Queries for the CIEventsAudit table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Line chart showing requests response duration per operation.

CIEventsAudit
| summarize DurationMs = avg(DurationMs)  by bin(TimeGenerated, 5m), OperationName
| render timechart

Gets a list of operational events request that finished with result type ClientError: HTTP status code < 500.

CIEventsAudit
| where ResultType has "ClientError"
| sort by TimeGenerated desc
| limit 100 // You can adjust the limit value to the number of logs you would like to retrieve.

Gets a list of API requests that finished with Error severity level.

CIEventsAudit
| where Level has "Error"
| sort by TimeGenerated desc
| limit 100 // You can adjust the limit value to the number of logs you would like to retrieve.

Gets a list of all events request for a specific correlation id

union CIEventsAudit , CIEventsOperational
| where CorrelationId == "" // Add your CorrelationId in the quotation marks
| sort by TimeGenerated desc
| limit 100

Gets a list of API events requests for a specific instance ID.

CIEventsAudit
| where InstanceId == "" // Add your InstanceId in the quotation marks
| sort by TimeGenerated desc
| limit 100