Share via

Alert rule dynamic threshold preview not working

Cindy 0 Reputation points Microsoft Employee
2026-04-20T17:43:46.68+00:00

I am creating an alert rule which will query from ADX and I would like to leverage Azure Monitor's dynamic threshold. When I attempt to preview the threshold, I repeatedly get this error message along with the lack of a chart generated: "There was a problem with the server. Please try again in a few minutes. Activity ID: 290e511f-b77c-48a5-bb4a-26c9d1259616."

I have tried modifying my query to be extremely barebones to try to determine if it is a query issue or a platform issue. Even with a query such as "Heartbeat

| where TimeGenerated >= ago(14d)

| summarize Count = count() by bin(TimeGenerated, 1h)" is returning the same error.

This capability is crucial as part of the testing process to confirm that this alert is behaving as expected.

User's image

Azure Monitor
Azure Monitor

An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Siva shunmugam Nadessin 9,625 Reputation points Microsoft External Staff Moderator
    2026-04-20T18:21:12.84+00:00

    Hello Cindy,

    Thank you for reaching out to the Microsoft Q&A forum. 

    When investigated we see that you’re running into a backend hiccup in the dynamic-threshold preview chart for your log alert. The preview UI is still in preview and has some specific constraints, so let’s walk through what that means and a few things you can try:

    1. Check your alert frequency
      • Log search alerts with dynamic thresholds don’t support 1-minute frequency.
      • Depending on your frequency, the preview only supports a limited time window: • 5-minute → 6 hours • 10–15 minute → 6 hours or 12 hours • 30 minute → 6 hours, 12 hours, or 1 day • ≥ 1 hour → 6 hours, 12 hours, 1 day, or 2 days
      • If your rule is set to 1 minute or you’re outside these windows, the preview may fail or return no data.
    2. Remove any time-series grouping or dimensions
      • In your screenshot you have “Time series: None,” which is good for simplicity. If you had dimensions selected, try turning them off so you’re only previewing one series.
    3. Click Refresh chart after every change
      • The portal won’t auto-refresh when you tweak query/frequency settings—you need to hit the Refresh link on the left.
    4. Try a smaller time range or shorter bin interval
      • Even though you summarized over 14 days, the preview only pulls up to the allowed range above. Try e.g. | where TimeGenerated >= ago(6h) and a finer bin (e.g. 5 min) to guarantee data in that window.
    5. If the error “There was a problem with the server…” persists, it’s likely an intermittent issue in the preview UI itself. As a workaround, you can pull the dynamic-threshold evaluation logs directly from the azalertsprodweu Kusto cluster using Kusto Explorer. That will show you the computed lower/upper bounds and any violations so you can validate behavior without the chart.

    Follow-up questions to narrow this down:

    1. What evaluation frequency have you configured on the alert rule?
    2. When you run your query in the portal Metrics explorer or time chart (outside of the preview pane), do you see data in the past 6 hours?
    3. Does switching to a 6h time window (e.g. ago(6h)) with a smaller bin size surface any data?
    4. Have you tried in a different region/subscription or incognito browser to rule out portal caching?

    Hope this helps you unblock the preview!

    Reference docs:

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.