Why is the Success property always empty?

Question

I am using azure log analytics workspaces and are trying to write a simple query to get the exception message when a azure function fails.

This is the query I am using

union AppTraces
| union AppExceptions
| union AppRequests
| where AppRoleName has "-NEU"
| where TimeGenerated > ago(1d)
//| where Success == "false"
| order by TimeGenerated asc
| project
    Success,
    TimeGenerated,
    AppRoleName,
    message = iff(Message != '', Message, iff(InnermostMessage != '', InnermostMessage, Properties.['prop__{OriginalFormat}'])),
    logLevel = Properties.['LogLevel']
| where logLevel != "Information"

The problem is that Success property is always empty and I expect it to be either true or false, I am using the Success property in other queries and it works just fine, for example as follows:

AppRequests 
| project TimeGenerated, OperationName, Success, ResultCode, DurationMs, AppRoleName
| where AppRoleName has "NEU"
| where OperationName != "MinimumAppVersionHead" and OperationName != "QueueManagerHead"
| where Success != "true"
| order by TimeGenerated desc 
| take 20

In the above case the Success where clause works as expected

Why is it not working in the first query?

Answer 1

Please check the below workaround it may help , we have tried with a simple query to check whether the success property is working or not. It works successfully using below query in logs with true and false.

As its works with second query it means you have added log analytics workspace for your function app successfully.

It seems there is an issue with "" , //| where Success == "false" instead of that try to remove the comment(//) and remove "" and use as below sample format in your query.

requests
| where success == false
| summarize failedCount=sum(itemCount), impactedUsers=dcount(user_Id) by operation_Name
| order by failedCount desc

We have tried with different output with success property as yours in the first query and getting no results . And by removing "" it works at our end.

Here are the below sample screenshots of output:-

OUTPUT OF THE GIVEN QUERY FOR FUNCTION APP FAILURE:

For more information please refer the below links:-

• MS DOC| View and query your Function app logs
• BLOG| Alerts on Azure Function failures