Issue with OMS JSON Query

eskarthi — Wed, 08 May 2019 02:48:28 GMT

Hello,

Nowadays we are relaying on OMS query for pulling data into Splunk, however i have noticed some gaps in the OMS - Json query.

For example : we are querying azure activity for every hour and we got some intermittent network disconnection/timeout error for sometime. Once the network connection was resumed the oms connector is not pulling the data from where it left .

Technically the script is constructing values in end,start parameters for extracting the query, however OMS/Log Analytics is not listening to the value we set in end,top,start parameters, it takes only the "query" parameter and execute.

{"query": "AzureActivity | where TimeGenerated > ago(1h)", "end": "2019-05-01T00:00:00", "top": "1", "start": "2019-05-01T11:21:56"}

Furthermore, I have tested the above query using postman utility and the OMS is ignoring those values and i don't know why we are sending those values to Azure ?

is there any way to fix the intermittent connection issues in code ? Please advise.

Thanks
Karthik

Re: Issue with OMS JSON Query

jkat54 — Tue, 21 May 2019 10:24:05 GMT

The app is a concept app based on the original OMS query language. The API the app used has been changed significantly.

If you can suggest any edits to code, I'd love to make patches for you and the community when I can.

topic Re: Issue with OMS JSON Query in All Apps and Add-ons

Issue with OMS JSON Query

Re: Issue with OMS JSON Query