Forum Discussion

jholl016's avatar
jholl016
New Member
7 years ago
Solved

Missing data when querying Log Analytics

When I query my Log Analytics workspace, the returned results are missing "windows" of data at various locations in the results table.  Here is my kusto query in LA:

Event 
| where EventLog == "Talon"
| search EventData contains ":Filename=TafsMtPt:"
| parse RenderedDescription with "Result=" Result ":error=" Error ":Peer=" Peer ":Direction=" Direction ":Mode=" Mode ":Filename=TafsMtPt:" Filename ":File Size=" FileSize ":Bytes Exchanged=" BytesExchanged ":Transfer Efficiency=" TransferEfficiency ":SID=" UserSID
| project Computer, Result, Error, Peer, Direction, Mode, Filename, FileSize, BytesExchanged, TransferEfficiency, UserSID, TimeGenerated, EventLevelName
| project-rename EventTime = TimeGenerated, LogType = EventLevelName
| where Filename !contains "-temp." and Filename !contains "desktop.ini" and Filename !contains "~$" and Filename !contains ".tmp" and Filename !endswith "_placeholder_"

When I run this query in the Azure portal, I get complete results, with no missing data.  Visualizing the results in a Log Analytics workspace summary by counting the number of events in hourly bins, you see spikes in the number of events for each weekday.

But when I export the kusto query to M Query for Power BI, the resultant data set is missing a significant amount of data.  Two of the weekday peaks are missing entirely.

 

I am using the latest edition of Power BI desktop.  What on earth is going on here?

 

2 Replies