Queries for the AZMSOperationalLogs table

Publish success data for topics

Publish success data for topics for OperationLogs.

AZMSOperationalLogs
| extend TopicName = tostring(split(_ResourceId, "/")[10])
| where Provider =~ "EventHub"
| where isnotnull(TopicName) and Status == "Succeeded"
| project TopicName, _ResourceId, EventName, Status, Caller, _SubscriptionId
| summarize by TopicName, EventName

Publish failures for subscription

Publish management action failures for subscription.

AZMSOperationalLogs
| extend SubInfo = _SubscriptionId
| where Provider =~ "EventHub"
| where isnotnull(SubInfo) and Status != "Succeeded"
| project SubInfo, _ResourceId, EventName, Status, Caller
| summarize by SubInfo, EventName

Publish failures for namespace

Publish management action failures for namespace.

AZMSOperationalLogs
| extend NamespaceName = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "EventHub"
| where isnotnull(NamespaceName) and Status != "Succeeded"
| project NamespaceName, _ResourceId, EventName, Status, Caller, _SubscriptionId
| summarize by NamespaceName, EventName

Publish success data for topics

Publish success data for topics on CRUD Operations in Server Bus.

AZMSOperationalLogs
| extend TopicName = tostring(split(_ResourceId, "/")[10])
| where Provider =~ "ServiceBus"
| where isnotnull(TopicName) and Status == "Succeeded"
| project TopicName, _ResourceId, EventName, Status, Caller, _SubscriptionId
| summarize by TopicName, EventName

Publish failures for Topics

Publish management action failures for topics.

AZMSOperationalLogs
| extend TopicName = tostring(split(_ResourceId, "/")[10])
| where Provider =~ "ServiceBus"
| where isnotnull(TopicName) and Status != "Succeeded"
| project TopicName, _ResourceId, EventName, Status, Caller, SubscriptionId
| summarize by TopicName, EventName

Publish failures for subscription

Publish management action failures for subscription.

AZMSOperationalLogs
| extend SubInfo = _SubscriptionId
| where Provider =~ "ServiceBus"
| where isnotnull(SubInfo) and Status != "Succeeded"
| project SubInfo, _ResourceId, EventName, Status, Caller
| summarize by SubInfo, EventName

Publish failures for namespace

Publish management action failures for namespace.

AZMSOperationalLogs
| extend NamespaceName = tostring(split(_ResourceId, "/")[8])
| where Provider =~ "ServiceBus"
| where isnotnull(NamespaceName) and Status != "Succeeded"
| project NamespaceName, _ResourceId, EventName, Status, Caller, _SubscriptionId
| summarize by NamespaceName, EventName