Alert rule dynamic threshold preview not working

Cindy 5 Reputation points • Microsoft Employee

I am creating an alert rule which will query from ADX and I would like to leverage Azure Monitor's dynamic threshold. When I attempt to preview the threshold, I repeatedly get this error message along with the lack of a chart generated: "There was a problem with the server. Please try again in a few minutes. Activity ID: 290e511f-b77c-48a5-bb4a-26c9d1259616."

I have tried modifying my query to be extremely barebones to try to determine if it is a query issue or a platform issue. Even with a query such as "Heartbeat

| where TimeGenerated >= ago(14d)

| summarize Count = count() by bin(TimeGenerated, 1h)" is returning the same error.

This capability is crucial as part of the testing process to confirm that this alert is behaving as expected.

👁 User's image

0 comments No comments
Sign in to comment

1 answer

  1. Siva shunmugam Nadessin 10,895 Reputation points • Microsoft External Staff • Moderator

    Hello Cindy,

    Thank you for reaching out to the Microsoft Q&A forum. 

    When investigated we see that you’re running into a backend hiccup in the dynamic-threshold preview chart for your log alert. The preview UI is still in preview and has some specific constraints, so let’s walk through what that means and a few things you can try:

    1. Check your alert frequency
      • Log search alerts with dynamic thresholds don’t support 1-minute frequency.
      • Depending on your frequency, the preview only supports a limited time window: • 5-minute → 6 hours • 10–15 minute → 6 hours or 12 hours • 30 minute → 6 hours, 12 hours, or 1 day • ≥ 1 hour → 6 hours, 12 hours, 1 day, or 2 days
      • If your rule is set to 1 minute or you’re outside these windows, the preview may fail or return no data.
    2. Remove any time-series grouping or dimensions
      • In your screenshot you have “Time series: None,” which is good for simplicity. If you had dimensions selected, try turning them off so you’re only previewing one series.
    3. Click Refresh chart after every change
      • The portal won’t auto-refresh when you tweak query/frequency settings—you need to hit the Refresh link on the left.
    4. Try a smaller time range or shorter bin interval
      • Even though you summarized over 14 days, the preview only pulls up to the allowed range above. Try e.g. | where TimeGenerated >= ago(6h) and a finer bin (e.g. 5 min) to guarantee data in that window.
    5. If the error “There was a problem with the server…” persists, it’s likely an intermittent issue in the preview UI itself. As a workaround, you can pull the dynamic-threshold evaluation logs directly from the azalertsprodweu Kusto cluster using Kusto Explorer. That will show you the computed lower/upper bounds and any violations so you can validate behavior without the chart.

    Follow-up questions to narrow this down:

    1. What evaluation frequency have you configured on the alert rule?
    2. When you run your query in the portal Metrics explorer or time chart (outside of the preview pane), do you see data in the past 6 hours?
    3. Does switching to a 6h time window (e.g. ago(6h)) with a smaller bin size surface any data?
    4. Have you tried in a different region/subscription or incognito browser to rule out portal caching?

    Hope this helps you unblock the preview!

    Reference docs:

    1. Siva shunmugam Nadessin 10,895 Reputation points • Microsoft External Staff • Moderator

      Hello Cindy,

      Just checking in to see if the solution shared above help you to resolve your issue. please reach out to us If you have any further questions.

      Thanks

    2. Siva shunmugam Nadessin 10,895 Reputation points • Microsoft External Staff • Moderator

      Hello Cindy, kindly “Accept Answer” this can be beneficial to other community members.

    3. Daman Preet 0 Reputation points

      I am running into the same issue and today Microsoft made it available as GA still same thing could you please suggest ?
      I am running the query for past 6 hours and 5 min timeframe

    Sign in to comment
Sign in to answer

Your answer