Forum Discussion

Anonymous

Feb 11, 2019

Solved

Can any query be saved as a function ?

I have written a query that is a bit involved, it is multi-line and it contains a union and a call to lookup. It works well as a query, but if I save it as a function and then try to run that, I get ...

azure monitor

Kusto language

Stanislav_Zhelyazkov
Feb 13, 2019
If you think this is some kind of a bug better log official case to MSFT. Seems the combination of using let with workspace() operator is causing the error. I for sure haven't seen this behavior documented.

Stanislav_Zhelyazkov

MVP

Feb 13, 2019

Hi,

I am not sure if I understand this:

The workspace command alone works in the scope of a function, I have tried all the variations. In this case the error is informative, it is only lookup that fails when run from inside a function.

In my case if you use the workspace() operator in query that works. That is expected behavior as that is the intention of the operator. When you save a query that has workspace() operator in it as function and you try to call the saved function you will get error. At least I got error. This means that using workspace() operator in a function is not supported. Have you tried saving the exact query you have but without using workspace() operator and than calling that function?

Anonymous

Feb 13, 2019

I meant I have successfully created a function that uses a different workspace and works correctly, both as a query and as a custom function, this one in particular :

workspace("something").Event_CL | distinct Bla | extend stn=substring(Bla, 1, 5);

But, since you encountered an error, I have tried your suggestion and indeed the complete query works if I remove the call to workspace. It seems the combination of workspace and lookup break something, which is interesting.

Not quite sure yet what to do with the knowledge though.

Stanislav_Zhelyazkov
MVP
Feb 13, 2019
If you think this is some kind of a bug better log official case to MSFT. Seems the combination of using let with workspace() operator is causing the error. I for sure haven't seen this behavior documented.
- Anonymous
  Mar 03, 2019
  I have opened a support case for this behavior, and the Kusto team acknowledged this is a bug. I was told it should be fixed around the 6th of March.