Apr 17 2021 08:34 AM
When I look at the Resource group filter at the top of the workbook page, I see 2 versions of the same group, with different upper and lower case letters. When I look at my main Resource Group pages, I only see one of them. Does anyone know why I am seeing 2 different versions of the same thing?
Apr 18 2021 12:06 AM
Apr 19 2021 05:02 AM
Often in the default Workbooks (is this your own or a Azure Sentinel templated one, if so which one?) provide Resource Group info from a Azure Resource Group (ARG) query
resources
| where type =~ 'microsoft.operationalinsights/workspaces'
| project resourceGroup
If you are using KQL you may have some in lower or upper case combinations or maybe a renamed RG?
Apr 19 2021 06:12 AM
Apr 19 2021 06:35 AM
Apr 19 2021 07:00 AM
Apr 19 2021 03:37 PM - edited Apr 19 2021 04:07 PM
Thanks for you efforts to try to help me figure out what might be happening. To provide some more details, this occurred in an saved workbook that was created from the Azure Activity template. I see the same issue in the actual template, it is happening for every single RG. The same RG is shown twice using different case, some are all upper case and some are mixed case.
The parameter is a dropdown from Logs, so now my real question, is why would the ResoureGroup field in the AzureActivity log be getting stored differently.?
The query is
Apr 19 2021 06:47 PM
@Dean Gross Different systems report resource groups in different ways, especially when it comes to using different cases. To avoid this you can use something like the KQL command "tolower()" to make everything lowercase or "toupper()" to make everything uppercase.