Adding new column in POCO does not show up in LAW

[jusso-dev]

Hey there,

Great library, love your work on this!

I have an issue when I attempt to add a new property to the .NET model I send to the target LAW, I input a new string property but it never shows up in the LAW table.. do I need to do anything for this to reflect in the LAW? do I need to manually update the columns in the table on the LAW?

Hope this makes sense.

[Zimmergren]

Hey @jusso-dev ,

In theory, you should be able to adjust your model and send new objects over without any manual tweaks.

Let me know if you've got a scenario to reproduce, or what your queries and data in LAW look like, and we can take a look.

[jusso-dev]

Thanks for getting back to me.

If from your side you add an additional field to your existing class, does it show up in the LAW? All I did was add an additional string property to my class model and it does not show up in the LAW. My KQL is simply "table-name_s" | order by TimeGenerated desc

I've also left it 24 hours and nothing changed.

I can't share anything specific as this is for a Government client of mine.

[Zimmergren]

I just did this, and it works fine on a demo project I've got lying around:

1. Modify my .NET object to introduce a new property:

public class ApplicationSecurityEvent
{
    public string Category { get; set; }
    public string Name { get; set; }
    public string Description { get; set; }
    public string Scope { get; set; }
    public int Severity { get; set; }
    public string Link { get; set; }
    public string SourceRepositoryType { get; set; }
    public string SourceFileLocation { get; set; }
    public string ScanID { get; set; }

    // NEW PROPERTY
    public string NewPropertyAddedToObjectDefinition { get; set; }
}

2. Set a value for this property in my entity before I send it off with the LogAnalytics client:

var securityItem = new ApplicationSecurityEvent
{
    Name = secItems[r].Name,
    Description = secItems[r].Description,
    Severity = secItems[r].Severity,
    Link = secItems[r].Link,
    ScanID = scanId,
    Category = secItems[r].Category,
    Scope = secItems[r].Scope,
    SourceFileLocation = secItems[r].SourceFileLocation,
    SourceRepositoryType = GetRandomSource(),

    // SET A VALUE FOR THE NEW PROPERTY
    NewPropertyAddedToObjectDefinition = "TESTING 123"
};

3. Query for the result, which shows that this property was successfully added as a string in the LAW data set:
   

It looks like it's working as expected. I have tested on two projects now, with the same results.
Did you populate a value for the new property, or is it empty when you send it off?

[jusso-dev]

Thanks so much for doing some digging, makes me feel less insane trying the same thing and not seeing results. I'll keep digging and keep this thread posted.

Thanks again!

[Zimmergren]

You bet. Let me know how it goes, and let's close this issue when you're ready as it looks like the code works as expected.
Feel free to re-open or continue here with any additional findings.