HI all,
I created two public ips, and i'am trying to use the resourceChanges to extract some information about changes creation deletes and so on the subscription.
when i run this query:
ResourceChanges
| where properties.targetResourceType == "microsoft.network/publicipaddresses"
| extend changeType_ = tostring(properties.changeType)
| extend changedBy_ = tostring(parse_json(tostring(properties.changeAttributes)).changedBy)
| extend timestamp_ = tostring(parse_json(tostring(properties.changeAttributes)).timestamp)
i got almost all the logs correctly (see attachment)
c
but for the changedBy i can't see who creates the public ips and i got value "Unspecified" but if i make even a little update i got my account name in the field of the changedBy.
for a major project we are extracting this values but even for create delete or update we gon unspecified in more than one case.
if someone can explain why this is happening i will really appreciate.
Best regards and thx for your time
HI all,
I created two public ips, and i'am trying to use the resourceChanges to extract some information about changes creation deletes and so on the subscription.
when i run this query:
ResourceChanges
| where properties.targetResourceType == "microsoft.network/publicipaddresses"
| extend changeType_ = tostring(properties.changeType)
| extend changedBy_ = tostring(parse_json(tostring(properties.changeAttributes)).changedBy)
| extend timestamp_ = tostring(parse_json(tostring(properties.changeAttributes)).timestamp)
i got almost all the logs correctly (see attachment)
c
but for the changedBy i can't see who creates the public ips and i got value "Unspecified" but if i make even a little update i got my account name in the field of the changedBy.
for a major project we are extracting this values but even for create delete or update we gon unspecified in more than one case.
if someone can explain why this is happening i will really appreciate.
Best regards and thx for your time