How to edit KQL Query in Activator Alert

Hi ujalajha , Thank you for reaching out to the Microsoft Community Forum.

In Fabric KQL Queryset (Activator) alerts, the query is captured at the time the alert is created and isn’t dynamically linked afterward. Because of that, you won’t see an option to edit the query in the existing alert and any changes to the original query won’t reflect in the rule.

So, if you need to update the query, I suggest you create a new alert with the updated query and remove the old one.

Hello ujalajha 

Welcome to this community forum.

In the KQL Queryset, a time-based activator can be created based on the selected query.

Unfortunately, once the Activator definition is created, only the condition and action can be altered.

As stated already, the KQL query cannot be altered in the Activator. Deleting the current Activator definition and creating a new definition based on the updated/fixed KQL query is the only thing you can do.

The original interval van be taken from the live-feed:

The context gives away the original projected columns in the KQL query:

Here, the 'Count' is exposed.

So, what was the original query, in case it's not available in the KQL Queryset anymore?

Go to the QueryInsights tab in the related KQL database and see that the same function is called using that interval:

Notice that the application is marked as 'Data Activator'.

This should be sufficient to recreate and update an obsolete Activator definition. 

--

If this answer helps you, a thumbs-up or marking it as the accepted answer is appreciated. All community members with similar questions will benefit by doing so. Your contribution is highly appreciated.