Skip to content

Commit 206273b

Browse files
Merge pull request #222259 from eternovsky/main
Call out TimeGenerated requirement in xform kql
2 parents 1d69221 + 65986f6 commit 206273b

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

articles/azure-monitor/essentials/data-collection-transformations-structure.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ Transformations in a [data collection rule (DCR)](data-collection-rule-overview.
3939

4040

4141

42+
### Required columns
43+
The output of every transformation must contain a valid timestamp in a column called `TimeGenerated` of type `datetime`. Make sure to include it in the final `extend` or `project` block! Creating or updating a DCR without `TimeGenerated` in the output of a transformation will lead to an error.
4244

4345
## Inline reference table
4446
The [datatable](/azure/data-explorer/kusto/query/datatableoperator?pivots=azuremonitor) operator isn't supported in the subset of KQL available to use in transformations. This operator would normally be used in KQL to define an inline query-time table. Use dynamic literals instead to work around this limitation.
@@ -329,4 +331,4 @@ Use [Identifier quoting](/azure/data-explorer/kusto/query/schema-entities/entity
329331

330332
## Next steps
331333

332-
- [Create a data collection rule](../agents/data-collection-rule-azure-monitor-agent.md) and an association to it from a virtual machine using the Azure Monitor agent.
334+
- [Create a data collection rule](../agents/data-collection-rule-azure-monitor-agent.md) and an association to it from a virtual machine using the Azure Monitor agent.

0 commit comments

Comments
 (0)