KQL Search

This query is designed to filter and display specific activities from the Azure Activity logs. Here's a simple breakdown of what it does:

1. Data Source: It starts by looking at the AzureActivity log, which records various actions and events within Azure.

2. Filter by Operation: It filters the logs to only include activities where the operation name is either:

   • "MICROSOFT.LOGIC/WORKFLOWS/DISABLE/ACTION" (indicating a workflow was disabled)
   • "MICROSOFT.LOGIC/WORKFLOWS/DELETE" (indicating a workflow was deleted)

3. Filter by Status: It further narrows down the results to activities where the status of the operation starts with:

   • "Succe" (likely referring to "Success")
   • "accept" (possibly referring to "Accepted")

   This means it only shows activities that were successfully completed or accepted.

4. Comment: There's a comment suggesting that if you want to see all attempts (not just successful ones), you can remove the status filter.

5. Note: It includes a reminder that Azure Activity logging must be enabled to capture these events, with a link to the relevant documentation for setting it up.

In summary, this query is used to find successful or accepted disable or delete actions on Azure Logic Apps workflows from the activity logs.