source
| where Tenant == "<tenant_name>"
| where ident == "runner-job-agent"
| where message contains "JobHistory"
| where message contains "PoolSyncJob"
source
| where Tenant == "<tenant_name>"
| where ident == "runner-job-agent"
| where message contains "JobHistory"
| where message contains "PoolSyncJob"
{ "foo": "bar" }
Testing2 Testing