logs are landing in some other table:

search '*loadbalancername*' | distinct $table

[#3]

@Sebastian Maas Take out the TimeGenerated line and change the time selection option (defaults to 24 hours) at the top to something like 6 months, then just run AzureDiagnostics.

Like you say, the table is there so there is some data in it.

Alternatively, if you hover over the AzureDiagnostics table, on the right there is a little symbol (I always think it looks like an eye), click that and it'll give you a sample 10 rows from the table.