Getting error while creating Alert rule in Log Analytics in OMS

Question

When I tried to add alert rule using OMS portal - Log analytics.

getting below error -

Search resulted in an error of type: SyntaxError

query is Type=Event EventLevelName=error

query is correct still getting above error can any one check this.

Getting error while creating Alert rule in Log Analytics in OMS

Answer 1

You should use Event | where EventLevelName == "Error".

Please refer to this link.

Workspace version   API version Sample query
v1 (legacy) 2015-11-01-preview  Type=Event EventLevelName = Error
v2 (upgraded)   2017-03-15-preview  Event | where EventLevelName == "Error"