I assume title may be reserved word or similar but query below refuses to be parsed around c.title. Not sure what exactly the issue with query itself
AzureActivity
| where CategoryValue == "ResourceHealth" and ResourceProviderValue == "MICROSOFT.COMPUTE"
| where not (ResourceGroup startswith "DATABRICKS-RG")
| extend d=parse_json(Properties)
| extend c = parse_json(tostring(d.eventProperties))
| where c.cause == "PlatformInitiated" and not(c.title == "Live Migration")
Error shown
 SYNTAX ERROR
Query could not be parsed at '.' on line [6,48]
Token: .
Line: 6
Position: 48
If issue persists, please open a support ticket.
Request id: 6a4d4bae-41f6-43b4-9657-55fc435acab9
                as title is a reserved keyword in the language, you could replace c.title with c['title'].
see: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/scalar-data-types/dynamic#dynamic-object-accessors
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With