az monitor scheduled-query create condition

[vandre]

Need more details about the format of the condition argument. What is the purpose of the bolded text below on the condition :

--condition "count 'Placeholder_1' > 360 resource id _ResourceID at least 1 violations out of 5 aggregated points"

The example in the documentation is written as:

az monitor scheduled-query create -g {rg} -n {name1} --scopes {vm_id} --condition "count 'Placeholder_1' > 360 resource id _ResourceID at least 1 violations out of 5 aggregated points" --condition-query Placeholder_1="union Event, Syslog | where TimeGenerated > ago(1h) | where EventLevelName=='Error' or SeverityLevel=='err'" --description "Test rule"

By trial an error I noticed that the following doesn't work: --condition "count 'Placeholder_1' > 360 "

Is it just a comment? can it be changed in any way?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 29ac6be4-8618-641e-a8f8-6deb9b47cb6f
• Version Independent ID: a9477987-1c59-212d-52ae-8e18e1e2b33e
• Content: az monitor scheduled-query
• Content Source: latest/docs-ref-autogen/monitor/scheduled-query.yml
• Service: monitoring-and-diagnostics
• GitHub Login: Robert Outlaw (@rloutlaw)
• Microsoft Alias: routlaw

[yonzhan]

monitor

[YuanyuanNi]

Hi， Victor Andres Morales (@vandre) “resource id _ResourceID at least 1 violations out of 5 aggregated points” is part of the condition, not a comment.
Best wishes.

[antonGritsenko]

Ni Yuanyuan (@YuanyuanNi) but where this format is documented? Even if you list an existing rules there is nothing even close to this syntax.

[szeestraten]

Any news on improving the documentation?
It is pretty impossible to reverse engineer the values of the criteria existing rules into the condition for this command.