Introduction When Log Analytics queries return no results, it can be due to data not yet being ingested, querying the wrong workspace, incorrect time ranges, or KQL syntax errors. This affects incident investigation, alerting, and dashboard accuracy.

Symptoms - KQL query returns "No results found" in Log Analytics - Azure Monitor alerts not firing despite known issues - Dashboards showing blank panels - Heartbeat table empty for VMs that should be reporting - Recently deployed agents not appearing in queries

Common Causes - Data ingestion delay (typically 2-5 minutes, can be longer under load) - Query running against wrong workspace - Time range selector set to a period with no data - Log Analytics agent (MMA) not installed or not reporting - Data collection rule (DCR) not configured for AMA

Step-by-Step Fix 1. **Verify data is being ingested**: ```kql union * | summarize count() by Type | order by count_ desc ```

  1. 1.Check which workspace you are querying:
  2. 2.```bash
  3. 3.az monitor log-analytics workspace show \
  4. 4.--resource-group myrg --workspace-name myworkspace
  5. 5.`
  6. 6.For AMA (Azure Monitor Agent), check DCR association:
  7. 7.```bash
  8. 8.az monitor data-collection-rule association list --resource <vm-resource-id>
  9. 9.`
  10. 10.Ensure the DCR includes the tables you need (e.g., Perf, Syslog).
  11. 11.Check agent status on the VM:
  12. 12.```bash
  13. 13.# Linux AMA
  14. 14.sudo systemctl status azuremonitoragent
  15. 15.sudo systemctl restart azuremonitoragent

# Windows AMA Get-Service AzureMonitorAgent ```

Prevention - Set default time range appropriately in Log Analytics - Use Azure Monitor Agent (AMA) instead of legacy MMA - Configure data collection rules before deploying agents - Set up ingestion failure alerts - Test queries with a recent known event before investigating