Merge pull request #54090 from bwren/mon-solution

PRMerger7 · web-flow · commit 6a9c2d6f343b · 2018-10-04T05:05:27.000+08:00
Update to monitor solutions
diff --git a/articles/monitoring/monitoring-solutions-resources-searches-alerts.md b/articles/monitoring/monitoring-solutions-resources-searches-alerts.md
@@ -83,7 +83,7 @@ Each property of a saved search is described in the following table.
 | query | Query to run. |
 
 > [!NOTE]
-> You may need to use escape characters in the query if it includes characters that could be interpreted as JSON.  For example, if your query was **Type: AzureActivity OperationName:"Microsoft.Compute/virtualMachines/write"**, it should be written in the solution file as **Type: AzureActivity OperationName:\\"Microsoft.Compute/virtualMachines/write\\"**.
+> You may need to use escape characters in the query if it includes characters that could be interpreted as JSON.  For example, if your query was **AzureActivity | OperationName:"Microsoft.Compute/virtualMachines/write"**, it should be written in the solution file as **AzureActivity | OperationName:/\"Microsoft.Compute/virtualMachines/write\"**.
 
 ## Alerts
 [Azure Log alerts](../monitoring-and-diagnostics/monitor-alerts-unified-log.md) are created by Azure Alert rules that run specified log queries at regular intervals.  If the results of the query match specified criteria, an alert record is created and one or more actions are run using [Action Groups](../monitoring-and-diagnostics/monitoring-action-groups.md).  
