Open martin-rublik opened 5 months ago
A mutli-line analytics query is stripped, only first line is taken into consideration, the rest of the query is ignored.
$la=$(az monitor log-analytics workspace list) | ConvertFrom-Json $sentinelLA = $la | ?{$_.Name -eq $SENTINEL_LA_NAME} query = @" SigninLogs | where TimeGenerated > ago(30minutes) | distinct UserPrincipalName,tostring(DeviceDetail.displayName) | limit 10 "@ $signInLogs=$(az monitor log-analytics query -w $sentinelLA.customerId --analytics-query $query)
az monitor log-analytics query returns all the date from SignInLogs
az monitor log-analytics query
the filter where TimeGenerated > ago(30minutes) should be taken into consideration, also the limit etc.
where TimeGenerated > ago(30minutes)
azure-cli 2.61.0 core 2.61.0 telemetry 1.1.0 Extensions: log-analytics 0.2.2 Dependencies: msal 1.28.0 azure-mgmt-resource 23.1.1 Python location 'C:\temp\azure-cli-2.61.0-x64\python.exe' Extensions directory 'C:\Users\martinr\.azure\cliextensions' Python (Windows) 3.11.8 (tags/v3.11.8:db85d51, Feb 6 2024, 22:03:32) [MSC v.1937 64 bit (AMD64)] Legal docs and information: aka.ms/AzureCliLegal Your CLI is up-to-date.
https://martin.rublik.eu/2024/06/11/az-cli-and-loganalytics.html you can find detailed information here, along with workaround for this issue.
Thank you for opening this issue, we will look into it.
Describe the bug
A mutli-line analytics query is stripped, only first line is taken into consideration, the rest of the query is ignored.
Related command
Errors
az monitor log-analytics query
returns all the date from SignInLogsIssue script & Debug output
az monitor log-analytics query
returns all the date from SignInLogsExpected behavior
the filter
where TimeGenerated > ago(30minutes)
should be taken into consideration, also the limit etc.Environment Summary
Additional context
https://martin.rublik.eu/2024/06/11/az-cli-and-loganalytics.html you can find detailed information here, along with workaround for this issue.