Forum Discussion

DennesTorres's avatar
DennesTorres
Icon for Power Participant rankPower Participant
2 years ago

KQL Query not accepted by alerts

Hi,   I have the KQL query below. This query is not being accepted for alert creation.   pusummary | where Window_End_Time > ago(20m) | where TotalRides >5 | where PULocationID in (pusummary ...
Reflex
lbendlin's avatar
lbendlin
Icon for Super User rankSuper User
2 years ago

You are already filtering your IDs.  No need to filter them again

 

pusummary
| where PULocationID in (pusummary 
    | where Window_End_Time > ago(20m) 
    | where TotalRides >5 
    | summarize TotalRides=sum(toint(TotalRides)) by PULocationID
    |top 5 by TotalRides)
| summarize TotalRides=sum(toint(TotalRides)) by Window_End_Time=bin(Window_End_Time,2m), PULocationID
  • DennesTorres's avatar
    DennesTorres
    Icon for Power Participant rankPower Participant
    2 years ago

    Hi,

     

    I can remove the 

    | where TotalRides >5


    But I can't remove the filter by window_end_Time, otherwise it show to me the values for the top 5 Ids for all the time available.

    Anyway, none of these options enabled the "Set Alert".

     

    Kind Regards,

     

    Dennes