Azure alert rule creation - KQL in query editor is ok but not validated when creating or editing alert rule

Question

Hi

I am trying to duplicate an alert rule that is currently working within a different tenancy, I have tried to use the same custom log search. This seems to be fine in the editor but when it's copied into the search query textbox it says 'couldn't validate ..'

Same search is being used in production, so I am uncertain what has been changed.

Would you be able to advise on the steps to resolve this?

Regards

Ryan.

Answer 1

Hello Ryan Lee,

When creating an alert in Azure Monitor, the "traces" table can be used in following scenarios. which often includes application and diagnostic logs.

• Application Insights: If your application is instrumented with Application Insights, the traces table can store telemetry data that is collected, such as diagnostic messages, custom events.
• Performance Monitoring: you can set up alerts to monitor application performance metrics, such as response times or throughput.

So, while choosing the scope, please make sure to use the appropriate scope.

Over my lab I've selected Application insights as a scope and i was able to create an alert rule.

FYR, the query has validated successfully in my scenario.

And i can create an alert for the same. Hence, please select the appropriate scope and try the operation.

Hope this helps!

let us know if you have any further queries. I’m happy to assist you further.  

Please provide your valuable comments

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.

Thanks.