Log Analtyics-如何使用“反逗号"在搜索查询中 [英] Log Analtyics - How to use "inverted commas" within search query

问题描述

我正在尝试为将公共IP分配给NIC创建搜索查询，然后针对该查询创建警报.我可以找到标识分配的部分，但是我需要在搜索中使用反逗号"，但是我无法...

I am trying to create a search query for when a Public IP is assigned to a NIC, and then create an alert off that. I can find the part which identifies the assignment, but I need to use "inverted commas" within my search, but I can't...

我的查询:

AzureActivity
| where OperationName == "Microsoft.Network/networkInterfaces/write" and ActivityStatus == "Started"
| where Properties contains "<>"

在包含"范围内，我需要使用从属性JSON中提取的以下JSON(我发现该搜索是在不包含属性包含"的情况下进行的):

Within that "contains", I need to use the following JSON pulled from the properties JSON (which I found doing a search without Properties Contains):

\"provisioningState\":\"Succeeded"\

但是，我知道我不能在已经倒置的逗号区域内使用倒置逗号".有没有办法让我把它放进去，也许可以用一些取消或括起来的方法?

However, I know I can't use "inverted commas" within an already inverted comma area. Is there a way to allow me to put that inside, perhaps with some sort of cancelling or bracketing?

推荐答案

感谢@Oleg Ananiev提交的链接，我找到了解决方案.

I have found my solution, thanks to the links submitted by @Oleg Ananiev.

AzureActivity
| sort by TimeGenerated desc nulls last
| where OperationName == "Microsoft.Network/networkInterfaces/write" and ActivityStatus == "Started"
| where Properties contains '\\"provisioningState\\":\\"Succeeded\\"' 

这篇关于Log Analtyics-如何使用“反逗号"在搜索查询中的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！