HI all,
I created two public ips, and i'am trying to use the resourceChanges to extract some information about changes creation deletes and so on the subscription.
when i run this query:
ResourceChanges
| where properties.targetResourceType == "microsoft.network/publicipaddresses"
| extend changeType = tostring(properties.changeType)
| extend changedBy = tostring(parsejson(tostring(properties.changeAttributes)).changedBy)
| extend timestamp = tostring(parse_json(tostring(properties.changeAttributes)).timestamp)
i got almost all the logs correctly (see attachment)
c
but for the changedBy i can't see who creates the public ips and i got value "Unspecified" but if i make even a little update i got my account name in the field of the changedBy.
for a major project we are extracting this values but even for create delete or update we gon unspecified in more than one case.
if someone can explain why this is happening i will really appreciate.
HI all, I created two public ips, and i'am trying to use the resourceChanges to extract some information about changes creation deletes and so on the subscription.
when i run this query: ResourceChanges | where properties.targetResourceType == "microsoft.network/publicipaddresses" | extend changeType = tostring(properties.changeType) | extend changedBy = tostring(parsejson(tostring(properties.changeAttributes)).changedBy) | extend timestamp = tostring(parse_json(tostring(properties.changeAttributes)).timestamp)
i got almost all the logs correctly (see attachment) c
but for the changedBy i can't see who creates the public ips and i got value "Unspecified" but if i make even a little update i got my account name in the field of the changedBy.
for a major project we are extracting this values but even for create delete or update we gon unspecified in more than one case.
if someone can explain why this is happening i will really appreciate.
Best regards and thx for your time