Skip to content

Commit 30fb31d

Browse files
Merge pull request #251074 from osalzberg/docs-editor/azure-monitor-data-explorer-pr-1694507718
Update azure-monitor-data-explorer-proxy.md
2 parents 1471c82 + dc9aba7 commit 30fb31d

File tree

1 file changed

+11
-4
lines changed

1 file changed

+11
-4
lines changed

articles/azure-monitor/logs/azure-monitor-data-explorer-proxy.md

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,8 @@ union customEvents, adx('https://help.kusto.windows.net/Samples').StormEvents
5151
```kusto
5252
let CL1 = adx('https://help.kusto.windows.net/Samples').StormEvents;
5353
union customEvents, CL1 | take 10
54-
```
54+
55+
```sql
5556
5657
> [!TIP]
5758
> Shorthand format is allowed: *ClusterName*/*InitialCatalog*. For example, `adx('help/Samples')` is translated to `adx('help.kusto.windows.net/Samples')`.
@@ -60,7 +61,7 @@ When you use the [`join` operator](/azure/data-explorer/kusto/query/joinoperator
6061
6162
For example:
6263
63-
```kusto
64+
kusto
6465
AzureDiagnostics
6566
| join hint.remote=left adx("cluster=ClusterURI").AzureDiagnostics on (ColumnName)
6667
```
@@ -145,11 +146,12 @@ union AzureActivity, arg("").Resources
145146
```kusto
146147
let CL1 = arg("").Resources ;
147148
union AzureActivity, CL1 | take 10
148-
```
149+
150+
```sql
149151
150152
When you use the [`join` operator](/azure/data-explorer/kusto/query/joinoperator) instead of union, you need to use a [`hint`](/azure/data-explorer/kusto/query/joinoperator#join-hints) to combine the data in Azure Resource Graph with data in the Log Analytics workspace. Use `Hint.remote={Direction of the Log Analytics Workspace}`. For example:
151153
152-
```kusto
154+
kusto
153155
Perf | where ObjectName == "Memory" and (CounterName == "Available MBytes Memory")
154156
| extend _ResourceId = replace_string(replace_string(replace_string(_ResourceId, 'microsoft.compute', 'Microsoft.Compute'), 'virtualmachines','virtualMachines'),"resourcegroups","resourceGroups")
155157
| join hint.remote=left (arg("").Resources | where type =~ 'Microsoft.Compute/virtualMachines' | project _ResourceId=id, tags) on _ResourceId | project-away _ResourceId1 | where tostring(tags.env) == "prod"
@@ -165,6 +167,11 @@ To create a new alert rule based on a cross-service query, follow the steps in [
165167
* Identifying the Timestamp column in the cluster isn't supported. The Log Analytics Query API won't pass along the time filter.
166168
* The cross-service query ability is used for data retrieval only.
167169
* [Private Link](../logs/private-link-security.md) does not support cross-service queries.
170+
* mv-expand is limited to 2000 records.
171+
172+
* the following operators do not work with the cross query with ability with Azure Resource Graph:
173+
174+
smv-apply(), rand(), arg_max() , arg_min(), avg() , avg_if(), countif(), sumif(), percentile() , percentiles() , percentilew() , percentilesw(), stdev() , stdevif() , stdevp(), variance() , variancep() , varianceif().
168175

169176
## Next steps
170177
* [Write queries](/azure/data-explorer/write-queries)

0 commit comments

Comments
 (0)