OMS – Upgrade Workspace Error

image

Few weeks ago Microsoft introduced the new Azure Log Analytics query language to OMS Log Analytics. In order to use the new language with your workspace you need to upgrade your current workspace. It is very simple and basically a one-click experience and there are new features available as MVP Marcel Zehner describes in his blog post. Microsoft also claims to have upgraded 1000s of workspaces without any issues.

One problem I ran into upgrading my workspace was an error. I clicked Upgrade Now…

Upgrade

…after few seconds I received this error…

Error

…so I went to my workspace and downloaded the log from my workspace…

image

…the log says…

image

What this means is, that there is a problem with a saved search query and its expression…

RemoveSavedSearches

…so the query looks like this…

Query

It seems that there is an issue with EventID:[xx..yy] which cannot be translated to the new query language. So you have two choices either you modify the query or just delete it. I delete the query…

image

After I deleted the query, the upgrade process was successful…

SuccessfullUpgrade

Why did this happen at all? Well I installed a community ACS reports solution…

image

…and it can easily happen that you face such a problem with your own or other community solutions. So be aware of the new query language reference or if you are new to the Azure Log Analytics language you will find a well documented starting point at https://docs.loganalytics.io .

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s