Feb 19 2019 01:35 AM
Feb 19 2019 01:35 AM
When we ingest data from our RP to LA, there are some fields and we explicitly set null values.
This is not for all scenarios. In other scenario, string values will be filled for those columns.
For eg - For Job A, field 1 will be null.
But in case of Job B, field 1 will be having string value.
Job A is very common and Job B is quite rare.
But since my setup has till now only those common jobs, I don't see field 1 created in my LA log search. Though the json we send from our RP explicitly have null values for those fields.
I need to write a generalized query (for all jobs) and print all the job specific fields.
Since the null field was not created yet, I get this error - Failed to resolve scalar expression when I query for that field.
So how to handle this case? Is there a way to let LA know the schema upfront so that null field columns are also created. Any other pointers would be helpful.
Feb 19 2019 11:35 PM
If that is the behavior of the API I do not think there is a way to avoid the behavior. Nevertheless can you share actually the query you use? Many things can be achieved with the query language but without knowing exactly what you use and trying to achieve it is hard to answer the question. Also those columns that you input and different what type they are string, integer, etc?
Feb 20 2019 12:19 AM
Thanks for the response.
This is the query:
AzureDiagnostics | where Category == "AzureBackupReport" and OperationName == "Job" | where TimeGenerated >= ago(90d) | project JobUniqueId_g, JobOperation_s, JobStatus_s, JobFailureCode_s, JobStartDateTime_s, JobDurationInSecs_s, JobOperationSubType_s, TimeGenerated
//, RecoveryJobDestination_s, RecoveryJobRPDateTime_s, RecoveryJobRPLocation_s, RecoveryLocationType_s
Feb 20 2019 12:53 AMSolution
You can do this
AzureDiagnostics | where TimeGenerated >= ago(90d) | project columnifexists("RecoveryJobDestination_s",'defaultValue')From the example you can see how it will be for the other columns as well. The operator documentation