Log analytics workspace reports 10 warnings

@Rob Underwood, thank you for posting this question on Microsoft Q&A.

Could you please answer the queries below to help us understand this issue better:

1. Where do you see this error? Could you share a screenshot masking the confidential information (subscription id, username/email id etc.)
2. When do you see this error? Is it while performing a specific task?
3. Is this something that has started occurring recently?

This seemed to start on June 4th.

@Rob Underwood, Apologies for the delayed response.

Are you still facing this issue or was it only for a small duration when you were facing this issue?

I checked the workbook, and it uses the query below to get these errors.

_LogOperation
| where Level in ("Error", "Warning")
| summarize arg_max(TimeGenerated, *) by Level, Resource=_ResourceId, Computer, Category, Operation, Details=Detail
| project
    TimeGenerated,
    Level,
    Category=strcat(Category, " (", Operation, ")"),
    Computer=iff(Resource == "", Computer, strcat(Computer, " (", Resource, ")")),
    FullText=Details
| reduce kind=source by FullText with threshold=0.5

If you are still seeing the errors being reported, can you please run the following query to get an understanding of the resource which is causing this issue?

_LogOperation| where Level in ("Error", "Warning")| summarize arg_max(TimeGenerated, *) by Level, Resource=_ResourceId, Compu

As the table for which the error is being reported is AzureDiagnostics table, the values are being sent by another resource which is causing this error. The respective resource will have to be investigated to understand the cause.

Please let us know if you have any questions.

@Rob Underwood, Following-up to check if you had a chance to review the answer provided. If the answer did not help, please add more context/follow-up question for it.

Hello @AnuragSingh-MSFT

If it can help : the same problem as @Rob Underwood started to occur recently in our context (same table, but with another independent tenant/subscription).

Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: . Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[].properties[0]', line 1, position *. (5)

This table AzureDiagnostics is only fed by diagnostic settings from native Azure services here, there no custom feeding of this table in our environment. So it is probably a bug on Microsoft side, about logs format sent via diagnostic settings

When I run the query you've sent (after completing the last truncated work to "Computer"), here is the result :

Level,Resource,Computer,"TimeGenerated [UTC]",Category,Operation,Detail,CorrelationId

Warning,,,"7/12/2024, 10:23:30.271 PM",Ingestion,"JSON Format","Data of type AzureDiagnostics is being dropped due to incorrect format at lineOffset: 75. Exception message: After parsing a value an unexpected character was encountered: B. Path 'records[75].properties[0]', line 1, position 144459.",