Custom data in log analytics workspace

%3CLINGO-SUB%20id%3D%22lingo-sub-1827783%22%20slang%3D%22en-US%22%3ECustom%20data%20in%20log%20analytics%20workspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1827783%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20uploaded%20some%20data%20to%20custom%20table%20in%20log%20analytics%20workspace%20through%20CSV%20file%2C%20I%20can%20see%20table%20name%20appeared%20in%20logs%20query%20with%20default%20fields%20however%20I%20dont%20see%20any%20data%20there.%20Am%20I%20doing%20anything%20wrong%20here%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%22tablename%20%7C%20summarize%20count()%22%20gives%20me%200%20results.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1827873%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20data%20in%20log%20analytics%20workspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1827873%22%20slang%3D%22en-US%22%3EIs%20this%20from%20a%20Watchlist%20or%20a%20custom%20log%20(a%20file%20on%20a%20server%20with%20the%20Agent)%3F%20In%20either%20case%20it%20maybe%20a%20timing%20issue%2C%20especially%20as%20you%20have%20the%20table%20and%20columns.%20Data%20should%20be%20there%20in%202-5mins%20or%20so%2C%20maybe%20longer%20in%20some%20cases%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1827877%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20data%20in%20log%20analytics%20workspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1827877%22%20slang%3D%22en-US%22%3Eits%20a%20custom%20log%20uploaded%20via%20CSV%20file.%20I%20have%20uploaded%20this%20data%20around%204%20hours%20ago.%20Initially%20I%20thought%20it%20may%20take%20some%20time%20but%20I%20am%20still%20see%20there%20is%20no%20data%20in%20custom%20table%20in%20my%20log%20analytic%20workspace.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1827973%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20data%20in%20log%20analytics%20workspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1827973%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F633583%22%20target%3D%22_blank%22%3E%40pateriaak%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESo%20that's%20above%20the%20expected%201hr%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fdata-sources-custom-logs%23step-5-validate-that-the-custom-logs-are-being-collected%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Fdata-sources-custom-logs%23step-5-validate-that-the-custom-logs-are-being-collected%3C%2FA%3E%26nbsp%3B%20are%20you%20getting%20Heartbeat%20events%20from%20the%20machine%20that%20has%20the%20custom%20log%3F%26nbsp%3B%20%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAlso%20depending%20on%20your%20use%20case%2C%20Watchlists%20maybe%20an%20alternative%20for%20.csv%20files.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1970702%22%20slang%3D%22fr-FR%22%3ERe%3A%20Custom%20data%20in%20log%20analytics%20workspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1970702%22%20slang%3D%22fr-FR%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F633583%22%20target%3D%22_blank%22%3E%40pateriaak%3C%2FA%3E%26nbsp%3BHi!%20I%20have%20the%20same%20problem%20now%3C%2FP%3E%3CP%3EHow%20did%20you%20manage%20to%20solve%20the%20problem%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

I have uploaded some data to custom table in log analytics workspace through CSV file, I can see table name appeared in logs query with default fields however I dont see any data there. Am I doing anything wrong here? 

 

"tablename | summarize count()" gives me 0 results. 

 

 

4 Replies
Is this from a Watchlist or a custom log (a file on a server with the Agent)? In either case it maybe a timing issue, especially as you have the table and columns. Data should be there in 2-5mins or so, maybe longer in some cases
its a custom log uploaded via CSV file. I have uploaded this data around 4 hours ago. Initially I thought it may take some time but I am still see there is no data in custom table in my log analytic workspace.

@pateriaak 

 

So that's above the expected 1hr https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-custom-logs#step-5-valida...  are you getting Heartbeat events from the machine that has the custom log?   

 

Also depending on your use case, Watchlists maybe an alternative for .csv files.

@pateriaak Hi! I have the same problem now 

How did you manage to solve the problem?