Few weeks ago Microsoft introduced the new Azure Log Analytics query language to OMS Log Analytics. In order to use the new language with your workspace you need to upgrade your current workspace. It is very simple and basically a one-click experience and there are new features available as MVP Marcel Zehner describes in his blog post. Microsoft also claims to have upgraded 1000s of workspaces without any issues.
One problem I ran into upgrading my workspace was an error. I clicked Upgrade Now…
…after few seconds I received this error…
…so I went to my workspace and downloaded the log from my workspace…
…the log says…
What this means is, that there is a problem with a saved search query and its expression…
…so the query looks like this…
It seems that there is an issue with EventID:[xx..yy] which cannot be translated to the new query language. So you have two choices either you modify the query or just delete it. I delete the query…
After I deleted the query, the upgrade process was successful…
Why did this happen at all? Well I installed a community ACS reports solution…
…and it can easily happen that you face such a problem with your own or other community solutions. So be aware of the new query language reference or if you are new to the Azure Log Analytics language you will find a well documented starting point at https://docs.loganalytics.io .
