Create Data Activator alerts from a KQL Queryset (preview)

  • Article

This article explains how to create Data Activator alerts from a KQL Queryset. For more information, see What is Data Activator. You can use Data Activator on a KQL Queryset to trigger notifications in two modes: when a scheduled KQL query returns results, or when a scheduled KQL query result that contains a visualization meets a defined set of conditions. You can send alert notifications either to yourself, or to others in your organization. Notifications can be sent by email or Microsoft Teams message.

Important

This feature is in preview.

Sample scenarios

Here are some ways you can use Data Activator alerts with KQL queries:

  • Suppose you have a KQL database and are storing application logs.
    • You receive an alert when any records from the last 5 minutes contain the string authorization error in the table’s message column.
  • In a different scenario, you have streaming data for available bicycles in different neighborhoods. A KQL query is created to render a piechart for the number of available bicycles per neighborhood.
    • You receive an alert when the number of available bicycles in any neighborhood falls below an acceptable number.

Prerequisites

Important

Only queries against KQL databases within an Eventhouse are supported. If your KQL queryset is connected to an external Azure Data Explorer cluster, creating an alert is not supported.

The following steps show you how to create an alert on a query that creates a visualization, or on a query that doesn't create a visualization.

Choose the tab that corresponds to your desired workflow.

Set alert on a KQL Queryset

Important

Timechart visualizations are not supported in this scenario. They are supported in Create Data Activator alerts from a Real-Time Dashboard.

  1. Browse to your KQL Queryset.

  2. Run a query that returns a visualization.

  3. Once the query returns results, select Set Alert on the top ribbon.

    For example, the following query is based on the sample Bicycles data from the Real-Time Intelligence tutorial.

    TutorialTable
| where Timestamp < ago(5m)
| summarize NumberOfBikes=sum(No_Bikes) by Neighbourhood
| render columnchart

    The query returns a column chart that shows the number of bikes available in each neighborhood, and this chart is used to set alert conditions.

Define alert conditions

  1. Set a time frequency for how often the query is run. The default is 5 minutes.
  2. In Conditions, specify your alert conditions as follows:
    • If your visualization has no dimensions, you can select the On each event when condition to monitor changes in the data stream by choosing a specific field to monitor.
    • If your visualization includes dimensions, you can select the On each event grouped by condition to monitor changes in the data stream by selecting a field for grouping, which divides the data into distinct groups
    • In the When dropdown, set the value to be evaluated.
    • In the Condition dropdown, set the condition to be evaluated. For more information, see Conditions.
    • In the Value field, set the value to compare against.
  3. In Action, specify whether you want your alert via email or Microsoft Teams. In the side pane, you can configure notifications that are sent to yourself. To send notifications to a different user, see Optional: Edit your trigger in Data Activator.
  4. In Save location, specify where to save your Data Activator alert. Choose an existing workspace, and save either in an existing Reflex item or a new one.
  5. Select Create to create your Data Activator trigger.

Screenshot of the set alert pane in the KQL queryset for creating a Data Activator alert.

Optional: Edit your trigger in Data Activator

When your Reflex item is saved, the side pane will display a link to your item. Select the link to further edit in Data Activator. This step can be useful if you want to do one of the following:

  • Add other recipients to your alert.
  • Change the content of the alert to reflect the specific data that triggered the alert.
  • Define a more complex alert condition than is possible in the Set alert pane.

For information on how to edit triggers in Data Activator, see Create triggers in design mode.

In the Reflex item itself, you can also view the history of the query results and the history of the trigger activations. For more information, see Create Data Activator triggers in design mode.

Related content