Forum Discussion
Deleted
Feb 11, 2019Can any query be saved as a function ?
I have written a query that is a bit involved, it is multi-line and it contains a union and a call to lookup. It works well as a query, but if I save it as a function and then try to run that, I get an error:
" 'lookup' operator: Failed to resolve table or column expression named 'domain_specific' "
Is this a known limitation or is this just a matter of parsing and I can add parenthesis somewhere or something similar ?
If you think this is some kind of a bug better log official case to MSFT. Seems the combination of using let with workspace() operator is causing the error. I for sure haven't seen this behavior documented.
Hi,
Can you provide the query or may be some example to understand what kind of operators are you using there? Keep in mind that in function you cannot use another function.
- Deleted
You mean my function can't use substring or extract for example ?
I have tested that, and it works. I guess you mean other custom functions, I haven't done that.
This is a shorter version of my query that also gets the same error ( with names changed ) :
let short = workspace("something").Event_CL | distinct TenantId_s | extend stn=substring(TenantId_s, 1, 5);
let Parsed_logs = Whatever_CL | parse RawData with * "[[[[" x1 "] [" x2 "] [] [" x3 "] [203] [] [] [] [string] [" x4 "] [] [1] [] [203] [" x5 " line:" x6 "]" x7 | project x1,x2,x3,x4,x5,x6, compId;
Parsed_logs | extend stn = extract("(yyy)(\\d{5}).*",2, compId ) | lookup kind=leftouter short on stn | project-away stnHi,
Yes by function I mean another custom function. Things like count(), summarize, extend are operators in the query language. I hope that makes it a little bit easier. I thing the problem comes that you are referring to another workspace in the function. As far as I understand you cannot use workspace() operator in functions. I do not think that is documented. It would be good if it is. Try to use the same query but without referencing another workspace. If it works than that is the problem.