Using 'Set in Query' option instead of Period in Azure Log Alerts

%3CLINGO-SUB%20id%3D%22lingo-sub-2520962%22%20slang%3D%22en-US%22%3EUsing%20'Set%20in%20Query'%20option%20instead%20of%20Period%20in%20Azure%20Log%20Alerts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2520962%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%20%26nbsp%3BI%20am%20using%20the%20attached%20query%20which%20is%20a%20combination%20of%203%20queries%20each%20with%20its%20own%20time%20range%20.%3C%2FP%3E%3CP%3EIn%20Log%20Analytics%20the%20UI%20supports%20the%20option%20'Set%20In%20Query'%20and%20the%20query%20is%20able%20to%20return%20expected%20result.%3C%2FP%3E%3CP%3EBut%20in%20Case%20of%20Log%20Alert%20for%20Period%20all%20the%20options%20are%20multiples%20of%20minute%20and%20there%20is%20no%20option%20to%20select%20'Set%20In%20Query'%20.%20Hence%20the%20results%20are%20undesirable%20.%20If%20I%20set%20the%20period%20to%2015%20mins%20the%20first%20query%20doesn't%20return%20a%20result%20.%20If%20set%20the%20period%20to%2024%20hours%20the%20second%20query%20returns%20more%20than%20expected%20result.%20Is%20there%20a%20way%20to%20get%20around%20this%20%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi,

   I am using the attached query which is a combination of 3 queries each with its own time range .

In Log Analytics the UI supports the option 'Set In Query' and the query is able to return expected result.

But in Case of Log Alert for Period all the options are multiples of minute and there is no option to select 'Set In Query' . Hence the results are undesirable . If I set the period to 15 mins the first query doesn't return a result . If set the period to 24 hours the second query returns more than expected result. Is there a way to get around this ?

 

Thanks

0 Replies