I'm writing a Azure Resource Graph query in Azure workbook on Azure portal:
AlertsManagementResources
| where type =~ 'microsoft.alertsmanagement/alerts'
| where properties.essentials.startDateTime > ago(30d)
| where properties.essentials.severity == "Sev0"
| extend State = tostring(properties.essentials.alertState)
| summarize count() by State
This query is giving me inconsistent results. Running the query gives me 50/50 chance of:
A. Retrieve all alerts from the last 30 days
B. Retrieve only recent alerts or no results at all.
What I have tried:
- Check all the errors in https://learn.microsoft.com/en-us/azure/governance/resource-graph/troubleshoot/general but none of them fit my current situation
- Running the query on Azure Resource Graph Explorer instead but still gives the same error so I think the problem is related to the Azure Resource Graph query, not the workbook.
P/S: Query Settings: Data source: "Azure Resource Graph"; Subscriptions: Any subscription with alerts fired 28-30 days ago; Visualization: "Grid"; Size: "Medium"