Log Analytics KQL with Time Range does not work from App Insights using "workspace"

1
votes

I have a Log Analytics KQL as below for Custom Table with Time Range; it works fine in Log Analytics.

You can notice the Time range = Set in query automatically.

Log Analytics KQL

But when I run the same KQL from App Insights using workspace, it doesn't take TimeGenerated into to account and fetches data for Time range set in App Insights and returns wrong resultset!

You can notice the Time range = Last 30 minutes in-spite I have given TimeGenerated > ago(365d)!

App Insights

I have noticed same issue with App Insights KQL running in Log Analytics using app() function!

Not sure what is wrong or is it a restriction?

1
azureazure-application-insightsazure-log-analyticsazure-data-explorerkql

1 Answers

3
votes

The root cause is that in application insights, it uses the timestamp column to represent the logged time. But in Log analytics, it uses the TimeGenerated column to represent the logged time.

So when in Application insights, you use workspace("log-analytics") and TimeGenerated > ago(10d), the application insights does not recognize TimeGenerated.

A screenshot as below:

enter image description here

In this situation, the solution is that, you should rename TimeGenerated to timestamp which can be recognized by application insights. The sample query like below:

enter image description here